zhangkaitao/shiro-example
Shiro Example
This project is a reference implementation and a collection of code samples for deploying the Apache Shiro security framework within Java-based web applications. It serves as a demonstration for implementing authentication, authorization, and user identity management.
The implementation features distributed session management to coordinate user states across multiple server instances for high availability. It also includes samples for third-party OAuth2 integration, enabling external account authentication, and single sign-on support to grant access to multiple related applications.
The project covers broad security capabilities including role-based access control with dynamic URL permissions and resource access restrictions. It also demonstrates the use of security filters for request interception, concurrent login control, and the encryption of sensitive data.
Features
- Apache Shiro Implementations - Serves as a reference implementation for deploying the Apache Shiro security framework in Java applications.
- Reference Implementations - Provides a collection of code samples demonstrating authentication and authorization using Apache Shiro.
- Distributed Session Storage - Coordinates user session state across multiple server instances using a shared external data store for high availability.
- User Identity Verification - Provides a system for verifying user identities to ensure secure access to the application.
- Java Security Frameworks - Implements role-based access control and identity verification within Java-based web applications.
- Permission-Based Access Control - Provides a security model where access to resources is granted based on permissions assigned to users or roles.
- Role-Based Access Control - Restricts system operations by mapping users to roles and roles to granular permissions.
- User Identity Management - Manages user profiles, authentication, and the assignment of roles and permissions.
- Web Application Security - Implements a security layer using filters and interceptors to protect web endpoints and pages.
- Security Filter Chains - Uses a chain of security filters to enforce authentication and authorization on incoming HTTP requests.
- Server-Side Session Stores - Provides server-side session storage to maintain user state across distributed server instances.
- Concurrent Session Restrictions - Limits the number of simultaneous active sessions a single user can maintain across devices.
- OAuth2 Integration - Connects to OAuth2 providers to enable secure user authorization and external account sign-in.
- Dynamic Permission Refresh - Allows real-time updates of resource access rules by loading permission sets from a database.
- URL Permission Mapping - Provides the ability to update resource access rules for URLs in real-time without restarting the application.
- Session Lifecycle Management - Manages the creation, rotation, and expiration of user sessions to track state across multiple requests.
- Single Sign-On Solutions - Implements single sign-on to grant access to multiple related applications with one authentication.
- Third-Party Authentication Providers - Integrates external identity providers using OAuth2 protocols for user authentication.
