org.apache.shiro.mgt
Class DefaultSecurityManager

java.lang.Object
  org.apache.shiro.mgt.CachingSecurityManager
      org.apache.shiro.mgt.RealmSecurityManager
          org.apache.shiro.mgt.AuthenticatingSecurityManager
              org.apache.shiro.mgt.AuthorizingSecurityManager
                  org.apache.shiro.mgt.SessionsSecurityManager
                      org.apache.shiro.mgt.DefaultSecurityManager

All Implemented Interfaces:

Authenticator, Authorizer, CacheManagerAware, SecurityManager, SessionManager, Destroyable

public class DefaultSecurityManager
extends SessionsSecurityManager

The Shiro framework's default concrete implementation of the SecurityManager interface, based around a collection of Realms. This implementation delegates its authentication, authorization, and session operations to wrapped Authenticator, Authorizer, and SessionManager instances respectively via superclass implementation.

To greatly reduce and simplify configuration, this implementation (and its superclasses) will create suitable defaults for all of its required dependencies, except the required one or more Realms. Because Realm implementations usually interact with an application's data model, they are almost always application specific; you will want to specify at least one custom Realm implementation that 'knows' about your application's data/security model (via RealmSecurityManager.setRealm(org.apache.shiro.realm.Realm) or one of the overloaded constructors). All other attributes in this class hierarchy will have suitable defaults for most enterprise applications.

RememberMe notice: This class supports the ability to configure a RememberMeManager for RememberMe identity services for login/logout, BUT, a default instance will not be created for this attribute at startup.

Because RememberMe services are inherently client tier-specific and therefore aplication-dependent, if you want RememberMe services enabled, you will have to specify an instance yourself via the setRememberMeManager mutator. However if you're reading this JavaDoc with the expectation of operating in a Web environment, take a look at the org.apache.shiro.web.DefaultWebSecurityManager implementation, which does support RememberMe services by default at startup.

Since:

0.2

Author:

Les Hazlewood, Jeremy Haile

Field Summary

protected RememberMeManager	rememberMeManager
protected SubjectFactory	subjectFactory

Constructor Summary

DefaultSecurityManager()
Default no-arg constructor.

DefaultSecurityManager(Collection<Realm> realms)
Supporting constructor for multiple realms.

DefaultSecurityManager(Realm singleRealm)
Supporting constructor for a single-realm application.

Method Summary

protected void	beforeLogout(Subject subject)
protected void	bind(Subject subject) Binds a Subject instance created after authentication to the application for later use.
protected SubjectContext	copy(SubjectContext subjectContext)
protected SessionContext	createSessionContext(SubjectContext subjectContext)
protected Subject	createSubject(AuthenticationToken token, AuthenticationInfo info, Subject existing) Creates a Subject instance for the user represented by the given method arguments.
Subject	createSubject(SubjectContext subjectContext) This implementation attempts to resolve any session ID that may exist in the context by passing it to the resolveSession(SubjectContext) method.
protected SubjectContext	createSubjectContext()
protected SubjectContext	ensureSecurityManager(SubjectContext context) Determines if there is a SecurityManager instance in the context, and if not, adds 'this' to the context.
protected PrincipalCollection	getRememberedIdentity(SubjectContext subjectContext)
RememberMeManager	getRememberMeManager()
protected SessionKey	getSessionKey(SubjectContext context)
SubjectFactory	getSubjectFactory()
Subject	login(Subject subject, AuthenticationToken token) First authenticates the AuthenticationToken argument, and if successful, constructs a Subject instance representing the authenticated account's identity.
void	logout(Subject subject) Logs out the specified Subject from the system.
protected void	onFailedLogin(AuthenticationToken token, AuthenticationException ae, Subject subject)
protected void	onSuccessfulLogin(AuthenticationToken token, AuthenticationInfo info, Subject subject)
protected void	rememberMeFailedLogin(AuthenticationToken token, AuthenticationException ex, Subject subject)
protected void	rememberMeLogout(Subject subject)
protected void	rememberMeSuccessfulLogin(AuthenticationToken token, AuthenticationInfo info, Subject subject)
protected Session	resolveContextSession(SubjectContext context)
protected SubjectContext	resolvePrincipals(SubjectContext context) Attempts to resolve an identity (a PrincipalCollection) for the context using heuristics.
protected SubjectContext	resolveSession(SubjectContext context) Attempts to resolve any associated session based on the context and returns a context that represents this resolved Session to ensure it may be referenced if necessary by the invoked SubjectFactory that performs actual Subject construction.
void	setRememberMeManager(RememberMeManager rememberMeManager)
void	setSubjectFactory(SubjectFactory subjectFactory)
protected void	stopSession(Subject subject)
protected void	unbind(Subject subject) Unbinds or removes the Subject's state from the application, typically called during logout(org.apache.shiro.subject.Subject).

