apache/shiro
Shiro
Shiro ist ein Java-Sicherheitsframework, das einen Identitäts- und Zugriffsmanager für die Implementierung von Authentifizierung, Autorisierung, Kryptografie und Sitzungsmanagement bereitstellt. Es fungiert als Sicherheitsschicht zur Überprüfung von Benutzeridentitäten und zur Durchsetzung rollenbasierter Zugriffskontrolle für geschützte Systemressourcen.
Das Projekt bietet eine steckbare Realm-Architektur, die Sicherheitslogik von Identitätsdaten entkoppelt, sowie ein eigenständiges Sitzungsmanagementsystem, das den Benutzerzustand unabhängig vom zugrunde liegenden Servlet-Container verfolgt. Es enthält einen Integrator für externe Identitätsanbieter unter Verwendung von Föderationsprotokollen wie OAuth 2.0 und SAML, um Single Sign-On zu ermöglichen.
Das Framework deckt eine breite Funktionsfläche ab, einschließlich Request-Interception durch Filter-Chains, deklarative Sicherheitsdurchsetzung via Annotationen und den Schutz sensibler Daten unter Verwendung symmetrischer und asymmetrischer kryptografischer Wrapper. Es bietet zudem Utilities für das Caching von Sicherheitsabfragen und die Verwaltung verteilter Sitzungslebenszyklen über Unternehmensumgebungen hinweg.
Features
- Java Security Frameworks - Provides a comprehensive security framework for authentication, authorization, and session management in Java applications.
- Annotation-Based Security - Enforces access control by checking user permissions against roles defined via Java annotations.
- Pluggable Realm Architectures - Features a pluggable realm architecture that decouples security logic from identity data sources.
- HTTP Request Filtering - Filters HTTP requests to protect URL paths and endpoints by requiring specific authentication levels.
- Identity and Access Management - Acts as a security layer that verifies user identities and enforces role-based access control.
- Generic Resource Authorization - Evaluates permissions and roles to determine if a user is authorized to perform specific actions.
- User Identity Verification - Verifies user identities by matching credentials against pluggable data sources such as LDAP or JDBC.
- Path-Based Access Rules - Uses URL-based filter chains and path matching to intercept requests and enforce security constraints.
- SAML Integrations - Integrates with external identity providers using SAML and OAuth 2.0 for single sign-on capabilities.
- User - Tracks user state and interaction across multiple requests regardless of the storage mechanism.
- Role-Based Access Control - Implements role-based access control to grant or deny resource access based on assigned roles and permissions.
- URL Security Policy Enforcement - Restricts access to specific URL patterns in web applications using filters to enforce security policies.
- Session Lifecycle Management - Manages the lifecycle, expiration, and rotation of user sessions independently of the web container.
- Web Session Management - Implements a standalone session management system that tracks user state independently of the servlet container.
- Application Session Management - Provides a standalone session API to track user state independently of the servlet container.
- Security Filter Chains - Uses sequenced filter chains to intercept web requests and enforce security constraints before they reach the application.
- Security Lookup Caching - Stores security lookups in memory to reduce data retrieval time and enhance performance.
- Security Data Caches - Implements pluggable memory and distributed caching for authentication and authorization lookups to optimize performance.
- Distributed Session Managers - Provides distributed session management to synchronize user state across enterprise environments.
- Application Data Security - Secures application data and passwords using symmetric/asymmetric encryption and salted hashing.
- Symmetric and Asymmetric Ciphers - Provides unified API wrappers for symmetric and asymmetric ciphers to encrypt sensitive data and hash passwords.
- Cryptographic Operations - Provides an SDK for performing symmetric and asymmetric encryption and signing operations.
- Java - Ships a set of Java-based tools for symmetric/asymmetric encryption and secure password hashing.
- Data Protection - Protects sensitive information using cryptographic hashing with salts and symmetric encryption.
- Enterprise Identity Providers - Connects applications to enterprise identity providers using LDAP, OAuth 2.0, and SAML.
- External Identity Provider Integration - Integrates with external identity providers using standard protocols like OAuth 2.0 and SAML.
- Distributed Session Storage - Manages user session lifecycles across distributed server nodes to maintain a consistent user experience.
- Annotation-Based Authorization - Provides annotations to declaratively enforce role-based access control on Java methods and classes.
- Single Sign-On Solutions - Enables single sign-on by sharing authentication state across federated applications.
- Identity Context Management - Establishes and persists a security context for users to maintain identity across requests.
- Web Access Management - Protects URLs through automated login, logout, and remember-me services with minimal configuration.
- Security - Connects security logic and access control into existing Java software frameworks.
- Security Context Propagators - Maintains a thread-local security context representing the current user and their associated permissions.
