This is an automated email from the ASF dual-hosted git repository.
lprimak pushed a commit to branch asf-site
in repository https://gitbox.apache.org/repos/asf/shiro-site.git
The following commit(s) were added to refs/heads/asf-site by this push:
new faec2b76f Oct 11, 2026 update
faec2b76f is described below
commit faec2b76f5528270f351a20c272d5a47e9d836b0
Author: lprimak <[email protected]>
AuthorDate: Sun Oct 11 01:07:05 2026 -0500
Oct 11, 2026 update
---
.gitignore | 9 ++
.well-known/security.txt | 2 +-
architecture.html | 4 +-
authentication.html | 3 +
authenticator.html | 263 ++++++++++++++++++++++++++++++++----
authorization.html | 3 +
authorizer.html | 296 ++++++++++++++++++++++++++++++++++++++---
documentation.html | 23 +++-
feed.xml | 2 +-
get-started.html | 39 ++++++
guides.html | 88 +++++++++++-
issues.html | 7 +-
java-authentication-guide.html | 28 ++++
java-authorization-guide.html | 29 +++-
reference.html | 39 ++++++
sitemap.xml | 16 +--
16 files changed, 781 insertions(+), 70 deletions(-)
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 000000000..e9daf1963
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,9 @@
+*.iml
+.idea/
+/output
+/target/
+/.project
+/.settings
+/cache
+.sdkmanrc
+.DS_Store
diff --git a/.well-known/security.txt b/.well-known/security.txt
index fc359b2fe..405a4c9cb 100644
--- a/.well-known/security.txt
+++ b/.well-known/security.txt
@@ -1,5 +1,5 @@
Contact: mailto:[email protected]
-Expires: 2027-09-26T17:08:16Z
+Expires: 2027-10-11T06:06:47Z
Preferred-Languages: en
Canonical: https://shiro.apache.org/.well-known/security.txt
Policy: https://shiro.apache.org/security-reports.html
\ No newline at end of file
diff --git a/architecture.html b/architecture.html
index 7d1076730..5efb72e7e 100644
--- a/architecture.html
+++ b/architecture.html
@@ -301,7 +301,7 @@ As mentioned above, the <code>SecurityManager</code> is the
heart of Shiro’
</li>
<li>
<p><strong>Authenticator</strong> (<a
href="static/current/apidocs/org/apache/shiro/authc/Authenticator.html">org.apache.shiro.authc.Authenticator</a>)
-The <code>Authenticator</code> is the component that is responsible for
executing and reacting to authentication (log-in) attempts by users. When a
user tries to log-in, that logic is executed by the <code>Authenticator</code>.
The <code>Authenticator</code> knows how to coordinate with one or more
<code>Realms</code> that store relevant user/account information. The data
obtained from these <code>Realms</code> is used to verify the user’s
identity to guarantee the user really is w [...]
+The <code>Authenticator</code> is the component that is responsible for
executing and reacting to authentication (log-in) attempts by users. When a
user tries to log-in, that logic is executed by the <code>Authenticator</code>.
The <code>Authenticator</code> knows how to coordinate with one or more
<code>Realms</code> that store relevant user/account information. The data
obtained from these <code>Realms</code> is used to verify the user’s
identity to guarantee the user really is w [...]
<div class="ulist">
<ul>
<li>
@@ -313,7 +313,7 @@ If more than one <code>Realm</code> is configured, the
<code>AuthenticationStrat
</li>
<li>
<p><strong>Authorizer</strong> (<a
href="static/current/apidocs/org/apache/shiro/authz/Authorizer.html">org.apache.shiro.authz.Authorizer</a>)
-The <code>Authorizer</code> is the component responsible determining users'
access control in the application. It is the mechanism that ultimately says if
a user is allowed to do something or not. Like the <code>Authenticator</code>,
the <code>Authorizer</code> also knows how to coordinate with multiple back-end
data sources to access role and permission information. The
<code>Authorizer</code> uses this information to determine exactly if a user is
allowed to perform a given action.</p>
+The <code>Authorizer</code> is the component responsible determining users'
access control in the application. It is the mechanism that ultimately says if
a user is allowed to do something or not. Like the <code>Authenticator</code>,
the <code>Authorizer</code> also knows how to coordinate with multiple back-end
data sources to access role and permission information. The
<code>Authorizer</code> uses this information to determine exactly if a user is
allowed to perform a given action. See [...]
