All Classes

Class	Description
AbstractAuthenticationStrategy	Abstract base implementation for Shiro's concrete AuthenticationStrategy implementations.
AbstractAuthenticator	Superclass for almost all Authenticator implementations that performs the common work around authentication attempts.
AbstractCacheManager	Very simple abstract CacheManager implementation that retains all created Cache instances in an in-memory ConcurrentMap.
AbstractContainerIT
AbstractFactory<T>	TODO - Class JavaDoc
AbstractFilter	Base abstract Filter simplifying Filter initialization and access to init parameters.
AbstractHash	Deprecated. in Shiro 1.1 in favor of using the concrete SimpleHash implementation directly.
AbstractLdapRealm	A Realm that authenticates with an LDAP server to build the Subject for a user.
AbstractNativeSessionManager	Abstract implementation supporting the NativeSessionManager interface, supporting SessionListeners and application of the globalSessionTimeout.
AbstractRememberMeManager	Abstract implementation of the RememberMeManager interface that handles serialization and encryption of the remembered user identity.
AbstractSessionDAO	An abstract SessionDAO implementation that performs some sanity checks on session creation and reading and allows for pluggable Session ID generation strategies if desired.
AbstractSessionManager	Base abstract class of the SessionManager interface, enabling configuration of an application-wide globalSessionTimeout.
AbstractShiroAnnotationProcessorConfiguration
AbstractShiroBeanConfiguration
AbstractShiroConfiguration
AbstractShiroFilter	Abstract base class that provides all standard Shiro request filtering behavior and expects subclasses to implement configuration-specific logic (INI, XML, .properties, etc).
AbstractShiroWebConfiguration
AbstractShiroWebFilterConfiguration
AbstractSymmetricCipherService	Base abstract class for supporting symmetric key cipher algorithms.
AbstractValidatingSessionManager	Default business-tier implementation of the ValidatingSessionManager interface.
AccessControlFilter	Superclass for any filter that controls access to a resource and may redirect the user to the login page if they are not authenticated.
Account	An Account is a convenience interface that extends both AuthenticationInfo and AuthorizationInfo and represents authentication and authorization for a single account in a single Realm.
AccountException	Exception thrown due to a problem with the account under which an authentication attempt is being executed.
AccountInfoController
ActiveDirectoryRealm	A Realm that authenticates with an active directory LDAP server to determine the roles for a particular user.
AdviceFilter	A Servlet Filter that enables AOP-style "around" advice for a ServletRequest via preHandle, postHandle, and afterCompletion hooks.
AesCipherService	CipherService using the AES cipher algorithm for all encryption, decryption, and key operations.
AllowAllCredentialsMatcher	A credentials matcher that always returns true when matching credentials no matter what arguments are passed in.
AllPermission	An all AllPermission instance is one that always implies any other permission; that is, its implies method always returns true.
AllSuccessfulStrategy	AuthenticationStrategy implementation that requires all configured realms to successfully process the submitted AuthenticationToken during the log-in attempt.
AnnotationAuthorizationFilter	A filter that grants or denies access to a JAX-RS resource based on the Shiro annotations on it.
AnnotationEventListenerResolver	Inspects an object for annotated methods of interest and creates an EventListener instance for each method discovered.
AnnotationHandler	Base support class for implementations that reads and processes JSR-175 annotations.
AnnotationMethodInterceptor	MethodInterceptor that inspects a specific annotation on the method invocation before continuing its execution.
AnnotationResolver	Defines an AOP-framework-independent way of determining if an Annotation exists on a Method.
AnnotationsAuthorizingMethodInterceptor	An AnnotationsAuthorizingMethodInterceptor is a MethodInterceptor that asserts a given method is authorized to execute based on one or more configured AuthorizingAnnotationMethodInterceptors.
AnonymousFilter	Filter that allows access to a path immeidately without performing security checks of any kind.
AntPathMatcher	PathMatcher implementation for Ant-style path patterns.
AopAllianceAnnotationsAuthorizingMethodInterceptor	Allows Shiro Annotations to work in any AOP Alliance specific implementation environment (for example, Spring).
AspectjAnnotationsAuthorizingMethodInterceptor	Extends the annotations authorizing method interceptor class hierarchie to adapt an aspectj JoinPoint into a MethodInvocation amd to perform the authorization of method invocations.
Assert	Assertion utility class that assists in validating arguments.
AtLeastOneSuccessfulStrategy	AuthenticationStrategy implementation that requires at least one configured realm to successfully process the submitted AuthenticationToken during the log-in attempt.
AuthenticatedAnnotationHandler	Handles RequiresAuthentication annotations and ensures the calling subject is authenticated before allowing access.
AuthenticatedAnnotationMethodInterceptor	Checks to see if a @RequiresAuthenticated annotation is declared, and if so, ensures the calling Subject.isAuthenticated() before invoking the method.
AuthenticatedTag	JSP tag that renders the tag body only if the current user has executed a successful authentication attempt during their current session.
AuthenticatingFilter	An AuthenticationFilter that is capable of automatically performing an authentication attempt based on the incoming request.
AuthenticatingRealm	A top-level abstract implementation of the Realm interface that only implements authentication support (log-in) operations and leaves authorization (access control) behavior to subclasses.
AuthenticatingSecurityManager	Shiro support of a SecurityManager class hierarchy that delegates all authentication operations to a wrapped Authenticator instance.
AuthenticationException	General exception thrown due to an error during the Authentication process.
AuthenticationFilter	Base class for all Filters that require the current user to be authenticated.
AuthenticationInfo	AuthenticationInfo represents a Subject's (aka user's) stored account information relevant to the authentication/log-in process only.
AuthenticationListener	An AuthenticationListener listens for notifications while Subjects authenticate with the system.
AuthenticationStrategy	A AuthenticationStrategy implementation assists the ModularRealmAuthenticator during the log-in process in a pluggable realm (PAM) environment.
AuthenticationToken	An AuthenticationToken is a consolidation of an account's principals and supporting credentials submitted by a user during an authentication attempt.
Authenticator	An Authenticator is responsible for authenticating accounts in an application.
