apache/shiro
Shiro
Shiro is a Java security framework that provides an identity and access manager for implementing authentication, authorization, cryptography, and session management. It serves as a security layer to verify user identities and enforce role-based access control for protected system resources.
The project features a pluggable realm architecture that decouples security logic from identity data and a standalone session management system that tracks user state independently of the underlying servlet container. It includes an integrator for external identity providers using federation protocols such as OAuth 2.0 and SAML to enable single sign-on.
The framework covers a broad capability surface including request interception through filter chains, declarative security enforcement via annotations, and the protection of sensitive data using symmetric and asymmetric cryptographic wrappers. It also provides utilities for caching security lookups and managing distributed session lifecycles across enterprise environments.
Features
- Java Security Frameworks - Provides a comprehensive security framework for authentication, authorization, and session management in Java applications.
- Annotation-Based Security - Enforces access control by checking user permissions against roles defined via Java annotations.
- Pluggable Realm Architectures - Features a pluggable realm architecture that decouples security logic from identity data sources.
- HTTP Request Filtering - Filters HTTP requests to protect URL paths and endpoints by requiring specific authentication levels.
- Identity and Access Management - Acts as a security layer that verifies user identities and enforces role-based access control.
- Generic Resource Authorization - Evaluates permissions and roles to determine if a user is authorized to perform specific actions.
- User Identity Verification - Verifies user identities by matching credentials against pluggable data sources such as LDAP or JDBC.
- Path-Based Access Rules - Uses URL-based filter chains and path matching to intercept requests and enforce security constraints.
- SAML Integrations - Integrates with external identity providers using SAML and OAuth 2.0 for single sign-on capabilities.
- User - Tracks user state and interaction across multiple requests regardless of the storage mechanism.
- Role-Based Access Control - Implements role-based access control to grant or deny resource access based on assigned roles and permissions.
- URL Security Policy Enforcement - Restricts access to specific URL patterns in web applications using filters to enforce security policies.
- Session Lifecycle Management - Manages the lifecycle, expiration, and rotation of user sessions independently of the web container.
- Web Session Management - Implements a standalone session management system that tracks user state independently of the servlet container.
- Application Session Management - Provides a standalone session API to track user state independently of the servlet container.
- Security Filter Chains - Uses sequenced filter chains to intercept web requests and enforce security constraints before they reach the application.
- Security Lookup Caching - Stores security lookups in memory to reduce data retrieval time and enhance performance.
- Security Data Caches - Implements pluggable memory and distributed caching for authentication and authorization lookups to optimize performance.
- Distributed Session Managers - Provides distributed session management to synchronize user state across enterprise environments.
- Application Data Security - Secures application data and passwords using symmetric/asymmetric encryption and salted hashing.
- Symmetric and Asymmetric Ciphers - Provides unified API wrappers for symmetric and asymmetric ciphers to encrypt sensitive data and hash passwords.
- Cryptographic Operations - Provides an SDK for performing symmetric and asymmetric encryption and signing operations.
- Java - Ships a set of Java-based tools for symmetric/asymmetric encryption and secure password hashing.
- Data Protection - Protects sensitive information using cryptographic hashing with salts and symmetric encryption.
- Enterprise Identity Providers - Connects applications to enterprise identity providers using LDAP, OAuth 2.0, and SAML.
- External Identity Provider Integration - Integrates with external identity providers using standard protocols like OAuth 2.0 and SAML.
- Distributed Session Storage - Manages user session lifecycles across distributed server nodes to maintain a consistent user experience.
- Annotation-Based Authorization - Provides annotations to declaratively enforce role-based access control on Java methods and classes.
- Single Sign-On Solutions - Enables single sign-on by sharing authentication state across federated applications.
- Identity Context Management - Establishes and persists a security context for users to maintain identity across requests.
- Web Access Management - Protects URLs through automated login, logout, and remember-me services with minimal configuration.
- Security - Connects security logic and access control into existing Java software frameworks.
- Security Context Propagators - Maintains a thread-local security context representing the current user and their associated permissions.
