Package Summary
Annotations used to restrict which classes, instances, or methods may be accessed or invoked depending on the caller's access abilities or authentication state.
Contains AOP implementation support classes specifically used for authorization operations, particularly supporting AOP Method Interceptors and JSR-175 metadata Annotations.
Support and default implementations for Shiro's
Permission interface.
Interface Summary
AuthorizationInfo represents a single Subject's stored authorization data (roles, permissions, etc) used during authorization (access control) checks only.
An
Authorizer performs authorization (access control) operations for any given Subject (aka 'application user').
A Permission represents the ability to perform an action or access a resource.
Class Summary
A
ModularRealmAuthorizer is an
Authorizer implementation that consults one or more configured
Realms during an authorization operation.
Simple POJO implementation of the
AuthorizationInfo interface that stores roles and permissions as internal attributes.
A simple representation of a security role that has a name and a collection of permissions.
Exception Summary
Exception thrown if there is a problem during authorization (access control check).
Thrown when a particular client (that is, host address) has not been enabled to access the system or if the client has been enabled access but is not permitted to perform a particular operation or access a particular resource.
Exception thrown when attempting to execute an authorization action when a successful authentication hasn't yet occurred.
Thrown to indicate a requested operation or access to a requested resource is not allowed.
Package org.apache.shiro.authz Description
Core interfaces and exceptions supporting Authorization (access control).
Shiro abbreviates the word 'AuthoriZation' as
authz to distinguish it seperately from 'AuthentiCation', abbreviated as
authc.
This package's primary interface of interest, which is the core of Shiro authorization functionality, is the
Authorizer. This interface handles all aspects of principal-related security and is the facade to all other Shiro authorization components.
Shiro has the ability to authorize subjects (a.k.a. users) without being intrusive to the application's domain model. Most applications will utilize the concepts of
groups,
roles, and
permissions, but Shiro tries to be as non-invasive as possible doesn't require any such interfaces (although a Permission interface is made available for fine-grained access control policies if you want to use Shiro's permission support out-of-the-box).
Although it is possible for applications to implement this and other interfaces directly, it is not recommended. Shiro already has base implementations which should be suitable for 99% of deployments.