</li>
<li>
<p><strong>SessionManager</strong> (<a
href="static/current/apidocs/org/apache/shiro/session/mgt/SessionManager.html">org.apache.shiro.session.mgt.SessionManager</a>)
diff --git a/authentication.html b/authentication.html
index 94071b732..acbb4c7c4 100644
--- a/authentication.html
+++ b/authentication.html
@@ -611,6 +611,9 @@ We will cover the <code>Realm</code> authentication
behavior shortly.</p>
<div class="sect2">
<h3 id="Authentication-AuthenticationSequence-Authenticator">Authenticator</h3>
<div class="paragraph">
+<p>For a standalone overview of the component, see <a
href="authenticator.html">Apache Shiro Authenticators</a>.</p>
+</div>
+<div class="paragraph">
<p>As mentioned earlier, the Shiro <code>SecurityManager</code>
implementations default to using a <a
href="/static/current/apidocs/org/apache/shiro/authc/pam/ModularRealmAuthenticator.html"><code>ModularRealmAuthenticator</code></a>
instance.
The <code>ModularRealmAuthenticator</code> equally supports applications with
single Realm as well as those with multiple realms.</p>
</div>
diff --git a/authenticator.html b/authenticator.html
index 672ad43c1..963ee8af1 100644
--- a/authenticator.html
+++ b/authenticator.html
@@ -18,20 +18,26 @@
<html lang="en">
<head>
<meta charset="utf-8"/>
- <title>Authenticator | Apache Shiro</title>
+ <title>Apache Shiro Authenticators | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="keywords" content='documentation,todo,lend-a-hand'>
+ <meta name="description" content="Understanding Apache Shiro
Authenticators - the component responsible for verifying user identity. Learn
how Authenticators work with Realms and AuthenticationStrategies.">
+ <meta property="og:description" content="Understanding Apache Shiro
Authenticators - the component responsible for verifying user identity. Learn
how Authenticators work with Realms and AuthenticationStrategies.">
+ <meta name="keywords"
content='authenticator,authentication,security,realms'>
<meta name="generator" content="JBake">
<meta name="google-site-verification"
content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification"
content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
<meta name="google-site-verification"
content="gBTYOG8lMfNb_jrWrH3kFbudpEs_WrAJ2lb2-zLRaso"/>
<meta name="msvalidate.01" content="0B57EB46CBFAD8FD45008D2DB6B6C68C">
- <meta property="og:title" content="Authenticator | Apache Shiro"/>
- <meta property="og:type" content="website"/>
- <meta property="article:tag" content='documentation'/>
- <meta property="article:tag" content='todo'/>
- <meta property="article:tag" content='lend-a-hand'/>
+ <meta property="og:title" content="Apache Shiro Authenticators | Apache
Shiro"/>
+ <meta property="og:type" content="article"/>
+ <meta name="twitter:card" content="summary" />
+ <meta name="twitter:site" content="@ApacheShiro" />
+ <meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
+ <meta property="article:tag" content='authenticator'/>
+ <meta property="article:tag" content='authentication'/>
+ <meta property="article:tag" content='security'/>
+ <meta property="article:tag" content='realms'/>
<meta property="og:locale" content="en_US" />
<meta property="og:url"
content='https://shiro.apache.org/authenticator.html'/>
<meta property="og:image" content='images/shiro-featured-image.png'/>
@@ -196,26 +202,237 @@
</div>
</nav>
- <div class="page-header">
- <h1>Authenticator</h1>
+ <div class="page-header">
+ <h1>Apache Shiro Authenticators</h1>
+ </div>
+
+
+ <div class="admonitionblock tip">
+ <table>
+ <tbody>
+ <tr>
+ <td class="icon">
+ <div class="title">Handy Hint</div>
+ </td>
+ <td class="content">
+ <div class="title">Shiro v1 and v2 version end-of-life notice</div>
+ <div class="paragraph">
+ <p>As of February 28, 2024, Shiro v1 was superseded by v2.<p>
+ <p>As of June 29, 2026, Shiro v2 was superseded by v3.<p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+ </table>
</div>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#Authenticator-Role">Role in the SecurityManager</a></li>
+<li><a
href="#Authenticator-ModularRealmAuthenticator">ModularRealmAuthenticator</a></li>
+<li><a href="#Authenticator-SingleVsMultipleRealms">Single vs. Multiple
Realms</a></li>
+<li><a
href="#Authenticator-AuthenticationStrategy">AuthenticationStrategy</a></li>
+<li><a href="#Authenticator-Configuration">Configuration</a></li>
+<li><a href="#Authenticator-RealmInteraction">How Authenticators Work with
Realms</a></li>
+<li><a href="#Authenticator-SeeAlso">See Also</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
<div class="paragraph">
-<p>TODO</p>
+<p>An <code>Authenticator</code> is a component responsible for verifying that
a user actually is who they claim to be.