AuthorizationAttributeSourceAdvisor	TODO - complete JavaDoc
AuthorizationException	Exception thrown if there is a problem during authorization (access control check).
AuthorizationFilter	Superclass for authorization-related filters.
AuthorizationInfo	AuthorizationInfo represents a single Subject's stored authorization data (roles, permissions, etc) used during authorization (access control) checks only.
Authorizer	An Authorizer performs authorization (access control) operations for any given Subject (aka 'application user').
AuthorizingAnnotationHandler	An AnnotationHandler that executes authorization (access control) behavior based on directive(s) found in a JSR-175 Annotation.
AuthorizingAnnotationMethodInterceptor	An AnnotationMethodInterceptor that asserts the calling code is authorized to execute the method before allowing the invocation to continue by inspecting code annotations to perform an access control check.
AuthorizingMethodInterceptor	Basic abstract class to support intercepting methods that perform authorization (access control) checks.
AuthorizingRealm	An AuthorizingRealm extends the AuthenticatingRealm's capabilities by adding Authorization (access control) support.
AuthorizingSecurityManager	Shiro support of a SecurityManager class hierarchy that delegates all authorization (access control) operations to a wrapped Authorizer instance.
Base64	Provides Base 64 encoding and decoding as defined by RFC 2045.
Base64Format	HashFormat that outputs only the hash's digest bytes in Base64 format.
BasicHttpAuthenticationFilter	Requires the requesting user to be authenticated for the request to continue, and if they're not, requires the user to login via the HTTP Basic protocol-specific challenge.
BasicIniEnvironment	Basic usage:
BeanEvent
BearerHttpAuthenticationFilter	Requires the requesting user to be authenticated for the request to continue, and if they're not, requires the user to login via the HTTP Bearer protocol-specific challenge.
BearerToken	A AuthenticationToken that contains an a Bearer token or API key, typically received via an HTTP Authorization header.
BeforeAdviceMethodInvocationAdapter	Helper class that adapts an AspectJ JoinPoint.
BlowfishCipherService	CipherService using the Blowfish cipher algorithm for all encryption, decryption, and key operations.
ByteSource	A ByteSource wraps a byte array and provides additional encoding operations.
ByteSource.Util	Utility class that can construct ByteSource instances.
Cache<K,V>	A Cache efficiently stores temporary objects primarily to improve an application's performance.
CacheException	Root class of all Shiro exceptions related to caching operations.
CacheManager	A CacheManager provides and maintains the lifecycles of Cache instances.
CacheManagerAware	Interface implemented by components that utilize a CacheManager and wish that CacheManager to be supplied if one is available.
CachingRealm	A very basic abstract extension point for the Realm interface that provides caching support for subclasses.
CachingSecurityManager	A very basic starting point for the SecurityManager interface that merely provides logging and caching support.
CachingSessionDAO	An CachingSessionDAO is a SessionDAO that provides a transparent caching layer between the components that use it and the underlying EIS (Enterprise Information System) session backing store (for example, filesystem, database, enterprise grid/cloud, etc).
CasAuthenticationException	Deprecated. replaced with Shiro integration in buji-pac4j.
CasFilter	Deprecated. replaced with Shiro integration in buji-pac4j.
CasRealm	Deprecated. replaced with Shiro integration in buji-pac4j.
CasSubjectFactory	Deprecated. replaced with Shiro integration in buji-pac4j.
CasToken	Deprecated. replaced with Shiro integration in buji-pac4j.
CipherService	A CipherService uses a cryptographic algorithm called a Cipher to convert an original input source using a key to an uninterpretable format.
ClassResolvingObjectInputStream	Enables correct ClassLoader lookup in various environments (e.g.
ClassUtils	Utility method library used to conveniently interact with Classes, such as acquiring them from the application ClassLoaders and instantiating Objects from them.
CliApp	Spring Boot Application that show the usage of a user login, checking permissions, and annotation protected methods.
CodecException	Root exception related to issues during encoding or decoding.
CodecSupport	Base abstract class that provides useful encoding and decoding operations, especially for character data.
CollectionUtils	Static helper class for use dealing with Collections.
CommonsInterpolator	Commons-Config interpolation wrapper.
ConcurrentAccessException	Thrown when an authentication attempt has been received for an account that has already been authenticated (i.e.
ConfigurableHashService	A HashService that allows configuration of its strategy via JavaBeans-compatible setter methods.
ConfigurationException	Root exception indicating there was a problem parsing or processing the Shiro configuration.
ConfiguredBeanEvent	Event triggered when a configured bean has been instantiated and fully configured but right before the bean has been initialized.
Cookie	Interface representing HTTP cookie operations, supporting pojo-style getters and setters for all attributes which includes HttpOnly support.
Cookie.SameSiteOptions	The SameSite attribute of the Set-Cookie HTTP response header allows you to declare if your cookie should be restricted to a first-party or same-site context.
CookieRememberMeManager	Remembers a Subject's identity by saving the Subject's principals to a Cookie for later retrieval.
CredentialsException	Exception thrown due to a problem with the credential(s) submitted for an account during the authentication process.
CredentialsMatcher	Interface implemented by classes that can determine if an AuthenticationToken's provided credentials matches a corresponding account's credentials stored in the system.
CryptoException	Base Shiro exception for problems encountered during cryptographic operations.
DataAccessException	Generic exception representing a problem when attempting to access data.
DefaultAnnotationResolver	Default AnnotationResolver implementation that merely inspects the MethodInvocation's target method, and returns targetMethod.getAnnotation(class).
DefaultBlockCipherService	Base abstract class for block cipher algorithms.
DefaultEnvironment	Simple/default Environment implementation that stores Shiro objects as key-value pairs in a Map instance.
DefaultEventBus	A default event bus implementation that synchronously publishes events to registered listeners.
DefaultFilter	Enum representing all of the default Shiro Filter instances available to web applications.
DefaultFilterChainManager	Default FilterChainManager implementation maintaining a map of Filter instances (key: filter name, value: Filter) as well as a map of NamedFilterLists created from these Filters (key: filter chain name, value: NamedFilterList).
