public abstract class AuthorizingRealm extends AuthenticatingRealm implements Authorizer, Initializable, PermissionResolverAware, RolePermissionResolverAware
AuthorizingRealm
extends the AuthenticatingRealm
's capabilities by adding Authorization
(access control) support.
This implementation will perform all role and permission checks automatically (and subclasses do not have to
write this logic) as long as the
getAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection)
method returns an
AuthorizationInfo
. Please see that method's JavaDoc for an in-depth explanation.
If you find that you do not want to utilize the AuthorizationInfo
construct,
you are of course free to subclass the AuthenticatingRealm
directly instead and
implement the remaining Realm interface methods directly. You might do this if you want have better control
over how the Role and Permission checks occur for your specific data source. However, using AuthorizationInfo
(and its default implementation SimpleAuthorizationInfo
) is sufficient in the large
majority of Realm cases.SimpleAuthorizationInfo
Constructor and Description |
---|
AuthorizingRealm() |
AuthorizingRealm(CacheManager cacheManager) |
AuthorizingRealm(CacheManager cacheManager,
CredentialsMatcher matcher) |
AuthorizingRealm(CredentialsMatcher matcher) |
Modifier and Type | Method and Description |
---|---|
protected void |
afterCacheManagerSet()
This implementation attempts to acquire an authentication cache if one is not already configured.
|
protected void |
checkPermission(Permission permission,
AuthorizationInfo info) |
void |
checkPermission(PrincipalCollection principal,
Permission permission)
Ensures a subject/user
Permission.implies(Permission) implies} the specified Permission. |
void |
checkPermission(PrincipalCollection subjectIdentifier,
String permission)
Ensures the corresponding Subject/user implies the specified permission String.
|
protected void |
checkPermissions(Collection<Permission> permissions,
AuthorizationInfo info) |
void |
checkPermissions(PrincipalCollection principal,
Collection<Permission> permissions)
Ensures the corresponding Subject/user
implies all of the
specified permission strings. |
void |
checkPermissions(PrincipalCollection subjectIdentifier,
String... permissions)
Ensures the corresponding Subject/user
implies all of the
specified permission strings. |
void |
checkRole(PrincipalCollection principal,
String role)
Asserts the corresponding Subject/user has the specified role by returning quietly if they do or throwing an
AuthorizationException if they do not. |
protected void |
checkRole(String role,
AuthorizationInfo info) |
protected void |
checkRoles(Collection<String> roles,
AuthorizationInfo info) |
void |
checkRoles(PrincipalCollection principal,
Collection<String> roles)
Asserts the corresponding Subject/user has all of the specified roles by returning quietly if they do or
throwing an
AuthorizationException if they do not. |
void |
checkRoles(PrincipalCollection principal,
String... roles)
Same as
checkRoles(PrincipalCollection subjectPrincipal, Collection<String> roleIdentifiers) but doesn't require a collection
as an argument. |
protected void |
clearCachedAuthorizationInfo(PrincipalCollection principals)
Clears out the AuthorizationInfo cache entry for the specified account.
|
protected void |
doClearCache(PrincipalCollection principals)
Calls
super.doClearCache to ensure any cached authentication data is removed and then calls
clearCachedAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection) to remove any cached
authorization data. |
protected abstract AuthorizationInfo |
doGetAuthorizationInfo(PrincipalCollection principals)
Retrieves the AuthorizationInfo for the given principals from the underlying data store.
|
Cache<Object,AuthorizationInfo> |
getAuthorizationCache() |
protected Object |
getAuthorizationCacheKey(PrincipalCollection principals) |
String |
getAuthorizationCacheName() |
protected AuthorizationInfo |
getAuthorizationInfo(PrincipalCollection principals)
Returns an account's authorization-specific information for the specified
principals ,
or null if no account could be found. |
PermissionResolver |
getPermissionResolver() |
protected Collection<Permission> |
getPermissions(AuthorizationInfo info) |
RolePermissionResolver |
getRolePermissionResolver() |
boolean |
hasAllRoles(PrincipalCollection principal,
Collection<String> roleIdentifiers)
Returns true if the corresponding Subject/user has all of the specified roles, false otherwise.
