This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-staging
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-staging by this push:
new c0bb2f0ce check site oct11
c0bb2f0ce is described below
commit c0bb2f0ce2015fb31c0b1b557580bd5cb98a4f8d
Author: lprimak <[email protected]>
AuthorDate: Sun Oct 11 00:40:01 2026 -0500
check site oct11
---
.gitignore | 9 ++
.well-known/security.txt | 2 +-
architecture.html | 4 +-
authentication.html | 3 +
authenticator.html | 235 +++++++++++++++++++++++++++++++++++++----
authorization.html | 3 +
authorizer.html | 265 +++++++++++++++++++++++++++++++++++++++++++----
feed.xml | 2 +-
issues.html | 7 +-
sitemap.xml | 16 +--
10 files changed, 486 insertions(+), 60 deletions(-)
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000..e9daf1963
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,9 @@
+*.iml
+.idea/
+/output
+/target/
+/.project
+/.settings
+/cache
+.sdkmanrc
+.DS_Store
diff --git a/.well-known/security.txt b/.well-known/security.txt
index 2df684228..f5e73a636 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-09-23T23:09:38Z
+Expires: 2027-10-11T05:39:47Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/architecture.html b/architecture.html
index 7d1076730..5efb72e7e 100644
--- a/architecture.html
+++ b/architecture.html
@@ -301,7 +301,7 @@ As mentioned above, the <code>SecurityManager</code> is the
heart of Shiro’
</li>
<li>
<p><strong>Authenticator</strong> (<a
href="static/current/apidocs/org/apache/shiro/authc/Authenticator.html">org.apache.shiro.authc.Authenticator</a>)
-The <code>Authenticator</code> is the component that is responsible for
executing and reacting to authentication (log-in) attempts by users. When a
user tries to log-in, that logic is executed by the <code>Authenticator</code>.
The <code>Authenticator</code> knows how to coordinate with one or more
<code>Realms</code> that store relevant user/account information. The data
obtained from these <code>Realms</code> is used to verify the user’s
identity to guarantee the user really is w [...]
+The <code>Authenticator</code> is the component that is responsible for
executing and reacting to authentication (log-in) attempts by users. When a
user tries to log-in, that logic is executed by the <code>Authenticator</code>.
The <code>Authenticator</code> knows how to coordinate with one or more
<code>Realms</code> that store relevant user/account information. The data
obtained from these <code>Realms</code> is used to verify the user’s
identity to guarantee the user really is w [...]
<div class="ulist">
<ul>
<li>
@@ -313,7 +313,7 @@ If more than one <code>Realm</code> is configured, the
<code>AuthenticationStrat
</li>
<li>
<p><strong>Authorizer</strong> (<a
href="static/current/apidocs/org/apache/shiro/authz/Authorizer.html">org.apache.shiro.authz.Authorizer</a>)
-The <code>Authorizer</code> is the component responsible determining users'
access control in the application. It is the mechanism that ultimately says if
a user is allowed to do something or not. Like the <code>Authenticator</code>,
the <code>Authorizer</code> also knows how to coordinate with multiple back-end
data sources to access role and permission information. The
<code>Authorizer</code> uses this information to determine exactly if a user is
allowed to perform a given action.</p>
+The <code>Authorizer</code> is the component responsible determining users'
access control in the application. It is the mechanism that ultimately says if
a user is allowed to do something or not. Like the <code>Authenticator</code>,
the <code>Authorizer</code> also knows how to coordinate with multiple back-end
data sources to access role and permission information. The
<code>Authorizer</code> uses this information to determine exactly if a user is
allowed to perform a given action. See [...]
</li>
<li>
<p><strong>SessionManager</strong> (<a
href="static/current/apidocs/org/apache/shiro/session/mgt/SessionManager.html">org.apache.shiro.session.mgt.SessionManager</a>)
diff --git a/authentication.html b/authentication.html
index 94071b732..acbb4c7c4 100644
--- a/authentication.html
+++ b/authentication.html
@@ -611,6 +611,9 @@ We will cover the <code>Realm</code> authentication
behavior shortly.</p>
<div class="sect2">
<h3 id="Authentication-AuthenticationSequence-Authenticator">Authenticator</h3>
<div class="paragraph">
+<p>For a standalone overview of the component, see <a
href="authenticator.html">Apache Shiro Authenticators</a>.</p>
+</div>
+<div class="paragraph">
<p>As mentioned earlier, the Shiro <code>SecurityManager</code>
implementations default to using a <a
href="/static/current/apidocs/org/apache/shiro/authc/pam/ModularRealmAuthenticator.html"><code>ModularRealmAuthenticator</code></a>
instance.