DefaultHashFormatFactory	This default HashFormatFactory implementation heuristically determines a HashFormat class to instantiate based on the input argument and returns a new instance of the discovered class.
DefaultHashService	Default implementation of the HashService interface, supporting a customizable hash algorithm name, secure-random salt generation, multiple hash iterations and an optional internal privateSalt.
DefaultInterpolator	This Interpolator simply returns the original value.
DefaultLdapContextFactory	Deprecated. replaced by the JndiLdapContextFactory implementation.
DefaultLdapRealm	An LDAP Realm implementation utilizing Sun's/Oracle's JNDI API as an LDAP API.
DefaultPasswordService	Default implementation of the PasswordService interface that relies on an internal HashService, HashFormat, and HashFormatFactory to function:
DefaultSecurityManager	The Shiro framework's default concrete implementation of the SecurityManager interface, based around a collection of Realms.
DefaultSerializer<T>	Serializer implementation that uses the default JVM serialization mechanism (Object Input/Output Streams).
DefaultSessionContext	Default implementation of the SessionContext interface which provides getters and setters that wrap interaction with the underlying backing context map.
DefaultSessionKey	Default implementation of the SessionKey interface, which allows setting and retrieval of a concrete sessionId that the SessionManager implementation can use to look up a Session instance.
DefaultSessionManager	Default business-tier implementation of a ValidatingSessionManager.
DefaultSessionStorageEvaluator	A Default SessionStorageEvaluator that provides reasonable control over if and how Sessions may be used for storing Subject state.
DefaultShiroFilterChainDefinition
DefaultSubjectContext	Default implementation of the SubjectContext interface.
DefaultSubjectDAO	Default SubjectDAO implementation that stores Subject state in the Subject's Session by default (but this can be disabled - see below).
DefaultSubjectFactory	Default SubjectFactory implementation that creates DelegatingSubject instances.
DefaultWebEnvironment	Default WebEnvironment implementation based on a backing Map instance.
DefaultWebSecurityManager	Default WebSecurityManager implementation used in web-based applications or any application that requires HTTP connectivity (SOAP, http remoting, etc).
DefaultWebSessionContext	Default implementation of the WebSessionContext interface which provides getters and setters that wrap interaction with the underlying backing context map.
DefaultWebSessionManager	Web-application capable SessionManager implementation.
DefaultWebSessionStorageEvaluator	A web-specific SessionStorageEvaluator that performs the same logic as the parent class DefaultSessionStorageEvaluator but additionally checks for a request-specific flag that may enable or disable session access.
DefaultWebSubjectContext	Default WebSubjectContext implementation that provides for additional storage and retrieval of a ServletRequest and ServletResponse.
DefaultWebSubjectFactory	A SubjectFactory implementation that creates WebDelegatingSubject instances.
DelegatingSession	A DelegatingSession is a client-tier representation of a server side Session.
DelegatingSubject	Implementation of the Subject interface that delegates method calls to an underlying SecurityManager instance for security checks.
Destroyable	Shiro container-agnostic interface that indicates that this object requires a callback during destruction.
DestroyedBeanEvent	Event triggered when a configured bean has been destroyed.
DisabledAccountException	Thrown when attempting to authenticate and the corresponding account has been disabled for some reason.
DisabledSessionException	Exception thrown if attempting to create a new Subject session, but that Subject's sessions are disabled.
DomainPermission	Provides a base Permission class from which type-safe/domain-specific subclasses may extend.
EhCache<K,V>	Shiro Cache implementation that wraps an Ehcache instance.
EhCacheManager	Shiro CacheManager implementation utilizing the Ehcache framework for all cache functionality.
EnterpriseCacheSessionDAO	SessionDAO implementation that relies on an enterprise caching product as the EIS system of record for all sessions.
Environment	An Environment instance encapsulates all of the objects that Shiro requires to function.
EnvironmentException	Exception thrown for errors related to Environment instances or configuration.
EnvironmentLoader	An EnvironmentLoader is responsible for loading a web application's Shiro WebEnvironment (which includes the web app's WebSecurityManager) into the ServletContext at application startup.
EnvironmentLoaderListener	Bootstrap listener to startup and shutdown the web application's Shiro WebEnvironment at ServletContext startup and shutdown respectively.
Event	Root class for all of Shiro's event classes.
EventBus	An event bus can publish events to event subscribers as well as provide a mechanism for registering and unregistering event subscribers.
EventBusAware	Interface implemented by components that utilize an EventBus for publishing and/or subscribing to/from events and wish that EventBus to be supplied if one is available.
EventClassComparator	Compares two event classes based on their position in a class hierarchy.
EventListener	An event listener knows how to accept and process events of a particular type (or types).
EventListenerComparator	Compares two event listeners to determine the order in which they should be invoked when an event is dispatched.
EventListenerResolver	An EventListenerResolver knows how to resolve (either create or lookup) EventListener instances as a result of inspecting a subscriber object, mostly likely a Subscribe-annotated object instance.
ExceptionMapper	JAX-RS exception mapper used to map Shiro AuthorizationExceptions to HTTP status codes.
ExcessiveAttemptsException	Thrown when a system is configured to only allow a certain number of authentication attempts over a period of time and the current session has failed to authenticate successfully within that number.
ExecutionException	Exception wrapping any potential checked exception thrown when a Subject executes a Callable.
ExecutorServiceSessionValidationScheduler	SessionValidationScheduler implementation that uses a ScheduledExecutorService to call ValidatingSessionManager.validateSessions() every interval milliseconds.
ExpiredCredentialsException	Thrown during the authentication process when the system determines the submitted credential(s) has expired and will not allow login.
ExpiredSessionException	A special case of a StoppedSessionException.
Factory<T>	Generics-aware interface supporting the Factory Method design pattern.
FilterChainManager	A FilterChainManager manages the creation and modification of Filter chains from an available pool of Filter instances.
FilterChainResolver	A FilterChainResolver can resolve an appropriate FilterChain to execute during a ServletRequest.
FirstSuccessfulStrategy	AuthenticationStrategy implementation that only accepts the account data from the first successfully consulted Realm and ignores all subsequent realms.