Methods inherited from class org.apache.shiro.mgt.SessionsSecurityManager

afterCacheManagerSet, afterSessionManagerSet, applyCacheManagerToSessionManager, destroy, getSession, getSessionManager, setSessionManager, start

Methods inherited from class org.apache.shiro.mgt.AuthorizingSecurityManager

afterRealmsSet, checkPermission, checkPermission, checkPermissions, checkPermissions, checkRole, checkRoles, getAuthorizer, hasAllRoles, hasRole, hasRoles, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, setAuthorizer

Methods inherited from class org.apache.shiro.mgt.AuthenticatingSecurityManager

authenticate, getAuthenticator, setAuthenticator

Methods inherited from class org.apache.shiro.mgt.RealmSecurityManager

applyCacheManagerToRealms, getRealms, setRealm, setRealms

Methods inherited from class org.apache.shiro.mgt.CachingSecurityManager

getCacheManager, setCacheManager

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

rememberMeManager

protected RememberMeManager rememberMeManager

subjectFactory

protected SubjectFactory subjectFactory

Constructor Detail

DefaultSecurityManager

public DefaultSecurityManager()

Default no-arg constructor.

DefaultSecurityManager

public DefaultSecurityManager(Realm singleRealm)

Supporting constructor for a single-realm application.

Parameters:

singleRealm - the single realm used by this SecurityManager.

DefaultSecurityManager

public DefaultSecurityManager(Collection<Realm> realms)

Supporting constructor for multiple realms.

Parameters:

realms - the realm instances backing this SecurityManager.

Method Detail

getSubjectFactory

public SubjectFactory getSubjectFactory()

setSubjectFactory

public void setSubjectFactory(SubjectFactory subjectFactory)

getRememberMeManager

public RememberMeManager getRememberMeManager()

setRememberMeManager

public void setRememberMeManager(RememberMeManager rememberMeManager)

createSubjectContext

protected SubjectContext createSubjectContext()

createSubject

protected Subject createSubject(AuthenticationToken token,
                                AuthenticationInfo info,
                                Subject existing)

Creates a Subject instance for the user represented by the given method arguments.

Parameters:

token - the AuthenticationToken submitted for the successful authentication.

info - the AuthenticationInfo of a newly authenticated user.

existing - the existing Subject instance that initiated the authentication attempt

Returns:

the Subject instance that represents the context and session data for the newly authenticated subject.

bind

protected void bind(Subject subject)

Binds a Subject instance created after authentication to the application for later use.

The default implementation simply stores the Subject's principals and authentication state to the Subject's session to ensure it is available for reference later.

Parameters:

subject - the Subject instance created after authentication to be bound to the application for later use.

rememberMeSuccessfulLogin

protected void rememberMeSuccessfulLogin(AuthenticationToken token,
                                         AuthenticationInfo info,
                                         Subject subject)

rememberMeFailedLogin

protected void rememberMeFailedLogin(AuthenticationToken token,
                                     AuthenticationException ex,
                                     Subject subject)

rememberMeLogout

protected void rememberMeLogout(Subject subject)

login

public Subject login(Subject subject,
                     AuthenticationToken token)
              throws AuthenticationException

First authenticates the AuthenticationToken argument, and if successful, constructs a Subject instance representing the authenticated account's identity.

Once constructed, the Subject instance is then bound to the application for subsequent access before being returned to the caller.

Parameters:

token - the authenticationToken to process for the login attempt.

subject - the subject against which the authentication attempt will occur

Returns:

a Subject representing the authenticated user.