+It is the core component that executes the authentication process on behalf of
the <a href="/subject.html">Subject</a>.</p>
</div>
-<hr />
-
-<h2><a id="Lendahandwithdocumentation"></a>Lend a hand with documentation</h2>
-
-<p>While we hope this documentation helps you with the work you're doing with
Apache Shiro,
- the community is improving and expanding the documentation all the time.
- If you'd like to help the Shiro project, please consider correcting,
expanding, or adding documentation where you see a need.
- Every little bit of help you provide expands the community and in turn
improves Shiro. </p>
-
-<p>The easiest way to contribute your documentation is to submit a
pull-request by clicking on the <code>Edit</code> link below,
- or send it to the <a href="mailing-lists.html" title="Mailing Lists">User
Mailing List</a>.</p>
-
-<hr />
+<div class="paragraph">
+<p>While the <a href="/authentication.html">Authentication</a> documentation
explains the concepts and workflow of authentication in Shiro,
+the Authenticator represents the actual implementation component that performs
identity verification.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-Role">Role in the SecurityManager</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The <a href="/securitymanager.html">SecurityManager</a> does not perform
authentication directly.
+Instead, it delegates authentication requests to its internal
<code>Authenticator</code> instance.
+When a <a href="/subject.html">Subject</a> calls <a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#login(org.apache.shiro.authc.AuthenticationToken)"><code>login(token)</code></a>,
+the SecurityManager receives the request and immediately delegates to the
Authenticator by calling
+<a
href="/static/current/apidocs/org/apache/shiro/authc/Authenticator.html#authenticate(org.apache.shiro.authc.AuthenticationToken)"><code>authenticate(token)</code></a>.</p>
+</div>
+<div class="paragraph">
+<p>The Authenticator takes the submitted <a
href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationToken.html"><code>AuthenticationToken</code></a>
+and uses it to verify the Subject’s identity.
+If verification succeeds, it returns an <a
href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationInfo.html"><code>AuthenticationInfo</code></a>
object.
+If verification fails, it throws an <a
href="/static/current/apidocs/org/apache/shiro/authc/AuthenticationException.html"><code>AuthenticationException</code></a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-ModularRealmAuthenticator">ModularRealmAuthenticator</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Shiro uses the <a
href="/static/current/apidocs/org/apache/shiro/authc/pam/ModularRealmAuthenticator.html"><code>ModularRealmAuthenticator</code></a>
+by default.
+This implementation supports coordinating one or more <a
href="/realm.html">Realms</a> during the authentication process.</p>
+</div>
+<div class="paragraph">
+<p>When an authentication token is submitted, the
ModularRealmAuthenticator:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Iterates through configured Realms</p>
+</li>
+<li>
+<p>Calls each Realm’s <a
href="/static/current/apidocs/org/apache/shiro/realm/Realm.html#supports(org.apache.shiro.authc.AuthenticationToken)"><code>supports(token)</code></a>
method to determine if the Realm can process the token</p>
+</li>
+<li>
+<p>If a Realm supports the token, its <a
href="/static/current/apidocs/org/apache/shiro/realm/Realm.html#getAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken)"><code>getAuthenticationInfo(token)</code></a>
method is invoked</p>
+</li>
+<li>
+<p>Returns authentication information if successful, or throws an exception if
failed</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-SingleVsMultipleRealms">Single vs. Multiple Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The ModularRealmAuthenticator supports both configurations:</p>
+</div>
+<div class="paragraph">
+<p><strong>Single Realm</strong>:
+When only one Realm is configured, the Authenticator directly invokes that
Realm to verify the Subject’s credentials.</p>
+</div>
+<div class="paragraph">
+<p><strong>Multiple Realms</strong>:
+When multiple Realms are configured, the Authenticator uses an <a
href="/static/current/apidocs/org/apache/shiro/authc/pam/AuthenticationStrategy.html"><code>AuthenticationStrategy</code></a>
+to determine how to coordinate authentication across the Realms.