|
boolean |
hasRole(PrincipalCollection principal,
String roleIdentifier)
Returns true if the corresponding Subject/user has the specified role, false otherwise.
|
protected boolean |
hasRole(String roleIdentifier,
AuthorizationInfo info) |
protected boolean[] |
hasRoles(List<String> roleIdentifiers,
AuthorizationInfo info) |
boolean[] |
hasRoles(PrincipalCollection principal,
List<String> roleIdentifiers)
Checks if the corresponding Subject/user has the specified roles, returning a boolean array indicating
which roles are associated with the given subject.
|
boolean |
isAuthorizationCachingEnabled()
Returns
true if authorization caching should be utilized if a CacheManager has been
configured , false otherwise. |
protected boolean[] |
isPermitted(List<Permission> permissions,
AuthorizationInfo info) |
protected boolean |
isPermitted(Permission permission,
AuthorizationInfo info) |
boolean[] |
isPermitted(PrincipalCollection principals,
List<Permission> permissions)
Checks if the corresponding Subject/user implies the given Permissions and returns a boolean array indicating
which permissions are implied.
|
boolean |
isPermitted(PrincipalCollection principals,
Permission permission)
Returns true if the corresponding subject/user is permitted to perform an action or access a resource
summarized by the specified permission.
|
boolean[] |
isPermitted(PrincipalCollection subjectIdentifier,
String... permissions)
Checks if the corresponding Subject implies the given permission strings and returns a boolean array
indicating which permissions are implied.
|
boolean |
isPermitted(PrincipalCollection principals,
String permission)
Returns true if the corresponding subject/user is permitted to perform an action or access a resource
summarized by the specified permission string.
|
protected boolean |
isPermittedAll(Collection<Permission> permissions,
AuthorizationInfo info) |
boolean |
isPermittedAll(PrincipalCollection principal,
Collection<Permission> permissions)
Returns true if the corresponding Subject/user implies all of the specified permissions, false
otherwise.
|
boolean |
isPermittedAll(PrincipalCollection subjectIdentifier,
String... permissions)
Returns true if the corresponding Subject/user implies all of the specified permission strings,
false otherwise.
|
protected void |
onInit()
Initializes this realm and potentially enables a cache, depending on configuration.
|
void |
setAuthorizationCache(Cache<Object,AuthorizationInfo> authorizationCache) |
void |
setAuthorizationCacheName(String authorizationCacheName) |
void |
setAuthorizationCachingEnabled(boolean authenticationCachingEnabled)
Sets whether or not authorization caching should be utilized if a
CacheManager has been
configured , false otherwise. |
void |
setName(String name)
Sets the (preferably application unique) name for this component.
|
void |
setPermissionResolver(PermissionResolver permissionResolver)
Sets the specified PermissionResolver on this instance.
|
void |
setRolePermissionResolver(RolePermissionResolver permissionRoleResolver)
Sets the specified RolePermissionResolver on this instance.
|
assertCredentialsMatch, clearCachedAuthenticationInfo, doGetAuthenticationInfo, getAuthenticationCache, getAuthenticationCacheKey, getAuthenticationCacheKey, getAuthenticationCacheName, getAuthenticationInfo, getAuthenticationTokenClass, getCredentialsMatcher, init, isAuthenticationCachingEnabled, isAuthenticationCachingEnabled, setAuthenticationCache, setAuthenticationCacheName, setAuthenticationCachingEnabled, setAuthenticationTokenClass, setCredentialsMatcher, supports
clearCache, getAvailablePrincipal, getCacheManager, getName, isCachingEnabled, onLogout, setCacheManager, setCachingEnabled
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
init
public AuthorizingRealm()
public AuthorizingRealm(CacheManager cacheManager)
public AuthorizingRealm(CredentialsMatcher matcher)
public AuthorizingRealm(CacheManager cacheManager, CredentialsMatcher matcher)
public void setName(String name)
Nameable
setName
in interface Nameable
setName
in class AuthenticatingRealm
name
- the preferably application unique name for this component.public void setAuthorizationCache(Cache<Object,AuthorizationInfo> authorizationCache)
public Cache<Object,AuthorizationInfo> getAuthorizationCache()
public String getAuthorizationCacheName()
public void setAuthorizationCacheName(String authorizationCacheName)
public boolean isAuthorizationCachingEnabled()
true
if authorization caching should be utilized if a CacheManager
has been
configured
, false
otherwise.
