CODEWITHSUNDEEP
javaauthorizationshirodropwizard
Marco Lamina
Marco Lamina

Reputation: 3644

Dynamic instance-level permissions with Apache Shiro

I am creating a REST service in Java using Dropwizard in combination with Apache Shiro for authentication and authorization. I extended JdbcRealm in order to make Shiro use my PostgreSQL database (which I access through Hibernate). Authentication works well. Creating group-level permissions is also very easy. Unfortunately, I was not able to find an idiomatic way to bind certain resource instances to specific users (subjects). I know that Shiro provides support for instance-level access control, but the documentation does not show a workflow which allows me to do the following:

Any hints or recommendations are appreciated!

Upvotes: 3

Views: 1667

Answers (1)

Alex Edwards
Alex Edwards

Reputation: 1673

I'm investigating a similar problem where I have a multi tenancy requirement so I don't know who the tenant is at compile time, something like this type of permission string:

global:{tenant}:users:limited,c,r,u,d

You might want to take a look at PermissionResolver I found this page quite helpful AuthorizationConfiguration from the shiro docs, the shiro docs are a bit of a scattergun

Upvotes: 2

Related Questions