You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shiro.apache.org by "paulmillar (via GitHub)" <gi...@apache.org> on 2025/12/22 02:16:06 UTC
[D] Making OIDC work with Shiro [shiro]
GitHub user paulmillar created a discussion: Making OIDC work with Shiro
Hi,
I'm interested in running some software (Apache Jena Fuseki) where the user authenticates via Open ID Connect (OIDC). Fuseki uses Apache Shiro as the authentication and authorisation layer, so I think this would most naturally work through Shiro's support for OIDC.
From reading the documentation, I understand that, within Shiro's architecture, the mechanism through which a user authenticates is called a _realm_. Realms are an extendable through plugins, allowing Shiro to support many different authentication schemes, provided there is a Shiro-specific realm plugin that implements that authentication scheme.
Therefore, one way to add OIDC support to Fuseki, would involve identify an OIDC realm plugin.
The Shiro documentation doesn't seem to provide a definitive list of available/build-in realms. Some documentation mention realms in passing, but the best list seems to come from [the JavaDoc](https://javadoc.io/doc/org.apache.shiro/shiro-core/latest/org/apache/shiro/realm/package-summary.html).
From a cursory scan of the Shiro source code, I found various reasonable realms (LDAP, Jdbc, JNDI, Active directory, ...) but no OIDC support.
Also, the Shiro documentation doesn't seem to have any mention of OIDC. This is puzzling because OIDC is (perhaps) the primary mechanism for supporting federated authentication and is fairly widely adopted in different environments.
Through my investigation, I found the [fuseki-oidc repo](https://github.com/linked-solutions/fuseki-oidc). This repo seems to provide the code needed to deploy Fuseki so it supports OIDC authentication. The repo appears to include code targeting Shiro, adding support for OIDC; however, I currently lack the knowledge to fully evaluate whether this approach is "correct". Also, the repo appears to be abandoned, with (at the current time) no updates for over five years.
I also found the article [Apache Zeppelin OIDC Single-Sign-On using Pac4j and Keycloak](https://medium.com/@diogo.oliveira_42955/apache-zeppelin-oidc-single-sign-on-using-pac4j-and-keycloak-2472b6a22033). This discusses how to use Shiro's integration with Pac4j along with Pac4j's support for OIDC to add support for OIDC authentication to Zeppelin.
From my (limited) understanding, this approaches is technically correct, but it seems to introduce unnecessary complexity by adding an additional layer in front of Shiro: Pac4j.
Another approach might be to use an OAuth2/OIDC filter that intercepts HTTP requests. This would only pass on an HTTP request to Shiro once the user's identity has been established. Information about the user would be forward (e.g., via HTTP request headers, JNDI, ...). This, too, would seem to introduce unnecessary complexity.
This issue is regarding the apparent lack of documentation describing how to add OIDC support to an application that uses Shiro.
I'm hoping to learn whether the best approach would be to try to build an OIDC Shiro realm, or to use Pac4j, or to add a OIDC filter, or some other approach.
Cheers,
Paul.
GitHub link: https://github.com/apache/shiro/discussions/2423
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "paulmillar (via GitHub)" <gi...@apache.org>.
GitHub user paulmillar closed a discussion: Making OIDC work with Shiro
Hi,
I'm interested in running some software (Apache Jena Fuseki) where the user authenticates via Open ID Connect (OIDC). Fuseki uses Apache Shiro as the authentication and authorisation layer, so I think this would most naturally work through Shiro's support for OIDC.
From reading the documentation, I understand that, within Shiro's architecture, the mechanism through which a user authenticates is called a _realm_. Realms are an extendable through plugins, allowing Shiro to support many different authentication schemes, provided there is a Shiro-specific realm plugin that implements that authentication scheme.
Therefore, one way to add OIDC support to Fuseki, would involve identify an OIDC realm plugin.
The Shiro documentation doesn't seem to provide a definitive list of available/build-in realms. Some documentation mention realms in passing, but the best list seems to come from [the JavaDoc](https://javadoc.io/doc/org.apache.shiro/shiro-core/latest/org/apache/shiro/realm/package-summary.html).
From a cursory scan of the Shiro source code, I found various reasonable realms (LDAP, Jdbc, JNDI, Active directory, ...) but no OIDC support.
Also, the Shiro documentation doesn't seem to have any mention of OIDC. This is puzzling because OIDC is (perhaps) the primary mechanism for supporting federated authentication and is fairly widely adopted in different environments.
Through my investigation, I found the [fuseki-oidc repo](https://github.com/linked-solutions/fuseki-oidc). This repo seems to provide the code needed to deploy Fuseki so it supports OIDC authentication. The repo appears to include code targeting Shiro, adding support for OIDC; however, I currently lack the knowledge to fully evaluate whether this approach is "correct". Also, the repo appears to be abandoned, with (at the current time) no updates for over five years.
I also found the article [Apache Zeppelin OIDC Single-Sign-On using Pac4j and Keycloak](https://medium.com/@diogo.oliveira_42955/apache-zeppelin-oidc-single-sign-on-using-pac4j-and-keycloak-2472b6a22033). This discusses how to use Shiro's integration with Pac4j along with Pac4j's support for OIDC to add support for OIDC authentication to Zeppelin.