The default value is true
.true
if authorization caching should be utilized, false
otherwise.public void setAuthorizationCachingEnabled(boolean authenticationCachingEnabled)
CacheManager
has been
configured
, false
otherwise.
The default value is true
.authenticationCachingEnabled
- the value to setpublic PermissionResolver getPermissionResolver()
public void setPermissionResolver(PermissionResolver permissionResolver)
PermissionResolverAware
setPermissionResolver
in interface PermissionResolverAware
permissionResolver
- the PermissionResolver being set.public RolePermissionResolver getRolePermissionResolver()
public void setRolePermissionResolver(RolePermissionResolver permissionRoleResolver)
RolePermissionResolverAware
setRolePermissionResolver
in interface RolePermissionResolverAware
permissionRoleResolver
- the RolePermissionResolver being set.protected void onInit()
cache
property has been set, it will be
used to cache the AuthorizationInfo objects returned from getAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection)
method invocations.
All future calls to getAuthorizationInfo
will attempt to use this cache first
to alleviate any potentially unnecessary calls to an underlying data store.cache
property has not been set,
the cacheManager
property will be checked.
If a cacheManager
has been set, it will be used to create an authorization
cache
, and this newly created cache which will be used as specified in #1.(org.apache.shiro.cache.Cache) cache
or cacheManager
properties are set, caching will be disabled and authorization look-ups will be delegated to
subclass implementations for each authorization check.onInit
in class AuthenticatingRealm
protected void afterCacheManagerSet()
AuthenticatingRealm
afterCacheManagerSet
in class AuthenticatingRealm
protected AuthorizationInfo getAuthorizationInfo(PrincipalCollection principals)
principals
,
or null
if no account could be found. The resulting AuthorizationInfo
object is used
by the other method implementations in this class to automatically perform access control checks for the
corresponding Subject
.
This implementation obtains the actual AuthorizationInfo
object from the subclass's
implementation of
doGetAuthorizationInfo
, and then
caches it for efficient reuse if caching is enabled (see below).
Invocations of this method should be thought of as completely orthogonal to acquiring
authenticationInfo
, since either could
occur in any order.
For example, in "Remember Me" scenarios, the user identity is remembered (and
assumed) for their current session and an authentication attempt during that session might never occur.
But because their identity would be remembered, that is sufficient enough information to call this method to
execute any necessary authorization checks. For this reason, authentication and authorization should be
loosely coupled and not depend on each other.
AuthorizationInfo
values returned from this method are cached for efficient reuse
if caching is enabled. Caching is enabled automatically when an authorizationCache
instance has been explicitly configured, or if a cacheManager
has been configured, which
will be used to lazily create the authorizationCache
as needed.
If caching is enabled, the authorization cache will be checked first and if found, will return the cached
AuthorizationInfo
immediately. If caching is disabled, or there is a cache miss, the authorization
info will be looked up from the underlying data store via the
doGetAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection)
method, which must be implemented
by subclasses.
clearCachedAuthorizationInfo
method. This ensures that the next call to getAuthorizationInfo(PrincipalCollection)
will
acquire the account's fresh authorization data, where it will then be cached for efficient reuse. This
ensures that stale authorization data will not be reused.principals
- the corresponding Subject's identifying principals with which to look up the Subject's
AuthorizationInfo
.principals
,
or null
if no account could be found.protected Object getAuthorizationCacheKey(PrincipalCollection principals)
protected void clearCachedAuthorizationInfo(PrincipalCollection principals)
getAuthorizationInfo
, and the
resulting return value will be cached before being returned so it can be reused for later authorization checks.