FormAuthenticationFilter	Requires the requesting user to be authenticated for the request to continue, and if they are not, forces the user to login via by redirecting them to the loginUrl you configure.
GuestAnnotationHandler	Checks to see if a @RequiresGuest annotation is declared, and if so, ensures the calling Subject does not have an identity before invoking the method.
GuestAnnotationMethodInterceptor	Checks to see if a @RequiresGuest annotation is declared, and if so, ensures the calling Subject does not have an identity before invoking the method.
GuestTag	JSP tag that renders the tag body if the current user is not known to the system, either because they haven't logged in yet, or because they have no 'RememberMe' identity.
GuiceShiroFilter	Shiro filter that is managed by and receives its filter chain configurations from Guice.
H64	Codec for Unix Crypt-style encoding.
HasAnyRolesTag	Displays body content if the current user has any of the roles specified.
Hash	A Cryptographic Hash represents a one-way conversion algorithm that transforms an input source to an underlying byte array.
HashedCredentialsMatcher	A HashedCredentialMatcher provides support for hashing of supplied AuthenticationToken credentials before being compared to those in the AuthenticationInfo from the data store.
Hasher	Commandline line utility to hash data such as strings, passwords, resources (files, urls, etc).
HashFormat	A HashFormat is able to format a Hash instance into a well-defined formatted String.
HashFormatFactory
HashingPasswordService	A HashingPasswordService is a PasswordService that performs password encryption and comparisons based on cryptographic Hashes.
HashRequest	A HashRequest is composed of data that will be used by a HashService to compute a hash (aka 'digest').
HashRequest.Builder	A Builder class representing the Builder design pattern for constructing HashRequest instances.
HashService	A HashService hashes input sources utilizing a particular hashing strategy.
HasPermissionTag
HasRoleTag
HazelcastCacheManager	A CacheManager implementation backed by Hazelcast, "an open source clustering and highly scalable data distribution platform for Java"
HelloController
Hex	Hexadecimal encoder and decoder.
HexFormat	HashFormat that outputs only The hash's digest bytes in hex format.
HostAuthenticationToken	A HostAuthenticationToken retains the host information from where an authentication attempt originates.
HostFilter	A Filter that can allow or deny access based on the host that sent the request.
HostUnauthorizedException	Thrown when a particular client (that is, host address) has not been enabled to access the system or if the client has been enabled access but is not permitted to perform a particular operation or access a particular resource.
HttpMethodPermissionFilter	A filter that translates an HTTP Request's Method (eg GET, POST, etc) into an corresponding action (verb) and uses that verb to construct a permission that will be checked to determine access.
HttpServletSession	Session implementation that is backed entirely by a standard servlet container HttpSession instance.
ImmutableProxiedSession	Implementation of the Session interface that proxies another Session, but does not allow any 'write' operations to the underlying session.
IncorrectCredentialsException	Thrown when attempting to authenticate with credential(s) that do not match the actual credentials associated with the account principal.
Ini	A class representing the INI text configuration format.
Ini.Section	An Ini.Section is String-key-to-String-value Map, identifiable by a name unique within an Ini instance.
IniFactorySupport<T>	Deprecated. use Shiro's Environment mechanisms instead.
IniFilterChainResolverFactory	A Factory that creates FilterChainResolver instances based on Ini configuration.
IniRealm	A Realm implementation that creates SimpleAccount instances based on Ini configuration.
IniSecurityManagerFactory	Deprecated. use Shiro's Environment mechanisms instead.
IniShiroFilter	Deprecated. in 1.2 in favor of using the ShiroFilter
Initializable	Shiro container-agnostic interface that indicates that this object requires initialization.
InitializedBeanEvent	Event triggered when a configured bean has been instantiated, fully configured and initialized.
IniWebEnvironment	WebEnvironment implementation configured by an Ini instance or Ini resource locations.
InstantiatedBeanEvent	Event triggered when a configured bean has been instantiated but before it is configured or initialized.
InstantiationException	Runtime exception thrown by the framework when unable to instantiate a Class via reflection.
Interpolator	Basic String interpolation interface.
InvalidPermissionStringException	Thrown by PermissionResolver.resolvePermission(String) when the String being parsed is not valid for that resolver.
InvalidRequestFilter	A request filter that blocks malicious requests.
InvalidResourceUsageException	Root exception indicating invalid or incorrect usage of a data access resource.
InvalidSessionException	Exception thrown when attempting to interact with the system under an established session when that session is considered invalid.
JavaEnvironment	Deprecated. This class is no longer used in Shiro and will be removed in the next major version.
JavaUuidSessionIdGenerator	SessionIdGenerator that generates String values of JDK UUID's as the session IDs.
JcaCipherService	Abstract CipherService implementation utilizing Java's JCA APIs.
JdbcRealm	Realm that allows authentication and authorization via JDBC calls.
JdbcRealm.SaltStyle	Password hash salt configuration.
JdbcUtils	A set of static helper methods for managing JDBC API objects.
JndiCallback	Callback interface to be implemented by classes that need to perform an operation (such as a lookup) in a JNDI context.
JndiLdapContextFactory	LdapContextFactory implementation using the default Sun/Oracle JNDI Ldap API, utilizing JNDI environment properties and an InitialContext.
JndiLdapRealm	Deprecated. Renamed to DefaultLdapRealm, this class will be removed prior to 2.0
JndiLocator	Convenient superclass for JNDI accessors, providing "jndiTemplate" and "jndiEnvironment" bean properties.
JndiObjectFactory<T>	A factory implementation intended to be used to look up objects in jndi.
JndiRealmFactory	Looks up one or more Realm instances from JNDI using specified jndiNames.
JndiTemplate	Helper class that simplifies JNDI operations.
LacksPermissionTag
LacksRoleTag
LdapContextFactory	Interface that encapsulates the creation of LdapContext objects that are used by DefaultLdapRealms to perform authentication attempts and query for authorization data.
LdapUtils	Utility class providing static methods to make working with LDAP easier.
LifecycleBeanPostProcessor	Bean post processor for Spring that automatically calls the init() and/or destroy() methods on Shiro objects that implement the Initializable or Destroyable interfaces, respectfully.