+This is a <a
href="https://en.wikipedia.org/wiki/Pluggable_Authentication_Modules";>PAM</a>-style
approach where each Realm can be consulted in sequence.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-AuthenticationStrategy">AuthenticationStrategy</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>When multiple Realms are configured, the Authenticator must determine if
the overall authentication attempt succeeds or fails.
+The <a
href="/static/current/apidocs/org/apache/shiro/authc/pam/AuthenticationStrategy.html"><code>AuthenticationStrategy</code></a>
makes this determination.</p>
+</div>
+<div class="paragraph">
+<p>Shiro provides three built-in strategies:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><strong>FirstSuccessfulStrategy</strong>: Consults Realms in order until
one succeeds. Remaining Realms are not consulted.</p>
+</li>
+<li>
+<p><strong>AtLeastOneSuccessfulStrategy</strong>: Returns success if at least
one Realm succeeds. Other Realms continue to be consulted.</p>
+</li>
+<li>
+<p><strong>AllSuccessfulStrategy</strong>: All Realms must succeed for
authentication to succeed. This is the most restrictive.</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>You can configure which strategy the Authenticator uses, or implement your
own strategy for custom behavior.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-Configuration">Configuration</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>You can configure a custom Authenticator in your Shiro configuration if
needed:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs"
data-lang="ini">authenticator = com.foo.bar.CustomAuthenticator
+securityManager.authenticator = $authenticator</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>You can also configure the AuthenticationStrategy:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs"
data-lang="ini">authenticationStrategy =
org.apache.shiro.authc.pam.FirstSuccessfulStrategy
+authenticator.authenticationStrategy = $authenticationStrategy</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>However, in most cases, the default ModularRealmAuthenticator with the
default strategy is sufficient for typical applications.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-RealmInteraction">How Authenticators Work with
Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authenticator does not directly know how to verify credentials.
+Instead, it coordinates with configured Realms to perform the actual
verification.</p>
+</div>
+<div class="paragraph">
+<p>A <a href="/realm.html">Realm</a> is a security-specific data access object
that can locate and validate user credentials from a data source
+(database, LDAP, file system, etc.).
+The Realm is responsible for:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Determining if it understands the submitted AuthenticationToken via its
<code>supports(token)</code> method</p>
+</li>
+<li>
+<p>Looking up the user in the data source</p>
+</li>
+<li>
+<p>Comparing submitted credentials with those stored in the data source</p>
+</li>
+<li>
+<p>Returning the user’s authentication information if credentials
match</p>
+</li>
+<li>
+<p>Throwing an exception if credentials do not match</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>The Authenticator simply orchestrates this process by delegating to Realms
in order and handling the results according to its configured strategy.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authenticator-SeeAlso">See Also</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>To learn more about related topics, see:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="authentication.html">Authentication</a> - Conceptual overview of
authentication in Shiro.</p>
+</li>
+<li>
+<p><a href="java-authentication-guide.html">Java Authentication Guide</a> -
Practical guide to implementing authentication in your application.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - How Realms connect Shiro to your data
sources.</p>
+</li>
+<li>
+<p><a href="authorizer.html">Authorizers</a> - The counterpart component for
authorization.</p>
+</li>
+<li>
+<p><a href="securitymanager.html">SecurityManager</a> - The component that
orchestrates Authenticators and other Shiro components.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+ <hr />
</div>
diff --git a/authorization.html b/authorization.html
index 560292bee..99bd6df71 100644
--- a/authorization.html
+++ b/authorization.html
@@ -1030,6 +1030,9 @@ public void updateAccount(Account account) {
<div class="sect2">