The <code>ModularRealmAuthenticator</code> equally supports applications with
single Realm as well as those with multiple realms.</p>
</div>
diff --git a/authenticator.html b/authenticator.html
index 672ad43c1..315dc0281 100644
--- a/authenticator.html
+++ b/authenticator.html
@@ -18,20 +18,26 @@
<html lang="en">
<head>
<meta charset="utf-8"/>
- <title>Authenticator | Apache Shiro</title>
+ <title>Apache Shiro Authenticators | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="keywords" content='documentation,todo,lend-a-hand'>
+ <meta name="description" content="Understanding Apache Shiro
Authenticators - the component responsible for verifying user identity. Learn
how Authenticators work with Realms and AuthenticationStrategies.">
+ <meta property="og:description" content="Understanding Apache Shiro
Authenticators - the component responsible for verifying user identity. Learn
how Authenticators work with Realms and AuthenticationStrategies.">
+ <meta name="keywords"
content='authenticator,authentication,security,realms'>
<meta name="generator" content="JBake">
<meta name="google-site-verification"
content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification"
content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
<meta name="google-site-verification"
content="gBTYOG8lMfNb_jrWrH3kFbudpEs_WrAJ2lb2-zLRaso"/>
<meta name="msvalidate.01" content="0B57EB46CBFAD8FD45008D2DB6B6C68C">
- <meta property="og:title" content="Authenticator | Apache Shiro"/>
- <meta property="og:type" content="website"/>
- <meta property="article:tag" content='documentation'/>
- <meta property="article:tag" content='todo'/>
- <meta property="article:tag" content='lend-a-hand'/>
+ <meta property="og:title" content="Apache Shiro Authenticators | Apache
Shiro"/>
+ <meta property="og:type" content="article"/>
+ <meta name="twitter:card" content="summary" />
+ <meta name="twitter:site" content="@ApacheShiro" />
+ <meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
+ <meta property="article:tag" content='authenticator'/>
+ <meta property="article:tag" content='authentication'/>
+ <meta property="article:tag" content='security'/>
+ <meta property="article:tag" content='realms'/>
<meta property="og:locale" content="en_US" />
<meta property="og:url"
content='https://shiro.apache.org/authenticator.html'/>
<meta property="og:image" content='images/shiro-featured-image.png'/>
@@ -196,26 +202,209 @@
</div>
</nav>
- <div class="page-header">
- <h1>Authenticator</h1>
+ <div class="page-header">
+ <h1>Apache Shiro Authenticators</h1>
+ </div>
+
+
+ <div class="admonitionblock tip">
+ <table>
+ <tbody>
+ <tr>
+ <td class="icon">
+ <div class="title">Handy Hint</div>
+ </td>
+ <td class="content">
+ <div class="title">Shiro v1 and v2 version end-of-life notice</div>
+ <div class="paragraph">
+ <p>As of February 28, 2024, Shiro v1 was superseded by v2.<p>
+ <p>As of June 29, 2026, Shiro v2 was superseded by v3.<p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+ </table>
</div>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#Authenticator-Role">Role in the SecurityManager</a></li>
+<li><a
href="#Authenticator-ModularRealmAuthenticator">ModularRealmAuthenticator</a></li>
+<li><a href="#Authenticator-SingleVsMultipleRealms">Single vs. Multiple
Realms</a></li>
+<li><a
href="#Authenticator-AuthenticationStrategy">AuthenticationStrategy</a></li>
+<li><a href="#Authenticator-Configuration">Configuration</a></li>
+<li><a href="#Authenticator-RealmInteraction">How Authenticators Work with
Realms</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
<div class="paragraph">
-<p>TODO</p>
+<p>An <code>Authenticator</code> is a component responsible for verifying that
a user actually is who they claim to be.