LifecycleUtils	Utility class to help call Initializable.init() and Destroyable.destroy() methods cleanly on any object.
LockedAccountException	A special kind of DisabledAccountException, this exception is thrown when attempting to authenticate and the corresponding account has been disabled explicitly due to being locked.
LoggingBeanEventListener	A stock bean listener implementation that logs all BeanEvents as TRACE log statements.
Logical	An enum for specifying a logical operation that can be used for interpreting authorization annotations
LoginController
LogoutAware	An SPI interface allowing cleanup logic to be executed during logout of a previously authenticated Subject/user.
LogoutFilter	Simple Filter that, upon receiving a request, will immediately log-out the currently executing subject and then redirect them to a configured redirectUrl.
MapCache<K,V>	A MapCache is a Cache implementation that uses a backing Map instance to store and retrieve cached data.
MapContext	A MapContext provides a common base for context-based data storage in a Map.
Md2CredentialsMatcher	Deprecated. since 1.1 - use the HashedCredentialsMatcher directly and set its hashAlgorithmName property.
Md2Hash	Generates an MD2 Hash (RFC 1319) from a given input source with an optional salt and hash iterations.
Md5CredentialsMatcher	Deprecated. since 1.1 - use the HashedCredentialsMatcher directly and set its hashAlgorithmName property.
Md5Hash	Generates an MD5 Hash (RFC 1321) from a given input source with an optional salt and hash iterations.
MemoryConstrainedCacheManager	Simple memory-only based CacheManager implementation usable in production environments.
MemorySessionDAO	Simple memory-based implementation of the SessionDAO that stores all of its sessions in an in-memory ConcurrentMap.
MergableAuthenticationInfo	An extension of the AuthenticationInfo interface to be implemented by classes that support merging with other AuthenticationInfo instances.
MethodInterceptor	A MethodInterceptor intercepts a MethodInvocation to perform before or after logic (aka 'advice').
MethodInterceptorSupport	This class is an abstraction of AOP method interceptor behavior specific to Shiro that leaves AOP implementation specifics to be handled by subclass implementations.
MethodInvocation	3rd-party API independent representation of a method invocation.
ModularCryptFormat	A HashFormat that supports Modular Crypt Format token rules.
ModularRealmAuthenticator	A ModularRealmAuthenticator delegates account lookups to a pluggable (modular) collection of Realms.
ModularRealmAuthorizer	A ModularRealmAuthorizer is an Authorizer implementation that consults one or more configured Realms during an authorization operation.
MutablePrincipalCollection	A PrincipalCollection that allows modification.
MutableWebEnvironment	A WebEnvironment that supports 'write' operations operations.
Nameable	Interface implemented by components that can be named, such as via configuration, and wish to have that name set once it has been configured.
NameableFilter	Allows a filter to be named via JavaBeans-compatible NameableFilter.getName()/NameableFilter.setName(String) methods.
NamedFilterList	A NamedFilterList is a List of Filter instances that is uniquely identified by a name.
NamedObjectEnvironment	An environment that supports object lookup by name.
NativeSessionManager	A Native session manager is one that manages sessions natively - that is, it is directly responsible for the creation, persistence and removal of Session instances and their lifecycles.
NoRealmBeanConfiguredException	This exception should be thrown if not bean of type Realm found.
NoSessionCreationFilter	A PathMatchingFilter that will disable creating new Sessions during the request.
NotAuthenticatedTag	JSP tag that renders the tag body only if the current user has not executed a successful authentication attempt during their current session.
OncePerRequestFilter	Filter base class that guarantees to be just executed once per request, on any servlet container.
OperationMode	A cipher mode of operation directs a cipher algorithm how to convert data during the encryption or decryption process.
PaddingScheme	A CipherPaddingScheme represents well-known padding schemes supported by JPA providers in a type-safe manner.
ParsableHashFormat	A ParsableHashFormat is able to parse a formatted string and convert it into a Hash instance.
PassThruAuthenticationFilter	An authentication filter that redirects the user to the login page when they are trying to access a protected resource.
PasswordMatcher	A CredentialsMatcher that employs best-practices comparisons for hashed text passwords.
PasswordService	A PasswordService supports common use cases when using passwords as a credentials mechanism.
PathConfigProcessor	A PathConfigProcessor processes configuration entries on a per path (url) basis.
PathMatchingFilter	Base class for Filters that will process only specified paths and allow all others to pass through.
PathMatchingFilterChainResolver	A FilterChainResolver that resolves FilterChains based on url path matching, as determined by a configurable PathMatcher.
PatternMatcher	Interface for components that can match source strings against a specified pattern string.
Permission	A Permission represents the ability to perform an action or access a resource.
PermissionAnnotationHandler	Checks to see if a @RequiresPermissions annotation is declared, and if so, performs a permission check to see if the calling Subject is allowed continued access.
PermissionAnnotationMethodInterceptor	Checks to see if a @RequiresPermissions annotation is declared, and if so, performs a permission check to see if the calling Subject is allowed to call the method.
PermissionResolver	A PermisisonResolver resolves a String value and converts it into a Permission instance.
PermissionResolverAware	Interface implemented by a component that wishes to use any application-configured PermissionResolver that might already exist instead of potentially creating one itself.
PermissionsAuthorizationFilter	Filter that allows access if the current user has the permissions specified by the mapped value, or denies access if the user does not have all of the permissions specified.
PermissionTag
PermissionUtils	Utility class to help with String-to-Permission object resolution.
PortFilter	A Filter that requires the request to be on a specific port, and if not, redirects to the same URL on that port.
PrincipalCollection	A collection of all principals associated with a corresponding Subject.
PrincipalMap	EXPERIMENTAL - DO NOT USE YET
PrincipalTag	Tag used to print out the String value of a user's default principal, or a specific principal as specified by the tag's attributes.
PropertiesRealm	A TextConfigurationRealm that defers all logic to the parent class, but just enables Properties based configuration in addition to the parent class's String configuration.
ProvidedHashFormat	An enum representing Shiro's default provided HashFormat implementations.
ProxiedFilterChain	A proxied filter chain is a FilterChain instance that proxies an original FilterChain as well as a List of other Filters that might need to execute prior to the final wrapped original chain.