From my (limited) understanding, this approaches is technically correct, but it seems to introduce unnecessary complexity by adding an additional layer in front of Shiro: Pac4j.
Another approach might be to use an OAuth2/OIDC filter that intercepts HTTP requests. This would only pass on an HTTP request to Shiro once the user's identity has been established. Information about the user would be forward (e.g., via HTTP request headers, JNDI, ...). This, too, would seem to introduce unnecessary complexity.
This issue is regarding the apparent lack of documentation describing how to add OIDC support to an application that uses Shiro.
I'm hoping to learn whether the best approach would be to try to build an OIDC Shiro realm, or to use Pac4j, or to add a OIDC filter, or some other approach.
Cheers,
Paul.
GitHub link: https://github.com/apache/shiro/discussions/2423
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "paulmillar (via GitHub)" <gi...@apache.org>.
GitHub user paulmillar closed a discussion: Making OIDC work with Shiro
Hi,
I'm interested in running some software (Apache Jena Fuseki) where the user authenticates via Open ID Connect (OIDC). Fuseki uses Apache Shiro as the authentication and authorisation layer, so I think this would most naturally work through Shiro's support for OIDC.
From reading the documentation, I understand that, within Shiro's architecture, the mechanism through which a user authenticates is called a _realm_. Realms are an extendable through plugins, allowing Shiro to support many different authentication schemes, provided there is a Shiro-specific realm plugin that implements that authentication scheme.
Therefore, one way to add OIDC support to Fuseki, would involve identify an OIDC realm plugin.
The Shiro documentation doesn't seem to provide a definitive list of available/build-in realms. Some documentation mention realms in passing, but the best list seems to come from [the JavaDoc](https://javadoc.io/doc/org.apache.shiro/shiro-core/latest/org/apache/shiro/realm/package-summary.html).
From a cursory scan of the Shiro source code, I found various reasonable realms (LDAP, Jdbc, JNDI, Active directory, ...) but no OIDC support.
Also, the Shiro documentation doesn't seem to have any mention of OIDC. This is puzzling because OIDC is (perhaps) the primary mechanism for supporting federated authentication and is fairly widely adopted in different environments.
Through my investigation, I found the [fuseki-oidc repo](https://github.com/linked-solutions/fuseki-oidc). This repo seems to provide the code needed to deploy Fuseki so it supports OIDC authentication. The repo appears to include code targeting Shiro, adding support for OIDC; however, I currently lack the knowledge to fully evaluate whether this approach is "correct". Also, the repo appears to be abandoned, with (at the current time) no updates for over five years.
I also found the article [Apache Zeppelin OIDC Single-Sign-On using Pac4j and Keycloak](https://medium.com/@diogo.oliveira_42955/apache-zeppelin-oidc-single-sign-on-using-pac4j-and-keycloak-2472b6a22033). This discusses how to use Shiro's integration with Pac4j along with Pac4j's support for OIDC to add support for OIDC authentication to Zeppelin.
From my (limited) understanding, this approaches is technically correct, but it seems to introduce unnecessary complexity by adding an additional layer in front of Shiro: Pac4j.
Another approach might be to use an OAuth2/OIDC filter that intercepts HTTP requests. This would only pass on an HTTP request to Shiro once the user's identity has been established. Information about the user would be forward (e.g., via HTTP request headers, JNDI, ...). This, too, would seem to introduce unnecessary complexity.
This issue is regarding the apparent lack of documentation describing how to add OIDC support to an application that uses Shiro.
I'm hoping to learn whether the best approach would be to try to build an OIDC Shiro realm, or to use Pac4j, or to add a OIDC filter, or some other approach.
Cheers,
Paul.
GitHub link: https://github.com/apache/shiro/discussions/2423
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
GitHub user lprimak added a comment to the discussion: Making OIDC work with Shiro
Hi, Paul,
OIDC is an authentication mechanism. Usually, you have to pick one authentication mechanism, not both.
If you want to use OIDC, you have to use an OIDC provider (Pac4j/Keycloak, etc). In that case,
Shiro becomes authorization provider only, and realm needs integration with the authentication provider (OIDC)
This is why there is additional complexity with Pac4j.
I am not familiar with Jena / Fuseki to speak specifically of those two.
GitHub link: https://github.com/apache/shiro/discussions/2423#discussioncomment-15850407
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "paulmillar (via GitHub)" <gi...@apache.org>.
GitHub user paulmillar closed the discussion with a comment: Making OIDC work with Shiro
Hi @lprimak ,
Thanks for the reply -- although I think you misunderstood the intended focus on this discussion point.
The underlying issue here is that OIDC is now a well-established and widely adopted framework to support SSO and federated authentication. However, to the best of my knowledge, Apache Shiro has no official support for OIDC. There is no support at the coding level (plugin/realm) nor documentation (tutorials, howto, best practice, ...).
I agree that using Zeppelin + pac4j introduces undesirable complexity. However, I see this article as indicative of the underlying problem: the need to support OIDC-based authentication and the lack of OIDC support in Apache Shiro.