+It is the core component that executes the authentication process on behalf of
the <a href="/subject.html">Subject</a>.</p>
</div>
-<hr />
-
-<h2><a id="Lendahandwithdocumentation"></a>Lend a hand with documentation</h2>
-
-<p>While we hope this documentation helps you with the work you're doing with
Apache Shiro,
- the community is improving and expanding the documentation all the time.
- If you'd like to help the Shiro project, please consider correcting,
expanding, or adding documentation where you see a need.
- Every little bit of help you provide expands the community and in turn
improves Shiro. </p>
-
-<p>The easiest way to contribute your documentation is to submit a
pull-request by clicking on the <code>Edit</code> link below,
- or send it to the <a href="mailing-lists.html" title="Mailing Lists">User
Mailing List</a>.</p>
-
-<hr />
+<div class="paragraph">
+<p>While the <a href="/authentication.html">Authentication</a> documentation
explains the concepts and workflow of authentication in Shiro,
+the Authenticator represents the actual implementation component that performs
identity verification.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-Role">Role in the SecurityManager</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The <a href="/securitymanager.html">SecurityManager</a> does not perform
authentication directly.
+Instead, it delegates authentication requests to its internal
<code>Authenticator</code> instance.
+When a <a href="/subject.html">Subject</a> calls <a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#login(org.apache.shiro.authc.AuthenticationToken)"><code>login(token)</code></a>,
+the SecurityManager receives the request and immediately delegates to the
Authenticator by calling
+<a
href="/static/current/apidocs/org/apache/shiro/authc/Authenticator.html#authenticate(org.apache.shiro.authc.AuthenticationToken)"><code>authenticate(token)</code></a>.</p>
+</div>
+<div class="paragraph">
+<p>The Authenticator takes the submitted <a
href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationToken.html"><code>AuthenticationToken</code></a>
+and uses it to verify the Subject’s identity.
+If verification succeeds, it returns an <a
href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationInfo.html"><code>AuthenticationInfo</code></a>
object.
+If verification fails, it throws an <a
href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationException.html"><code>AuthenticationException</code></a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-ModularRealmAuthenticator">ModularRealmAuthenticator</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Shiro uses the <a
href="/static/current/apidocs/org/apache/shiro/authc/pam/ModularRealmAuthenticator.html"><code>ModularRealmAuthenticator</code></a>
+by default.
+This implementation supports coordinating one or more <a
href="/realm.html">Realms</a> during the authentication process.</p>
+</div>
+<div class="paragraph">
+<p>When an authentication token is submitted, the
ModularRealmAuthenticator:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Iterates through configured Realms</p>
+</li>
+<li>
+<p>Calls each Realm’s <a
href="/static/current/apidocs/org/apache/shiro/realm/Realm.html#supports(org.apache.shiro.authc.AuthenticationToken)"><code>supports(token)</code></a>
method to determine if the Realm can process the token</p>
+</li>
+<li>
+<p>If a Realm supports the token, its <a
href="/static/current/apidocs/org/apache/shiro/realm/Realm.html#getAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken)"><code>getAuthenticationInfo(token)</code></a>
method is invoked</p>
+</li>
+<li>
+<p>Returns authentication information if successful, or throws an exception if
failed</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-SingleVsMultipleRealms">Single vs. Multiple Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The ModularRealmAuthenticator supports both configurations:</p>
+</div>
+<div class="paragraph">
+<p><strong>Single Realm</strong>:
+When only one Realm is configured, the Authenticator directly invokes that
Realm to verify the Subject’s credentials.</p>
+</div>
+<div class="paragraph">
+<p><strong>Multiple Realms</strong>:
+When multiple Realms are configured, the Authenticator uses an <a
href="/static/current/apidocs/org/apache/shiro/authc/pam/AuthenticationStrategy.html"><code>AuthenticationStrategy</code></a>
+to determine how to coordinate authentication across the Realms.
+This is a <a
href="https://en.wikipedia.org/wiki/Pluggable_Authentication_Modules";>PAM</a>-style
approach where each Realm can be consulted in sequence.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-AuthenticationStrategy">AuthenticationStrategy</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>When multiple Realms are configured, the Authenticator must determine if
the overall authentication attempt succeeds or fails.