ProxiedSession	Simple Session implementation that immediately delegates all corresponding calls to an underlying proxied session instance.
QuartzSessionValidationJob	A quartz job that basically just calls the ValidatingSessionManager.validateSessions() method on a configured session manager.
QuartzSessionValidationScheduler	An implementation of the SessionValidationScheduler that uses Quartz to schedule a job to call ValidatingSessionManager.validateSessions() on a regular basis.
Quickstart	Simple Quickstart application showing how to use Shiro's API.
QuickStart	Simple Bean used to demonstrate subject usage.
QuickstartGuice	Simple Quickstart application showing how to use Shiro's API with Guice integration.
QuickstartShiroModule
RandomNumberGenerator	A component that can generate random number/byte values as needed.
RandomSessionIdGenerator	Generates session IDs by using a Random instance to generate random IDs.
Realm	A Realm is a security component that can access application-specific security entities such as users, roles, and permissions to determine authentication and authorization operations.
RealmFactory	Enables Shiro end-users to configure and initialize one or more Realm instances in any manner desired.
RealmSecurityManager	Shiro support of a SecurityManager class hierarchy based around a collection of Realms.
RedirectView	View that redirects to an absolute, context relative, or current request relative URL, exposing all model attributes as HTTP query parameters.
ReflectionBuilder	Object builder that uses reflection and Apache Commons BeanUtils to build objects given a map of "property values".
RegExPatternMatcher	PatternMatcher implementation that uses standard java.util.regex objects.
RememberMeAuthenticationToken	An AuthenticationToken that indicates if the user wishes their identity to be remembered across sessions.
RememberMeManager	A RememberMeManager is responsible for remembering a Subject's identity across that Subject's sessions with the application.
RequestPairSource	A RequestPairSource is a component that can supply a ServletRequest and ServletResponse pair associated with a currently executing request.
RequiredTypeException	Exception thrown when attempting to acquire an object of a required type and that object does not equal, extend, or implement a specified Class.
RequiresAuthentication	Requires the current Subject to have been authenticated during their current session for the annotated class/instance/method to be accessed or invoked.
RequiresGuest	Requires the current Subject to be a "guest", that is, they are not authenticated or remembered from a previous session for the annotated class/instance/method to be accessed or invoked.
RequiresPermissions	Requires the current executor's Subject to imply a particular permission in order to execute the annotated method.
RequiresRoles	Requires the currently executing Subject to have all of the specified roles.
RequiresUser	Requires the current Subject to be an application user for the annotated class/instance/method to be accessed or invoked.
ResourceBasedWebEnvironment	Abstract implementation for WebEnvironments that can be initialized via resource paths (config files).
ResourceConfigurable	Interface implemented by components that can be configured by resource locations (paths).
ResourceUtils	Static helper methods for loading Stream-backed resources.
RestrictedErrorController
RoleAnnotationHandler	Checks to see if a @RequiresRoles annotation is declared, and if so, performs a role check to see if the calling Subject is allowed to proceed.
RoleAnnotationMethodInterceptor	Checks to see if a @RequiresRoles annotation is declared, and if so, performs a role check to see if the calling Subject is allowed to invoke the method.
RolePermissionResolver	A RolePermissionResolver resolves a String value and converts it into a Collection of Permission instances.
RolePermissionResolverAware	Interface implemented by a component that wishes to use any application-configured RolePermissionResolver that might already exist instead of potentially creating one itself.
RolesAuthorizationFilter	Filter that allows access if the current user has the roles specified by the mapped value, or denies access if the user does not have all of the roles specified.
RoleTag
SaltedAuthenticationInfo	Interface representing account information that may use a salt when hashing credentials.
SavedRequest	Maintains request data for a request that was redirected, so that after authentication the user can be redirected to the originally requested page.
SecureRandomNumberGenerator	Default implementation of the RandomNumberGenerator interface, backed by a SecureRandom instance.
SecureRemoteInvocationExecutor	An implementation of the Spring RemoteInvocationExecutor that binds a sessionId to the incoming thread to make it available to the SecurityManager implementation during the thread execution.
SecureRemoteInvocationFactory	A RemoteInvocationFactory that passes the session ID to the server via a RemoteInvocation attribute.
SecureTag
SecurityManager	A SecurityManager executes all security operations for all Subjects (aka users) across a single application.
SecurityUtils	Accesses the currently accessible Subject for the calling code depending on runtime environment.
SerializationException	Root exception for problems either serializing or de-serializing data.
Serializer<T>	A Serializer converts objects to raw binary data and vice versa, enabling persistent storage of objects to files, HTTP cookies, or other mechanism.
ServletContainerSessionManager	SessionManager implementation providing Session implementations that are merely wrappers for the Servlet container's HttpSession.
ServletContextSupport	Base implementation for any components that need to access the web application's ServletContext.
Session	A Session is a stateful data context associated with a single Subject (user, daemon process, etc) who interacts with a software system over a period of time.
SessionContext	A SessionContext is a 'bucket' of data presented to a SessionFactory which interprets this data to construct Session instances.
SessionDAO	Data Access Object design pattern specification to enable Session access to an EIS (Enterprise Information System).
SessionException	General security exception attributed to problems during interaction with the system during a session.
SessionFactory	A simple factory class that instantiates concrete Session instances.
SessionIdGenerator	Interface allowing pluggable session ID generation strategies to be used with various SessionDAO implementations.
SessionKey	A SessionKey is a key that allows look-up of any particular Session instance.
SessionListener	Interface to be implemented by components that wish to be notified of events that occur during a Session's life cycle.
SessionListenerAdapter	Simple adapter implementation of the SessionListener interface, effectively providing no-op implementations of all methods.
SessionManager	A SessionManager manages the creation, maintenance, and clean-up of all application Sessions.
SessionsSecurityManager	Shiro support of a SecurityManager class hierarchy that delegates all session operations to a wrapped SessionManager instance.
SessionStorageEvaluator	Evaluates whether or not Shiro may use a Subject's Session to persist that Subject's internal state.
SessionValidationScheduler	Interface that should be implemented by classes that can control validating sessions on a regular basis.