GitHub link: https://github.com/apache/shiro/discussions/2423#discussioncomment-16390626
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "paulmillar (via GitHub)" <gi...@apache.org>.
GitHub user paulmillar reopened a discussion: Making OIDC work with Shiro
Hi,
I'm interested in running some software (Apache Jena Fuseki) where the user authenticates via Open ID Connect (OIDC). Fuseki uses Apache Shiro as the authentication and authorisation layer, so I think this would most naturally work through Shiro's support for OIDC.
From reading the documentation, I understand that, within Shiro's architecture, the mechanism through which a user authenticates is called a _realm_. Realms are an extendable through plugins, allowing Shiro to support many different authentication schemes, provided there is a Shiro-specific realm plugin that implements that authentication scheme.
Therefore, one way to add OIDC support to Fuseki, would involve identify an OIDC realm plugin.
The Shiro documentation doesn't seem to provide a definitive list of available/build-in realms. Some documentation mention realms in passing, but the best list seems to come from [the JavaDoc](https://javadoc.io/doc/org.apache.shiro/shiro-core/latest/org/apache/shiro/realm/package-summary.html).
From a cursory scan of the Shiro source code, I found various reasonable realms (LDAP, Jdbc, JNDI, Active directory, ...) but no OIDC support.
Also, the Shiro documentation doesn't seem to have any mention of OIDC. This is puzzling because OIDC is (perhaps) the primary mechanism for supporting federated authentication and is fairly widely adopted in different environments.
Through my investigation, I found the [fuseki-oidc repo](https://github.com/linked-solutions/fuseki-oidc). This repo seems to provide the code needed to deploy Fuseki so it supports OIDC authentication. The repo appears to include code targeting Shiro, adding support for OIDC; however, I currently lack the knowledge to fully evaluate whether this approach is "correct". Also, the repo appears to be abandoned, with (at the current time) no updates for over five years.
I also found the article [Apache Zeppelin OIDC Single-Sign-On using Pac4j and Keycloak](https://medium.com/@diogo.oliveira_42955/apache-zeppelin-oidc-single-sign-on-using-pac4j-and-keycloak-2472b6a22033). This discusses how to use Shiro's integration with Pac4j along with Pac4j's support for OIDC to add support for OIDC authentication to Zeppelin.
From my (limited) understanding, this approaches is technically correct, but it seems to introduce unnecessary complexity by adding an additional layer in front of Shiro: Pac4j.
Another approach might be to use an OAuth2/OIDC filter that intercepts HTTP requests. This would only pass on an HTTP request to Shiro once the user's identity has been established. Information about the user would be forward (e.g., via HTTP request headers, JNDI, ...). This, too, would seem to introduce unnecessary complexity.
This issue is regarding the apparent lack of documentation describing how to add OIDC support to an application that uses Shiro.
I'm hoping to learn whether the best approach would be to try to build an OIDC Shiro realm, or to use Pac4j, or to add a OIDC filter, or some other approach.
Cheers,
Paul.
GitHub link: https://github.com/apache/shiro/discussions/2423
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "paulmillar (via GitHub)" <gi...@apache.org>.
GitHub user paulmillar added a comment to the discussion: Making OIDC work with Shiro
Hi @lprimak,
Thanks for the feedback.
Could you share the list of "good results" that you found?
Cheers,
Paul.
GitHub link: https://github.com/apache/shiro/discussions/2423#discussioncomment-16404955
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "paulmillar (via GitHub)" <gi...@apache.org>.
GitHub user paulmillar added a comment to the discussion: Making OIDC work with Shiro
Thanks for sharing these links. I will go through them over the next few days.
GitHub link: https://github.com/apache/shiro/discussions/2423#discussioncomment-16418878
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
GitHub user lprimak added a comment to the discussion: Making OIDC work with Shiro
Hi, Paul,
You are correct that "OIDC is now a well-established and widely adopted framework"
This is why there are many implementations of OIDC already. Shiro doesn't need one of it's own,
as there are many examples of integration with already-existing OIDC frameworks.
There is no "official" Shiro-OIDC integration because there are many use cases and many types of possible integrations.
Again, no need to have an "official" one.
A quick google search yielded a lot of good results for me.
You are certainly right that there is no documentation of a way to integrate OIDC with Shiro.
Perhaps you would like to contribute one?
GitHub link: https://github.com/apache/shiro/discussions/2423#discussioncomment-16400353
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org
Re: [D] Making OIDC work with Shiro [shiro]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
GitHub user lprimak added a comment to the discussion: Making OIDC work with Shiro
I googled "apache shiro oidc integration examples"
https://github.com/corzia/oidc-example
https://www.programmersought.com/article/82273374798/
https://blog.bmarwell.de/2022/04/26/apache-shiro-jwt-authentication-jjwt.html
there are a lot more as well, this is just a sample
GitHub link: https://github.com/apache/shiro/discussions/2423#discussioncomment-16412753
----
This is an automatically sent email for issues@shiro.apache.org.
To unsubscribe, please send an email to: issues-unsubscribe@shiro.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@shiro.apache.org
For additional commands, e-mail: issues-help@shiro.apache.org