OT:Security Options

[Zoran Avtarovski <zo...@sparecreative.com>]

Hi Guys,

We have to add EntraID (OpenID) support to one of our applications and 
as such are going to move away from Tomcat's Container managed security.

After some reading we found that both Shiro and Spring Security appear 
to be good solutions and I was hoping to tap in the groups knowledge as 
to the pros and cons of each for a struts based app.

Key points we are mindful of are:

  * We are currently on Struts 6 but will be moving to 7 in the next 12
    months
  * We already use the struts spring plugin for dependency injection
  * We will need to support JDBC auth in combination with two other AD
    sources

Any constructive advice is appreciated as we are not out to start 
something here just looking for the best solution with clear requirements.

Z.

Re: OT:Security Options

[Lukasz Lenart <lu...@apache.org>]

pt., 12 cze 2026 o 08:57 Zoran Avtarovski <zo...@sparecreative.com> napisał(a):
>   * We already use the struts spring plugin for dependency injection
>   * We will need to support JDBC auth in combination with two other AD
>     sources

Since you are already using Spring I would suggest continuing to use
Spring Security. Shiro includes support for Spring [1] as well, so
it's matter of which one matches your requirements better.

[1] https://shiro.apache.org/spring-framework.html


Regards
Łukasz

---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org