+The <a
href="/static/current/apidocs/org/apache/shiro/authc/pam/AuthenticationStrategy.html"><code>AuthenticationStrategy</code></a>
makes this determination.</p>
+</div>
+<div class="paragraph">
+<p>Shiro provides three built-in strategies:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><strong>FirstSuccessfulStrategy</strong>: Consults Realms in order until
one succeeds. Remaining Realms are not consulted.</p>
+</li>
+<li>
+<p><strong>AtLeastOneSuccessfulStrategy</strong>: Returns success if at least
one Realm succeeds. Other Realms continue to be consulted.</p>
+</li>
+<li>
+<p><strong>AllSuccessfulStrategy</strong>: All Realms must succeed for
authentication to succeed. This is the most restrictive.</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>You can configure which strategy the Authenticator uses, or implement your
own strategy for custom behavior.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-Configuration">Configuration</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>You can configure a custom Authenticator in your Shiro configuration if
needed:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs"
data-lang="ini">authenticator = com.foo.bar.CustomAuthenticator
+securityManager.authenticator = $authenticator</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>You can also configure the AuthenticationStrategy:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs"
data-lang="ini">authenticationStrategy =
org.apache.shiro.authc.pam.FirstSuccessfulStrategy
+authenticator.authenticationStrategy = $authenticationStrategy</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>However, in most cases, the default ModularRealmAuthenticator with the
default strategy is sufficient for typical applications.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-RealmInteraction">How Authenticators Work with
Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authenticator does not directly know how to verify credentials.
+Instead, it coordinates with configured Realms to perform the actual
verification.</p>
+</div>
+<div class="paragraph">
+<p>A <a href="/realm.html">Realm</a> is a security-specific data access object
that can locate and validate user credentials from a data source
+(database, LDAP, file system, etc.).
+The Realm is responsible for:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Determining if it understands the submitted AuthenticationToken via its
<code>supports(token)</code> method</p>
+</li>
+<li>
+<p>Looking up the user in the data source</p>
+</li>
+<li>
+<p>Comparing submitted credentials with those stored in the data source</p>
+</li>
+<li>
+<p>Returning the user’s authentication information if credentials
match</p>
+</li>
+<li>
+<p>Throwing an exception if credentials do not match</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>The Authenticator simply orchestrates this process by delegating to Realms
in order and handling the results according to its configured strategy.</p>
+</div>
+</div>
+</div>
+ <hr />
</div>
diff --git a/authorization.html b/authorization.html
index 560292bee..99bd6df71 100644
--- a/authorization.html
+++ b/authorization.html
@@ -1030,6 +1030,9 @@ public void updateAccount(Account account) {
<div class="sect2">
<h3 id="Authentication-AuthorizingSubjects-ModularRealmAuthorizer">Modular
Realm Authorizer</h3>
<div class="paragraph">
+<p>For a standalone overview of the component, see <a
href="authorizer.html">Apache Shiro Authorizers</a>.</p>
+</div>
+<div class="paragraph">
<p>As mentioned earlier, the Shiro <code>SecurityManager</code>
implementations default to using a <a
href="static/current/apidocs/org/apache/shiro/authz/ModularRealmAuthorizer.html"><code>ModularRealmAuthorizer</code></a>
instance. The <code>ModularRealmAuthorizer</code> equally supports
applications with single Realm as well as those with multiple realms.</p>
</div>
<div class="paragraph">
diff --git a/authorizer.html b/authorizer.html
index ea4dad0be..2324e4516 100644
--- a/authorizer.html
+++ b/authorizer.html
@@ -18,20 +18,27 @@
<html lang="en">
<head>
<meta charset="utf-8"/>
- <title>Authorizer | Apache Shiro</title>
+ <title>Apache Shiro Authorizers | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="keywords" content='documentation,todo,lend-a-hand'>
+ <meta name="description" content="Understanding Apache Shiro Authorizers -
the component that determines what authenticated users are allowed to do. Learn