<h3 id="Authentication-AuthorizingSubjects-ModularRealmAuthorizer">Modular
Realm Authorizer</h3>
<div class="paragraph">
+<p>For a standalone overview of the component, see <a
href="authorizer.html">Apache Shiro Authorizers</a>.</p>
+</div>
+<div class="paragraph">
<p>As mentioned earlier, the Shiro <code>SecurityManager</code>
implementations default to using a <a
href="static/current/apidocs/org/apache/shiro/authz/ModularRealmAuthorizer.html"><code>ModularRealmAuthorizer</code></a>
instance. The <code>ModularRealmAuthorizer</code> equally supports
applications with single Realm as well as those with multiple realms.</p>
</div>
<div class="paragraph">
diff --git a/authorizer.html b/authorizer.html
index ea4dad0be..8629870dd 100644
--- a/authorizer.html
+++ b/authorizer.html
@@ -18,20 +18,27 @@
<html lang="en">
<head>
<meta charset="utf-8"/>
- <title>Authorizer | Apache Shiro</title>
+ <title>Apache Shiro Authorizers | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="keywords" content='documentation,todo,lend-a-hand'>
+ <meta name="description" content="Understanding Apache Shiro Authorizers -
the component that determines what authenticated users are allowed to do. Learn
how Authorizers work with Realms to evaluate permissions and roles.">
+ <meta property="og:description" content="Understanding Apache Shiro
Authorizers - the component that determines what authenticated users are
allowed to do. Learn how Authorizers work with Realms to evaluate permissions
and roles.">
+ <meta name="keywords"
content='authorizer,authorization,access-control,permissions,roles'>
<meta name="generator" content="JBake">
<meta name="google-site-verification"
content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification"
content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
<meta name="google-site-verification"
content="gBTYOG8lMfNb_jrWrH3kFbudpEs_WrAJ2lb2-zLRaso"/>
<meta name="msvalidate.01" content="0B57EB46CBFAD8FD45008D2DB6B6C68C">
- <meta property="og:title" content="Authorizer | Apache Shiro"/>
- <meta property="og:type" content="website"/>
- <meta property="article:tag" content='documentation'/>
- <meta property="article:tag" content='todo'/>
- <meta property="article:tag" content='lend-a-hand'/>
+ <meta property="og:title" content="Apache Shiro Authorizers | Apache
Shiro"/>
+ <meta property="og:type" content="article"/>
+ <meta name="twitter:card" content="summary" />
+ <meta name="twitter:site" content="@ApacheShiro" />
+ <meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
+ <meta property="article:tag" content='authorizer'/>
+ <meta property="article:tag" content='authorization'/>
+ <meta property="article:tag" content='access-control'/>
+ <meta property="article:tag" content='permissions'/>
+ <meta property="article:tag" content='roles'/>
<meta property="og:locale" content="en_US" />
<meta property="og:url"
content='https://shiro.apache.org/authorizer.html'/>
<meta property="og:image" content='images/shiro-featured-image.png'/>
@@ -196,26 +203,273 @@
</div>
</nav>
- <div class="page-header">
- <h1>Authorizer</h1>
+ <div class="page-header">
+ <h1>Apache Shiro Authorizers</h1>
+ </div>
+
+
+ <div class="admonitionblock tip">
+ <table>
+ <tbody>
+ <tr>
+ <td class="icon">
+ <div class="title">Handy Hint</div>
+ </td>
+ <td class="content">
+ <div class="title">Shiro v1 and v2 version end-of-life notice</div>
+ <div class="paragraph">
+ <p>As of February 28, 2024, Shiro v1 was superseded by v2.<p>
+ <p>As of June 29, 2026, Shiro v2 was superseded by v3.<p>
+ </div>
+ </td>
+ </tr>
+ </tbody>
+ </table>
</div>
+<div id="toc" class="toc">
+<div id="toctitle">Table of Contents</div>
+<ul class="sectlevel1">
+<li><a href="#Authorizer-Role">Role in the SecurityManager</a></li>
+<li><a
href="#Authorizer-ModularRealmAuthorizer">ModularRealmAuthorizer</a></li>
+<li><a href="#Authorizer-PermissionAndRoleChecks">Permission and Role
Checks</a>
+<ul class="sectlevel2">
+<li><a href="#Authorizer-PermissionChecks">Permission Checks</a></li>
+<li><a href="#Authorizer-RoleChecks">Role Checks</a></li>
+</ul>
+</li>
+<li><a href="#Authorizer-Configuration">Configuration</a></li>
+<li><a href="#Authorizer-RealmInteraction">How Authorizers Work with
Realms</a></li>
+<li><a href="#Authorizer-MultipleRealms">Authorization with Multiple
Realms</a></li>
+<li><a href="#Authorizer-SeeAlso">See Also</a></li>
+</ul>
+</div>
+<div id="preamble">
+<div class="sectionbody">
<div class="paragraph">
-<p>TODO</p>
+<p>An <code>Authorizer</code> is a component responsible for determining
whether a user is allowed to perform a certain action.
