5

I'm trying to implement a modular authentication/authorization app. I was wondering if Shiro is the correct choice. What I want to get is to have a system to which I can plug in and maybe in later time exchange some authentication endpoints and also authorization endpoints. I want to be able to use shiro for authentication (for example I would implement facebook plugin for shiro, or ldap plugin for shiro and I can easly plug it into my authentication/authorization app). I also may want to have authorization implemented using different framework than shiro.

I was wondering if shiro with it's custom session and it's subjects and realms is capable of doing such things as I described ? Currently I see Shiro as very dynamic framework, which allows to do such things, but I might be wrong because I never use earlier. Custom authentication modules (imo) might be plugged in as new realms, but I'm not sure if this will work with authorization?

I also don't understand how shiro roles and permission system may be used when I want to setup restrictions to web application, for example I want to give restrictions to the given url / group of urls. I think that the only way to implement that is to create a custom mapper which will map given role to permissions. For example in some database I will have all urls, and in separate table I will have list of roles. Then I will add to every role a group of URLs. I don't see how could I use shiro permission system to implement URL restrictions.

Please tell me if shiro is a good choice, or maybe I should go into other framework (spring security maybe?)

aurelius
  • 3,946
  • 7
  • 40
  • 73
Ma Kro
  • 1,232
  • 4
  • 20
  • 34

1 Answers1

3

I find myself in your position now, I have to choose between Shiro and Spring Security.

I was able to implement what have you described with both tools but from what I have learned so far is that SS has a more loose coupled architecture thus more extensible to your specific needs and easier to customize.

One reason behind my opinion is that implementing certain feature I need, access policy for a role, was much easier using SS.

So between Shiro, SS, Heras, OACC, OWASP... Shiro is a second solution and SS would be the first.

aurelius
  • 3,946
  • 7
  • 40
  • 73
  • 2
    Thanks for the answer. I already chose Shiro, so I hope it will be good enough. Also shiro has one coll feature - which is distributed session. SS doesn't have it (from what I know), so this was the main argument for me after Shiro. – Ma Kro Dec 17 '14 at 19:46