how Authorizers work with Realms to evaluate permissions and roles.">
+ <meta property="og:description" content="Understanding Apache Shiro
Authorizers - the component that determines what authenticated users are
allowed to do. Learn how Authorizers work with Realms to evaluate permissions
and roles.">
+ <meta name="keywords"
content='authorizer,authorization,access-control,permissions,roles'>
<meta name="generator" content="JBake">
<meta name="google-site-verification"
content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification"
content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
<meta name="google-site-verification"
content="gBTYOG8lMfNb_jrWrH3kFbudpEs_WrAJ2lb2-zLRaso"/>
<meta name="msvalidate.01" content="0B57EB46CBFAD8FD45008D2DB6B6C68C">
- <meta property="og:title" content="Authorizer | Apache Shiro"/>
- <meta property="og:type" content="website"/>
- <meta property="article:tag" content='documentation'/>
- <meta property="article:tag" content='todo'/>
- <meta property="article:tag" content='lend-a-hand'/>
+ <meta property="og:title" content="Apache Shiro Authorizers | Apache
Shiro"/>
+ <meta property="og:type" content="article"/>
+ <meta name="twitter:card" content="summary" />
+ <meta name="twitter:site" content="@ApacheShiro" />
+ <meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
+ <meta property="article:tag" content='authorizer'/>
+ <meta property="article:tag" content='authorization'/>
+ <meta property="article:tag" content='access-control'/>
+ <meta property="article:tag" content='permissions'/>
+ <meta property="article:tag" content='roles'/>
<meta property="og:locale" content="en_US" />
<meta property="og:url"
content='https://shiro.apache.org/authorizer.html'/>
<meta property="og:image" content='images/shiro-featured-image.png'/>
@@ -196,26 +203,242 @@
</div>
</nav>
- <div class="page-header">
- <h1>Authorizer</h1>
+ <div class="page-header">
+ <h1>Apache Shiro Authorizers</h1>
+ </div>
+
+
+ <div class="admonitionblock tip">
+ <table>
+ <tbody>
+ <tr>
+ <td class="icon">
+ <div class="title">Handy Hint</div>
+ </td>
+ <td class="content">
+ <div class="title">Shiro v1 and v2 version end-of-life notice</div>
+ <div class="paragraph">
+ <p>As of February 28, 2024, Shiro v1 was superseded by v2.<p>
+ <p>As of June 29, 2026, Shiro v2 was superseded by v3.<p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+ </table>
</div>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#Authorizer-Role">Role in the SecurityManager</a></li>
+<li><a
href="#Authorizer-ModularRealmAuthorizer">ModularRealmAuthorizer</a></li>
+<li><a href="#Authorizer-PermissionAndRoleChecks">Permission and Role
Checks</a>
+<ul class="sectlevel2">
+<li><a href="#Authorizer-PermissionChecks">Permission Checks</a></li>
+<li><a href="#Authorizer-RoleChecks">Role Checks</a></li>
+</ul>
+</li>
+<li><a href="#Authorizer-Configuration">Configuration</a></li>
+<li><a href="#Authorizer-RealmInteraction">How Authorizers Work with
Realms</a></li>
+<li><a href="#Authorizer-MultipleRealms">Authorization with Multiple
Realms</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
<div class="paragraph">
-<p>TODO</p>
+<p>An <code>Authorizer</code> is a component responsible for determining
whether a user is allowed to perform a certain action.
+It evaluates whether a <code>Subject</code> has the necessary permissions or
roles to access a resource or perform an operation.</p>
</div>
-<hr />
-
-<h2><a id="Lendahandwithdocumentation"></a>Lend a hand with documentation</h2>
-
-<p>While we hope this documentation helps you with the work you're doing with
Apache Shiro,
- the community is improving and expanding the documentation all the time.
- If you'd like to help the Shiro project, please consider correcting,
expanding, or adding documentation where you see a need.
- Every little bit of help you provide expands the community and in turn
improves Shiro. </p>
+<div class="paragraph">
+<p>While the <a href="/authorization.html">Authorization</a> documentation
explains the concepts and workflow of access control in Shiro,
+the Authorizer represents the actual implementation component that performs
access control decisions.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-Role">Role in the SecurityManager</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The <a href="/securitymanager.html">SecurityManager</a> does not perform
authorization checks directly.
+Instead, it delegates authorization decisions to its internal
<code>Authorizer</code> instance.