+It evaluates whether a <code>Subject</code> has the necessary permissions or
roles to access a resource or perform an operation.</p>
</div>
-<hr />
-
-<h2><a id="Lendahandwithdocumentation"></a>Lend a hand with documentation</h2>
-
-<p>While we hope this documentation helps you with the work you're doing with
Apache Shiro,
- the community is improving and expanding the documentation all the time.
- If you'd like to help the Shiro project, please consider correcting,
expanding, or adding documentation where you see a need.
- Every little bit of help you provide expands the community and in turn
improves Shiro. </p>
+<div class="paragraph">
+<p>While the <a href="/authorization.html">Authorization</a> documentation
explains the concepts and workflow of access control in Shiro,
+the Authorizer represents the actual implementation component that performs
access control decisions.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-Role">Role in the SecurityManager</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The <a href="/securitymanager.html">SecurityManager</a> does not perform
authorization checks directly.
+Instead, it delegates authorization decisions to its internal
<code>Authorizer</code> instance.
+When a <a href="/subject.html">Subject</a> calls authorization methods such as
+<a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole(java.lang.String)"><code>hasRole(role)</code></a>,
+<a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(org.apache.shiro.authz.Permission)"><code>isPermitted(permission)</code></a>,
+or their variants, the SecurityManager delegates to the Authorizer.</p>
+</div>
+<div class="paragraph">
+<p>The Authorizer determines whether the Subject is permitted to perform the
requested action by checking the Subject’s roles and permissions.
+If the Subject has the necessary role or permission, the authorization check
passes.
+If not, an <a
href="/static/current/apidocs/org/apache/shiro/authz/AuthorizationException.html"><code>AuthorizationException</code></a>
may be thrown.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-ModularRealmAuthorizer">ModularRealmAuthorizer</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Shiro uses the <a
href="/static/current/apidocs/org/apache/shiro/authz/ModularRealmAuthorizer.html"><code>ModularRealmAuthorizer</code></a>
+by default.
+This implementation supports coordinating one or more <a
href="/realm.html">Realms</a> during the authorization process.</p>
+</div>
+<div class="paragraph">
+<p>When an authorization check is performed, the ModularRealmAuthorizer:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Iterates through configured Realms</p>
+</li>
+<li>
+<p>For each Realm that implements the <code>Authorizer</code> interface, calls
the corresponding authorization method
+(<code>hasRole*</code>, <code>checkRole*</code>, <code>isPermitted*</code>, or
<code>checkPermission*</code>)</p>
+</li>
+<li>
+<p>Aggregates and evaluates the results according to Shiro’s
authorization semantics</p>
+</li>
+<li>
+<p>Returns the authorization decision to the caller</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>It is important to note that the ModularRealmAuthorizer treats Realms
differently depending on whether they implement the <code>Authorizer</code>
interface.
+If a Realm does not implement <code>Authorizer</code>, it is not consulted for
authorization checks.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-PermissionAndRoleChecks">Permission and Role Checks</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authorizer performs two types of authorization checks:</p>
+</div>
+<div class="sect2">
+<h3 id="Authorizer-PermissionChecks">Permission Checks</h3>
+<div class="paragraph">
+<p>Permission checks verify whether a Subject is allowed to perform a specific
action on a specific resource.