If you wish to clear out all associated cached data (and not just authorization data), use the
CachingRealm.clearCache(org.apache.shiro.subject.PrincipalCollection)
method instead (which will in turn call this
method by default).principals
- the principals of the account for which to clear the cached AuthorizationInfo.protected abstract AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals)
SimpleAuthorizationInfo
, as it is suitable in most cases.principals
- the primary identifying principals of the AuthorizationInfo that should be retrieved.SimpleAuthorizationInfo
protected Collection<Permission> getPermissions(AuthorizationInfo info)
public boolean isPermitted(PrincipalCollection principals, String permission)
Authorizer
This is an overloaded method for the corresponding type-safe Permission
variant.
Please see the class-level JavaDoc for more information on these String-based permission methods.
isPermitted
in interface Authorizer
principals
- the application-specific subject/user identifier.permission
- the String representation of a Permission that is being checked.Authorizer.isPermitted(PrincipalCollection principals,Permission permission)
public boolean isPermitted(PrincipalCollection principals, Permission permission)
Authorizer
More specifically, this method determines if any Permissions associated
with the subject imply
the specified permission.
isPermitted
in interface Authorizer
principals
- the application-specific subject/user identifier.permission
- the permission that is being checked.protected boolean isPermitted(Permission permission, AuthorizationInfo info)
public boolean[] isPermitted(PrincipalCollection subjectIdentifier, String... permissions)
Authorizer
This is an overloaded method for the corresponding type-safe Permission
variant.
Please see the class-level JavaDoc for more information on these String-based permission methods.
isPermitted
in interface Authorizer
subjectIdentifier
- the application-specific subject/user identifier.permissions
- the String representations of the Permissions that are being checked.public boolean[] isPermitted(PrincipalCollection principals, List<Permission> permissions)
Authorizer
More specifically, this method should determine if each Permission in
the array is implied
by permissions
already associated with the subject.
This is primarily a performance-enhancing method to help reduce the number of
Authorizer.isPermitted(org.apache.shiro.subject.PrincipalCollection, java.lang.String)
invocations over the wire in client/server systems.
isPermitted
in interface Authorizer
principals
- the application-specific subject/user identifier.permissions
- the permissions that are being checked.protected boolean[] isPermitted(List<Permission> permissions, AuthorizationInfo info)
public boolean isPermittedAll(PrincipalCollection subjectIdentifier, String... permissions)
Authorizer
This is an overloaded method for the corresponding type-safe Permission
variant.
Please see the class-level JavaDoc for more information on these String-based permission methods.
isPermittedAll
in interface Authorizer
subjectIdentifier
- the application-specific subject/user identifier.permissions
- the String representations of the Permissions that are being checked.Authorizer.isPermittedAll(PrincipalCollection,Collection)
public boolean isPermittedAll(PrincipalCollection principal, Collection<Permission> permissions)
Authorizer
More specifically, this method determines if all of the given Permissions are
implied by
permissions already associated with the subject.
isPermittedAll
in interface Authorizer
principal
- the application-specific subject/user identifier.permissions
- the permissions to check.protected boolean isPermittedAll(Collection<Permission> permissions, AuthorizationInfo info)
public void checkPermission(PrincipalCollection subjectIdentifier, String permission) throws AuthorizationException
Authorizer
If the subject's existing associated permissions do not Permission.implies(Permission)
imply}
the given permission, an AuthorizationException
will be thrown.
This is an overloaded method for the corresponding type-safe Permission
variant.
Please see the class-level JavaDoc for more information on these String-based permission methods.
checkPermission
in interface Authorizer
subjectIdentifier
- the application-specific subject/user identifier.permission
- the String representation of the Permission to check.AuthorizationException
- if the user does not have the permission.public void checkPermission(PrincipalCollection principal, Permission permission) throws AuthorizationException
Authorizer
Permission.implies(Permission)
implies} the specified Permission.
If the subject's existing associated permissions do not Permission.implies(Permission)
imply}
the given permission, an AuthorizationException
will be thrown.checkPermission
in interface Authorizer
principal
- the application-specific subject/user identifier.permission
- the Permission to check.AuthorizationException
- if the user does not have the permission.protected void checkPermission(Permission permission, AuthorizationInfo info)
public void checkPermissions(PrincipalCollection subjectIdentifier, String... permissions) throws AuthorizationException
Authorizer
implies
all of the
specified permission strings.