+When a <a href="/subject.html">Subject</a> calls authorization methods such as
+<a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole(java.lang.String)"><code>hasRole(role)</code></a>,
+<a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(org.apache.shiro.authz.Permission)"><code>isPermitted(permission)</code></a>,
+or their variants, the SecurityManager delegates to the Authorizer.</p>
+</div>
+<div class="paragraph">
+<p>The Authorizer determines whether the Subject is permitted to perform the
requested action by checking the Subject’s roles and permissions.
+If the Subject has the necessary role or permission, the authorization check
passes.
+If not, an <a
href="/static/current/apidocs/org/apache/shiro/authz/AuthorizationException.html"><code>AuthorizationException</code></a>
may be thrown.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-ModularRealmAuthorizer">ModularRealmAuthorizer</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Shiro uses the <a
href="/static/current/apidocs/org/apache/shiro/authz/ModularRealmAuthorizer.html"><code>ModularRealmAuthorizer</code></a>
+by default.
+This implementation supports coordinating one or more <a
href="/realm.html">Realms</a> during the authorization process.</p>
+</div>
+<div class="paragraph">
+<p>When an authorization check is performed, the ModularRealmAuthorizer:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Iterates through configured Realms</p>
+</li>
+<li>
+<p>For each Realm that implements the <code>Authorizer</code> interface, calls
the corresponding authorization method
+(<code>hasRole*</code>, <code>checkRole*</code>, <code>isPermitted*</code>, or
<code>checkPermission*</code>)</p>
+</li>
+<li>
+<p>Aggregates and evaluates the results according to Shiro’s
authorization semantics</p>
+</li>
+<li>
+<p>Returns the authorization decision to the caller</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>It is important to note that the ModularRealmAuthorizer treats Realms
differently depending on whether they implement the <code>Authorizer</code>
interface.
+If a Realm does not implement <code>Authorizer</code>, it is not consulted for
authorization checks.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-PermissionAndRoleChecks">Permission and Role Checks</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authorizer performs two types of authorization checks:</p>
+</div>
+<div class="sect2">
+<h3 id="Authorizer-PermissionChecks">Permission Checks</h3>
+<div class="paragraph">
+<p>Permission checks verify whether a Subject is allowed to perform a specific
action on a specific resource.
+Methods for permission checks include:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(org.apache.shiro.authz.Permission)"><code>isPermitted(permission)</code></a>
- returns <code>true</code> or <code>false</code></p>
+</li>
+<li>
+<p><a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermission(org.apache.shiro.authz.Permission)"><code>checkPermission(permission)</code></a>
- throws an exception on failure</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>For example:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs"
data-lang="java">if (subject.isPermitted("account:read")) {
+ //User can read accounts
+}
-<p>The easiest way to contribute your documentation is to submit a
pull-request by clicking on the <code>Edit</code> link below,
- or send it to the <a href="mailing-lists.html" title="Mailing Lists">User
Mailing List</a>.</p>
+subject.checkPermission("document:delete:report123");</code></pre>
+</div>
+</div>
+</div>
+<div class="sect2">
+<h3 id="Authorizer-RoleChecks">Role Checks</h3>
+<div class="paragraph">
+<p>Role checks verify whether a Subject has a specific role. Methods for role
checks include:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole(java.lang.String)"><code>hasRole(role)</code></a>
- returns <code>true</code> or <code>false</code></p>
+</li>
+<li>
+<p><a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRole(java.lang.String)"><code>checkRole(role)</code></a>
- throws an exception on failure</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>For example:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs"
data-lang="java">if (subject.hasRole("admin")) {
+ //User is an administrator
+}
-<hr />
+subject.checkRole("user");</code></pre>
+</div>
+</div>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-Configuration">Configuration</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>You can configure a custom Authorizer in your Shiro configuration if
needed:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs"
data-lang="ini">authorizer = com.foo.bar.CustomAuthorizer
+securityManager.authorizer = $authorizer</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>However, in most cases, the default ModularRealmAuthorizer is sufficient
for typical applications.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-RealmInteraction">How Authorizers Work with Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authorizer does not directly know where to retrieve authorization data.
+Instead, it coordinates with configured Realms to perform the actual
authorization checks.</p>
+</div>
+<div class="paragraph">
+<p>A <a href="/realm.html">Realm</a> is a security-specific data access object
that knows how to retrieve authorization data from a data source
+(database, LDAP, file system, etc.).
