apache/shiro
Shiro
Shiro es un framework de seguridad de Java que proporciona un gestor de identidad y acceso para implementar autenticación, autorización, criptografía y gestión de sesiones. Sirve como una capa de seguridad para verificar las identidades de los usuarios y hacer cumplir el control de acceso basado en roles para los recursos protegidos del sistema.
El proyecto cuenta con una arquitectura de reino (realm) conectable que desacopla la lógica de seguridad de los datos de identidad y un sistema de gestión de sesiones independiente que rastrea el estado del usuario independientemente del contenedor de servlets subyacente. Incluye un integrador para proveedores de identidad externos utilizando protocolos de federación como OAuth 2.0 y SAML para permitir el inicio de sesión único (SSO).
El framework cubre una amplia superficie de capacidad, incluyendo la interceptación de peticiones a través de cadenas de filtros, la aplicación de seguridad declarativa mediante anotaciones y la protección de datos sensibles utilizando envoltorios criptográficos simétricos y asimétricos. También proporciona utilidades para el almacenamiento en caché de búsquedas de seguridad y la gestión de ciclos de vida de sesiones distribuidas en entornos empresariales.
Features
- Java Security Frameworks - Provides a comprehensive security framework for authentication, authorization, and session management in Java applications.
- Annotation-Based Security - Enforces access control by checking user permissions against roles defined via Java annotations.
- Pluggable Realm Architectures - Features a pluggable realm architecture that decouples security logic from identity data sources.
- HTTP Request Filtering - Filters HTTP requests to protect URL paths and endpoints by requiring specific authentication levels.
- Identity and Access Management - Acts as a security layer that verifies user identities and enforces role-based access control.
- Generic Resource Authorization - Evaluates permissions and roles to determine if a user is authorized to perform specific actions.
- User Identity Verification - Verifies user identities by matching credentials against pluggable data sources such as LDAP or JDBC.
- Path-Based Access Rules - Uses URL-based filter chains and path matching to intercept requests and enforce security constraints.
- SAML Integrations - Integrates with external identity providers using SAML and OAuth 2.0 for single sign-on capabilities.
- User - Tracks user state and interaction across multiple requests regardless of the storage mechanism.
- Role-Based Access Control - Implements role-based access control to grant or deny resource access based on assigned roles and permissions.
- URL Security Policy Enforcement - Restricts access to specific URL patterns in web applications using filters to enforce security policies.
- Session Lifecycle Management - Manages the lifecycle, expiration, and rotation of user sessions independently of the web container.
- Web Session Management - Implements a standalone session management system that tracks user state independently of the servlet container.
- Application Session Management - Provides a standalone session API to track user state independently of the servlet container.
- Security Filter Chains - Uses sequenced filter chains to intercept web requests and enforce security constraints before they reach the application.
- Security Lookup Caching - Stores security lookups in memory to reduce data retrieval time and enhance performance.
- Security Data Caches - Implements pluggable memory and distributed caching for authentication and authorization lookups to optimize performance.
- Distributed Session Managers - Provides distributed session management to synchronize user state across enterprise environments.
- Application Data Security - Secures application data and passwords using symmetric/asymmetric encryption and salted hashing.
- Symmetric and Asymmetric Ciphers - Provides unified API wrappers for symmetric and asymmetric ciphers to encrypt sensitive data and hash passwords.
- Cryptographic Operations - Provides an SDK for performing symmetric and asymmetric encryption and signing operations.
- Java - Ships a set of Java-based tools for symmetric/asymmetric encryption and secure password hashing.
- Data Protection - Protects sensitive information using cryptographic hashing with salts and symmetric encryption.
- Enterprise Identity Providers - Connects applications to enterprise identity providers using LDAP, OAuth 2.0, and SAML.
- External Identity Provider Integration - Integrates with external identity providers using standard protocols like OAuth 2.0 and SAML.
- Distributed Session Storage - Manages user session lifecycles across distributed server nodes to maintain a consistent user experience.
- Annotation-Based Authorization - Provides annotations to declaratively enforce role-based access control on Java methods and classes.
- Single Sign-On Solutions - Enables single sign-on by sharing authentication state across federated applications.
- Identity Context Management - Establishes and persists a security context for users to maintain identity across requests.
- Web Access Management - Protects URLs through automated login, logout, and remember-me services with minimal configuration.
- Security - Connects security logic and access control into existing Java software frameworks.
- Security Context Propagators - Maintains a thread-local security context representing the current user and their associated permissions.