Sha1CredentialsMatcher	Deprecated. since 1.1 - use the HashedCredentialsMatcher directly and set its hashAlgorithmName property.
Sha1Hash	Generates an SHA-1 Hash (Secure Hash Standard, NIST FIPS 180-1) from a given input source with an optional salt and hash iterations.
Sha256CredentialsMatcher	Deprecated. since 1.1 - use the HashedCredentialsMatcher directly and set its hashAlgorithmName property.
Sha256Hash	Generates an SHA-256 Hash from a given input source with an optional salt and hash iterations.
Sha384CredentialsMatcher	Deprecated. since 1.1 - use the HashedCredentialsMatcher directly and set its hashAlgorithmName property.
Sha384Hash	Generates an SHA-384 Hash from a given input source with an optional salt and hash iterations.
Sha512CredentialsMatcher	Deprecated. since 1.1 - use the HashedCredentialsMatcher directly and set its hashAlgorithmName property.
Sha512Hash	Generates an SHA-512 Hash from a given input source with an optional salt and hash iterations.
Shiro1CryptFormat	The Shiro1CryptFormat is a fully reversible Modular Crypt Format (MCF).
ShiroAnnotationAuthorizingAspect	Aspect that adds a before advice for each invocation of an annotated method.
ShiroAnnotationFilterFeature	Wraps filters around JAX-RS resources that are annotated with Shiro annotations.
ShiroAnnotationProcessorAutoConfiguration
ShiroAnnotationProcessorConfiguration
ShiroAopModule	Install this module to enable Shiro AOP functionality in Guice.
ShiroAutoConfiguration
ShiroBeanAutoConfiguration
ShiroBeanConfiguration
ShiroConfiguration
ShiroEventBusBeanPostProcessor	Spring BeanPostProcessor that detects, EventBusAware and classes containing @Subscribe methods.
ShiroException	Root exception for all Shiro runtime exceptions.
ShiroFeature	Shiro JAX-RS feature which includes ExceptionMapper, SubjectPrincipalRequestFilter, and ShiroAnnotationFilterFeature.
ShiroFilter	Primary Shiro Filter for web applications configuring Shiro via Servlet <listener> in web.xml.
ShiroFilterChainDefinition
ShiroFilterFactoryBean	FactoryBean to be used in Spring-based web applications for defining the master Shiro Filter.
ShiroHttpServletRequest	A ShiroHttpServletRequest wraps the Servlet container's original ServletRequest instance, but ensures that all HttpServletRequest invocations that require Shiro's support (getRemoteUser, getSession, etc) can be executed first by Shiro as necessary before allowing the underlying Servlet container instance's method to be invoked.
ShiroHttpServletResponse	HttpServletResponse implementation to support URL Encoding of Shiro Session IDs.
ShiroHttpSession	Wrapper class that uses a Shiro Session under the hood for all session operations instead of the Servlet Container's session mechanism.
ShiroModule	Sets up Shiro lifecycles within Guice, enables the injecting of Shiro objects, and binds a default SecurityManager and SessionManager.
ShiroNoRealmConfiguredFailureAnalyzer
ShiroRequestMappingConfig
ShiroSecurityContext	A Shiro based SecurityContext that exposes the current Shiro Subject as a Principal.
ShiroSessionScope	Guice scope for Shiro sessions.
ShiroUrlPathHelper	A Spring UrlPathHelper that uses Shiro's path resolution logic.
ShiroWebAutoConfiguration
ShiroWebConfiguration
ShiroWebFilterConfiguration
ShiroWebFilterConfiguration
ShiroWebModule	Sets up Shiro lifecycles within Guice, enables the injecting of Shiro objects, and binds a default WebSecurityManager, SecurityManager and SessionManager.
ShiroWebModule.FilterConfig<T extends Filter>	Filter configuration which pairs a Filter class with its configuration used on a path.
ShiroWebMvcAutoConfiguration
ShortCircuitIterationException	Exception thrown during the authentication process using FirstSuccessfulStrategy, with stopAfterFirstSuccess set.
SimpleAccount	Simple implementation of the Account interface that contains principal and credential and authorization information (roles and permissions) as instance variables and exposes them via getters and setters using standard JavaBean notation.
SimpleAccountRealm	A simple implementation of the Realm interface that uses a set of configured user accounts and roles to support authentication and authorization.
SimpleAuthenticationInfo	Simple implementation of the MergableAuthenticationInfo interface that holds the principals and credentials.
SimpleAuthorizationInfo	Simple POJO implementation of the AuthorizationInfo interface that stores roles and permissions as internal attributes.
SimpleByteSource	Very simple ByteSource implementation that maintains an internal byte[] array and uses the Hex and Base64 codec classes to support the toHex() and toBase64() implementations.
SimpleCookie	Default Cookie implementation.
SimpleCredentialsMatcher	Simple CredentialsMatcher implementation.
SimpleHash	A Hash implementation that allows any MessageDigest algorithm name to be used.
SimpleHashRequest	Simple implementation of HashRequest that can be used when interacting with a HashService.
SimpleNamedFilterList	Simple NamedFilterList implementation that is supported by a backing List instance and a simple name property.
SimplePrincipalCollection	A simple implementation of the MutablePrincipalCollection interface that tracks principals internally by storing them in a LinkedHashMap.
SimplePrincipalMap	Default implementation of the PrincipalMap interface.
SimpleRole	A simple representation of a security role that has a name and a collection of permissions.
SimpleService	Simple Service with methods protected with annotations.
SimpleSession	Simple Session JavaBeans-compatible POJO implementation, intended to be used on the business/server tier.
SimpleSessionFactory	SessionFactory implementation that generates SimpleSession instances.
SingleArgumentMethodEventListener	A event listener that invokes a target object's method that accepts a single event argument.
SoftHashMap<K,V>	A SoftHashMap is a memory-constrained map that stores its values in SoftReferences.
SpringAnnotationResolver	AnnotationResolver implementation that uses Spring's more robust AnnotationUtils to find method annotations instead of the JDKs simpler (and rather lacking) Method.getAnnotation(class) implementation.