Throws:

AuthenticationException - if there is a problem authenticating the specified token.

onSuccessfulLogin

protected void onSuccessfulLogin(AuthenticationToken token,
                                 AuthenticationInfo info,
                                 Subject subject)

onFailedLogin

protected void onFailedLogin(AuthenticationToken token,
                             AuthenticationException ae,
                             Subject subject)

beforeLogout

protected void beforeLogout(Subject subject)

copy

protected SubjectContext copy(SubjectContext subjectContext)

createSubject

public Subject createSubject(SubjectContext subjectContext)

This implementation attempts to resolve any session ID that may exist in the context by passing it to the resolveSession(SubjectContext) method. The return value from that call is then used to attempt to resolve the subject identity via the resolvePrincipals(SubjectContext) method. The return value from that call is then used to create the Subject instance by calling getSubjectFactory().createSubject(resolvedContext);

Parameters:

subjectContext - any data needed to direct how the Subject should be constructed.

Returns:

the Subject instance reflecting the specified initialization data.

Since:

1.0

See Also:

SubjectFactory.createSubject(org.apache.shiro.subject.SubjectContext)

ensureSecurityManager

protected SubjectContext ensureSecurityManager(SubjectContext context)

Determines if there is a SecurityManager instance in the context, and if not, adds 'this' to the context. This ensures the SubjectFactory instance will have access to a SecurityManager during Subject construction if necessary.

Parameters:

context - the subject context data that may contain a SecurityManager instance.

Returns:

The SubjectContext to use to pass to a SubjectFactory for subject creation.

Since:

1.0

resolveSession

protected SubjectContext resolveSession(SubjectContext context)

Attempts to resolve any associated session based on the context and returns a context that represents this resolved Session to ensure it may be referenced if necessary by the invoked SubjectFactory that performs actual Subject construction.

If there is a Session already in the context because that is what the caller wants to be used for Subject construction, or if no session is resolved, this method effectively does nothing returns the Map method argument unaltered.

Parameters:

context - the subject context data that may resolve a Session instance.

Returns:

The context to use to pass to a SubjectFactory for subject creation.

Since:

1.0

resolveContextSession

protected Session resolveContextSession(SubjectContext context)
                                 throws InvalidSessionException

Throws:

InvalidSessionException

getSessionKey

protected SessionKey getSessionKey(SubjectContext context)

resolvePrincipals

protected SubjectContext resolvePrincipals(SubjectContext context)

Attempts to resolve an identity (a PrincipalCollection) for the context using heuristics. The implementation strategy:

1. Check the context to see if it can already resolve an identity. If so, this method does nothing and returns the method argument unaltered.
2. Check for a RememberMe identity by calling getRememberedIdentity(org.apache.shiro.subject.SubjectContext). If that method returns a non-null value, place the remembered PrincipalCollection in the context.
3. If the remembered identity is discovered, associate it with the session to eliminate unnecessary rememberMe accesses for the remainder of the session

Parameters:

context - the subject context data that may provide (directly or indirectly through one of its values) a PrincipalCollection identity.

Returns:

The Subject context to use to pass to a SubjectFactory for subject creation.

Since:

1.0

createSessionContext

protected SessionContext createSessionContext(SubjectContext subjectContext)

logout

public void logout(Subject subject)

Description copied from interface: SecurityManager

Logs out the specified Subject from the system.

Note that most application developers should not call this method unless they have a good reason for doing so. The preferred way to logout a Subject is to call Subject.logout(), not the SecurityManager directly.

Framework developers on the other hand might find calling this method directly useful in certain cases.

Parameters:

subject - the subject to log out.

stopSession

protected void stopSession(Subject subject)

unbind

protected void unbind(Subject subject)

Unbinds or removes the Subject's state from the application, typically called during logout(org.apache.shiro.subject.Subject).

This implementation is symmetric with the bind(org.apache.shiro.subject.Subject) method in that it will remove any principals and authentication state from the session if the session exists. If there is no subject session, this method does not do anything.

Parameters:

subject - the subject to unbind from the application as it will no longer be used.

getRememberedIdentity

protected PrincipalCollection getRememberedIdentity(SubjectContext subjectContext)