+The Realm is responsible for:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Determining if it implements the <code>Authorizer</code> interface (which
indicates it can perform authorization checks)</p>
+</li>
+<li>
+<p>Retrieving the Subject’s roles and permissions from the data
source</p>
+</li>
+<li>
+<p>Evaluating whether the Subject has the requested role or permission</p>
+</li>
+<li>
+<p>Returning the results of the authorization check</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>The Authorizer simply orchestrates this process by delegating to Realms and
aggregating their results.
+This allows you to use multiple Realms where authorization data may come from
different sources,
+and Shiro will coordinate the results appropriately.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-MultipleRealms">Authorization with Multiple Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>When multiple Realms are configured, the ModularRealmAuthorizer consults
all Realms that implement the <code>Authorizer</code> interface.
+The results are aggregated to determine the final authorization decision.</p>
+</div>
+<div class="paragraph">
+<p>Typically, if any Realm grants permission or role membership, the
authorization check succeeds.
+However, the exact behavior depends on the authorization data model and how
the Realms are configured.
+Custom Authorizer implementations can be used to implement different
aggregation strategies if needed.</p>
+</div>
+</div>
+</div>
+ <hr />
</div>
diff --git a/feed.xml b/feed.xml
index 38d2f0d27..76fc82f6e 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-09-23T23:09:39Z</updated>
+ <updated>2026-10-11T05:39:47Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/issues.html b/issues.html
index 1aba1e9dc..bd8c9aacf 100644
--- a/issues.html
+++ b/issues.html
@@ -20,9 +20,9 @@
<meta charset="utf-8"/>
<title>Apache Shiro Bug & Issue Tracking | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="description" content="Report bugs, request features, and track
issues for Apache Shiro using GitHub Issues tracking system.">
- <meta property="og:description" content="Report bugs, request features,
and track issues for Apache Shiro using GitHub Issues tracking system.">
- <meta name="keywords" content='issues,bugs,jira,bug-tracking,support'>
+ <meta name="description" content="Report bugs, request features, and track
issues for Apache Shiro using GitHub Issues.">
+ <meta property="og:description" content="Report bugs, request features,
and track issues for Apache Shiro using GitHub Issues.">
+ <meta name="keywords" content='issues,bugs,bug-tracking,support'>
<meta name="generator" content="JBake">
<meta name="google-site-verification"
content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification"
content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
@@ -36,7 +36,6 @@
<meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
<meta property="article:tag" content='issues'/>
<meta property="article:tag" content='bugs'/>
- <meta property="article:tag" content='jira'/>
<meta property="article:tag" content='bug-tracking'/>
<meta property="article:tag" content='support'/>
<meta property="og:locale" content="en_US" />
diff --git a/sitemap.xml b/sitemap.xml
index 3ead291f8..70ad7d6b3 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -56,6 +56,10 @@
<loc>https://shiro.apache.org/get-started.html</loc>
<lastmod>2010-03-18</lastmod>
</url>
+ <url>
+ <loc>https://shiro.apache.org/authorizer.html</loc>
+ <lastmod>2010-03-18</lastmod>
+ </url>
<url>
<loc>https://shiro.apache.org/java-cryptography-guide.html</loc>
<lastmod>2010-03-18</lastmod>
@@ -112,6 +116,10 @@
<loc>https://shiro.apache.org/commercial-support.html</loc>
<lastmod>2010-03-18</lastmod>
</url>
+ <url>
+ <loc>https://shiro.apache.org/authenticator.html</loc>
+ <lastmod>2010-03-18</lastmod>
+ </url>
<url>
<loc>https://shiro.apache.org/what-is-shiro.html</loc>
<lastmod>2010-03-18</lastmod>
@@ -568,14 +576,6 @@
<loc>https://shiro.apache.org/release-archive.html</loc>
<lastmod>2022-06-28</lastmod>
</url>
- <url>
- <loc>https://shiro.apache.org/authorizer.html</loc>
- <lastmod>2026-05-25</lastmod>
- </url>
- <url>
- <loc>https://shiro.apache.org/authenticator.html</loc>
- <lastmod>2026-05-25</lastmod>
- </url>
<url>
<loc>https://shiro.apache.org/team.html</loc>
<lastmod>2023-02-08</lastmod>