If the subject's existing associated permissions do not
imply
all of the given permissions,
an AuthorizationException
will be thrown.
This is an overloaded method for the corresponding type-safe Permission
variant.
Please see the class-level JavaDoc for more information on these String-based permission methods.
checkPermissions
in interface Authorizer
subjectIdentifier
- the application-specific subject/user identifier.permissions
- the string representations of Permissions to check.AuthorizationException
- if the user does not have all of the given permissions.public void checkPermissions(PrincipalCollection principal, Collection<Permission> permissions) throws AuthorizationException
Authorizer
implies
all of the
specified permission strings.
If the subject's existing associated permissions do not
imply
all of the given permissions,
an AuthorizationException
will be thrown.checkPermissions
in interface Authorizer
principal
- the application-specific subject/user identifier.permissions
- the Permissions to check.AuthorizationException
- if the user does not have all of the given permissions.protected void checkPermissions(Collection<Permission> permissions, AuthorizationInfo info)
public boolean hasRole(PrincipalCollection principal, String roleIdentifier)
Authorizer
hasRole
in interface Authorizer
principal
- the application-specific subject/user identifier.roleIdentifier
- the application-specific role identifier (usually a role id or role name).protected boolean hasRole(String roleIdentifier, AuthorizationInfo info)
public boolean[] hasRoles(PrincipalCollection principal, List<String> roleIdentifiers)
Authorizer
This is primarily a performance-enhancing method to help reduce the number of
Authorizer.hasRole(org.apache.shiro.subject.PrincipalCollection, java.lang.String)
invocations over the wire in client/server systems.
hasRoles
in interface Authorizer
principal
- the application-specific subject/user identifier.roleIdentifiers
- the application-specific role identifiers to check (usually role ids or role names).protected boolean[] hasRoles(List<String> roleIdentifiers, AuthorizationInfo info)
public boolean hasAllRoles(PrincipalCollection principal, Collection<String> roleIdentifiers)
Authorizer
hasAllRoles
in interface Authorizer
principal
- the application-specific subject/user identifier.roleIdentifiers
- the application-specific role identifiers to check (usually role ids or role names).public void checkRole(PrincipalCollection principal, String role) throws AuthorizationException
Authorizer
AuthorizationException
if they do not.checkRole
in interface Authorizer
principal
- the application-specific subject/user identifier.role
- the application-specific role identifier (usually a role id or role name ).AuthorizationException
- if the user does not have the role.protected void checkRole(String role, AuthorizationInfo info)
public void checkRoles(PrincipalCollection principal, Collection<String> roles) throws AuthorizationException
Authorizer
AuthorizationException
if they do not.checkRoles
in interface Authorizer
principal
- the application-specific subject/user identifier.roles
- the application-specific role identifiers to check (usually role ids or role names).AuthorizationException
- if the user does not have all of the specified roles.public void checkRoles(PrincipalCollection principal, String... roles) throws AuthorizationException
Authorizer
checkRoles(PrincipalCollection subjectPrincipal, Collection<String> roleIdentifiers)
but doesn't require a collection
as an argument.
Asserts the corresponding Subject/user has all of the specified roles by returning quietly if they do or
throwing an AuthorizationException
if they do not.checkRoles
in interface Authorizer
principal
- the application-specific subject/user identifier.roles
- the application-specific role identifiers to check (usually role ids or role names).AuthorizationException
- if the user does not have all of the specified roles.protected void checkRoles(Collection<String> roles, AuthorizationInfo info)
protected void doClearCache(PrincipalCollection principals)
super.doClearCache
to ensure any cached authentication data is removed and then calls
clearCachedAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection)
to remove any cached
authorization data.
If overriding in a subclass, be sure to call super.doClearCache
to ensure this behavior is maintained.doClearCache
in class AuthenticatingRealm
principals
- the principals of the account for which to clear any cached AuthorizationInfoCopyright © 2004–2020 The Apache Software Foundation. All rights reserved.