SslFilter	Filter which requires a request to be over SSL.
StoppedSessionException	Exception thrown when attempting to interact with the system under a session that has been stopped.
StringUtils	Simple utility class for String operations useful across the framework.
Subject	A Subject represents state and security operations for a single application user.
Subject.Builder	Builder design pattern implementation for creating Subject instances in a simplified way without requiring knowledge of Shiro's construction techniques.
SubjectAwareExecutor	Executor implementation that will automatically first associate any argument Runnable instances with the currently available Subject and then dispatch the Subject-enabled runnable to an underlying delegate Executor instance.
SubjectAwareExecutorService	ExecutorService implementation that will automatically first associate any argument Runnable or Callable instances with the currently available subject and then dispatch the Subject-enabled runnable or callable to an underlying delegate ExecutorService instance.
SubjectAwareScheduledExecutorService	Same concept as the SubjectAwareExecutorService but additionally supports the ScheduledExecutorService interface.
SubjectCallable<V>	A SubjectCallable associates a Subject with a target/delegate Callable to ensure proper Subject thread-state management when the Callable executes.
SubjectContext	A SubjectContext is a 'bucket' of data presented to a SecurityManager which interprets this data to construct Subject instances.
SubjectDAO	A SubjectDAO is responsible for persisting a Subject instance's internal state such that the Subject instance can be recreated at a later time if necessary.
SubjectFactory	A SubjectFactory is responsible for constructing Subject instances as needed.
SubjectPrincipalRequestFilter	A ContainerRequestFilter that replaces the SecurityContext with a ShiroSecurityContext.
SubjectRunnable	A SubjectRunnable ensures that a target/delegate Runnable will execute such that any call to SecurityUtils.getSubject() during the Runnable's execution will return the associated Subject instance.
SubjectThreadState	Manages thread-state for Subject access (supporting SecurityUtils.getSubject() calls) during a thread's execution.
Subscribe	Indicates a method is an event consumer.
TextConfigurationRealm	A SimpleAccountRealm that enables text-based configuration of the initial User, Role, and Permission objects created at startup.
ThreadContext	A ThreadContext provides a means of binding and unbinding objects to the current thread based on key/value pairs.
ThreadState	A ThreadState instance manages any state that might need to be bound and/or restored during a thread's execution.
TypedEventListener
UnauthenticatedException	Exception thrown when attempting to execute an authorization action when a successful authentication hasn't yet occurred.
UnauthorizedException	Thrown to indicate a requested operation or access to a requested resource is not allowed.
UnavailableSecurityManagerException	Exception thrown when attempting to acquire the application's SecurityManager instance, but Shiro's lookup heuristics cannot find one.
UnknownAccountException	Thrown when attempting to authenticate with a principal that doesn't exist in the system (e.g.
UnknownAlgorithmException	Exception thrown when attempting to lookup or use a cryptographic algorithm that does not exist in the current JVM environment.
UnknownClassException	The Shiro framework's RuntimeException equivalent of the JDK's ClassNotFoundException, to maintain a RuntimeException paradigm.
UnknownSessionException	Exception thrown when attempting to interact with the system under the pretense of a particular session (e.g.
UnresolveableReferenceException	Exception thrown when a reference to an object is made, but that object cannot be found.
UnsupportedAuthenticationMechanismException	Exception thrown when a configured LDAP Authentication Mechanism is unsupported by the target LDAP server.
UnsupportedTokenException	Exception thrown during the authentication process when an AuthenticationToken implementation is encountered that is not supported by one or more configured Realms.
UserAnnotationHandler	Checks to see if a @RequiresUser annotation is declared, and if so, ensures the calling Subject is either authenticated or remembered via remember me services before allowing access.
UserAnnotationMethodInterceptor	Checks to see if a @RequiresUser annotation is declared, and if so, ensures the calling Subject is either authenticated or remembered via remember me services before invoking the method.
UserFilter	Filter that allows access to resources if the accessor is a known user, which is defined as having a known principal.
UsernamePasswordToken	A simple username/password authentication token to support the most widely-used authentication mechanism.
UserTag	JSP tag that renders the tag body if the current user known to the system, either from a successful login attempt (not necessarily during the current session) or from 'RememberMe' services.
ValidatingSession	A ValidatingSession is a Session that is capable of determining it is valid or not and is able to validate itself if necessary.
ValidatingSessionManager	A ValidatingSessionManager is a SessionManager that can proactively validate any or all sessions that may be expired.
WebApp
WebDelegatingSubject	Default WebSubject implementation that additional ensures the ability to retain a servlet request/response pair to be used by internal shiro components as necessary during the request execution.
WebEnvironment	A web-specific Environment instance, used in web applications.
WebIniSecurityManagerFactory	Deprecated. use Shiro's Environment mechanisms instead.
WebSecurityManager	This interface represents a SecurityManager implementation that can used in web-enabled applications.
WebSessionContext	A WebSubjectContext is a SessionContext that additionally provides for type-safe methods to set and retrieve a ServletRequest and ServletResponse, as the request/response pair will often need to be referenced during construction of web-initiated Session instances.
WebSessionKey	A SessionKey implementation that also retains the ServletRequest and ServletResponse associated with the web request that is performing the session lookup.
WebSessionManager	SessionManager specific to web-enabled applications.
WebSubject	A WebSubject represents a Subject instance that was acquired as a result of an incoming ServletRequest.
WebSubject.Builder	A WebSubject.Builder performs the same function as a Subject.Builder, but additionally ensures that the Servlet request/response pair that is triggering the Subject instance's creation is retained for use by internal Shiro components as necessary.
WebSubjectContext	A WebSubjectContext is a SubjectContext that additionally provides for type-safe methods to set and retrieve a ServletRequest and ServletResponse.
WebUtils	Simple utility class for operations used across multiple class hierarchies in the web framework code.
WildcardPermission	A WildcardPermission is a very flexible permission construct supporting multiple levels of permission matching.
WildcardPermissionResolver	PermissionResolver implementation that returns a new WildcardPermission based on the input string.
XmlSerializer	Deprecated. This class should not be used directly because of unsecure XMLEncoder/XMLDecoder usage.