Apache Shiro User Manual (3) Shiro Authorization

Authorization is access control, which will determine whether the user has the corresponding access rights to resources in the application.

For example, determine whether a user has permission to view pages, permission to edit data, permission to have a certain button, and whether he has permission to print, etc.

1. Three elements of authorization

Authorization has three core elements: permissions, roles and users.

Permissions

Permissions are the core element of the Apache Shiro security mechanism. It clearly states the allowed behavior and performance in the application. A well-formatted permissions statement clearly communicates the permissions a user has on the resource.

Most resources will support typical CRUD operations (create, read, update, delete), but it makes sense for any operation to be based on a specific resource. Therefore, the fundamental idea of permission declaration is based on resources and operations.

Through the permission declaration, we can only understand what this permission can do in the application, but we cannot determine who has this permission.

So, we need to associate users and permissions in the application.

The usual approach is to assign permissions to a role and then associate this role with one or more users.

Permission declaration and granularity

Shiro permission declaration usually uses expressions separated by colons. As mentioned before, a permission expression can clearly specify the resource type, allowed operations, and accessible data. At the same time, Shiro permission expressions support simple wildcards, allowing for more flexible permission settings.

The following uses examples to illustrate permission expressions.

User data can be queried

User:view

User data can be queried or edited

User:view,edit

Can be edited Perform all operations on user data

User:* or user

Can edit user data with id 123

User:edit:123

Role

Shiro supports two role modes:

1. Traditional role: A role represents a series of operations. When an operation needs to be authorized and verified, you only need to determine whether it is the role. Can. This kind of role permissions is relatively simple and vague, which is not conducive to expansion.

2. Permission role: A role has a set of permissions. During authorization verification, it is necessary to determine whether the current role has the permission. This kind of role permissions can provide a detailed permission description for the role, which is suitable for more complex permission designs.

The authorization implementation of the two role modes will be described in detail below.

2. Authorization implementation

Shiro supports three ways to implement the authorization process:

Coding implementation
Annotation implementation
JSP Taglig implementation

1. Encoding-based authorization implementation

1.1 Traditional role-based authorization implementation

When you need to verify whether a user has a certain role, you can call the hasRole* method of the Subject instance to verify.

Subject currentUser = SecurityUtils.getSubject(); if (currentUser.hasRole("administrator")) { //show the admin button } else { //don't show the button? Grey it out? }

The relevant verification methods are as follows:

Subject method The verification method

Subject currentUser = SecurityUtils.getSubject(); //guarantee that the current user is a bank teller and //therefore allowed to open the account: currentUser.checkRole("bankTeller"); openBankAccount();

Permission printPermission = new PrinterPermission("laserjet4400n", "print"); Subject currentUser = SecurityUtils.getSubject(); if (currentUser.isPermitted(printPermission)) { //show the Print button } else { //don't show the button? Grey it out? } Permission printPermission = new PrinterPermission("laserjet4400n", "print"); Subject currentUser = SecurityUtils.getSubject(); if (currentUser.isPermitted(printPermission)) { //show the Print button } else { //don't show the button? Grey it out? }

Subject currentUser = SecurityUtils.getSubject(); if (currentUser.isPermitted("printer:print:laserjet4400n")) { //show the Print button } else { //don't show the button? Grey it out? }

Subject currentUser = SecurityUtils.getSubject(); //guarantee that the current user is permitted //to open a bank account: Permission p = new AccountPermission("open"); currentUser.checkPermission(p); openBankAccount();

Subject currentUser = SecurityUtils.getSubject(); //guarantee that the current user is permitted //to open a bank account: currentUser.checkPermission("account:open"); openBankAccount();

@RequiresAuthentication public void updateAccount(Account userAccount) { //this method will only be invoked by a //Subject that is guaranteed authenticated ... } @ RequiresGuest

@RequiresPermissions("account:create") public void createAccount(Account account) { //this method will only be invoked by a Subject //that is permitted to create an account ... } @RequiresRoles

<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>

 Hi there! Please Login or Signup today! 

 Welcome back John! Not John? Click here to login. 

 Update your contact information.  notAuthenticated标签

 Please login in order to update your credit card information. 

Hello, , how are you today?

 Administer the system 

 Sorry, you are not allowed to administer the system. 

 You are either a developer, project manager, or administrator. 

 Create a new User 

 Create a new User