+Methods for permission checks include:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#isPermitted(org.apache.shiro.authz.Permission)"><code>isPermitted(permission)</code></a>
- returns <code>true</code> or <code>false</code></p>
+</li>
+<li>
+<p><a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#checkPermission(org.apache.shiro.authz.Permission)"><code>checkPermission(permission)</code></a>
- throws an exception on failure</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>For example:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs"
data-lang="java">if (subject.isPermitted("account:read")) {
+ //User can read accounts
+}
-<p>The easiest way to contribute your documentation is to submit a
pull-request by clicking on the <code>Edit</code> link below,
- or send it to the <a href="mailing-lists.html" title="Mailing Lists">User
Mailing List</a>.</p>
+subject.checkPermission("document:delete:report123");</code></pre>
+</div>
+</div>
+</div>
+<div class="sect2">
+<h3 id="Authorizer-RoleChecks">Role Checks</h3>
+<div class="paragraph">
+<p>Role checks verify whether a Subject has a specific role. Methods for role
checks include:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#hasRole(java.lang.String)"><code>hasRole(role)</code></a>
- returns <code>true</code> or <code>false</code></p>
+</li>
+<li>
+<p><a
href="/static/current/apidocs/org/apache/shiro/subject/Subject.html#checkRole(java.lang.String)"><code>checkRole(role)</code></a>
- throws an exception on failure</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>For example:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-java hljs"
data-lang="java">if (subject.hasRole("admin")) {
+ //User is an administrator
+}
-<hr />
+subject.checkRole("user");</code></pre>
+</div>
+</div>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-Configuration">Configuration</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>You can configure a custom Authorizer in your Shiro configuration if
needed:</p>
+</div>
+<div class="listingblock">
+<div class="content">
+<pre class="highlightjs highlight"><code class="language-ini hljs"
data-lang="ini">authorizer = com.foo.bar.CustomAuthorizer
+securityManager.authorizer = $authorizer</code></pre>
+</div>
+</div>
+<div class="paragraph">
+<p>However, in most cases, the default ModularRealmAuthorizer is sufficient
for typical applications.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-RealmInteraction">How Authorizers Work with Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>The Authorizer does not directly know where to retrieve authorization data.
+Instead, it coordinates with configured Realms to perform the actual
authorization checks.</p>
+</div>
+<div class="paragraph">
+<p>A <a href="/realm.html">Realm</a> is a security-specific data access object
that knows how to retrieve authorization data from a data source
+(database, LDAP, file system, etc.).
+The Realm is responsible for:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p>Determining if it implements the <code>Authorizer</code> interface (which
indicates it can perform authorization checks)</p>
+</li>
+<li>
+<p>Retrieving the Subject’s roles and permissions from the data
source</p>
+</li>
+<li>
+<p>Evaluating whether the Subject has the requested role or permission</p>
+</li>
+<li>
+<p>Returning the results of the authorization check</p>
+</li>
+</ul>
+</div>
+<div class="paragraph">
+<p>The Authorizer simply orchestrates this process by delegating to Realms and
aggregating their results.
+This allows you to use multiple Realms where authorization data may come from
different sources,
+and Shiro will coordinate the results appropriately.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-MultipleRealms">Authorization with Multiple Realms</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>When multiple Realms are configured, the ModularRealmAuthorizer consults
all Realms that implement the <code>Authorizer</code> interface.
+The results are aggregated to determine the final authorization decision.</p>
+</div>
+<div class="paragraph">
+<p>Typically, if any Realm grants permission or role membership, the
authorization check succeeds.
+However, the exact behavior depends on the authorization data model and how
the Realms are configured.
+Custom Authorizer implementations can be used to implement different
aggregation strategies if needed.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="Authorizer-SeeAlso">See Also</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>To learn more about related topics, see:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="authorization.html">Authorization</a> - Conceptual overview of
authorization in Shiro.</p>
+</li>
+<li>
+<p><a href="java-authorization-guide.html">Java Authorization Guide</a> -
Practical guide to implementing authorization in your application.</p>
+</li>
+<li>
+<p><a href="permissions.html">Permissions</a> - Understanding Shiro’s
permission model.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - How Realms connect Shiro to your data
sources.</p>
+</li>
+<li>
+<p><a href="authenticator.html">Authenticators</a> - The counterpart component
for authentication.</p>
+</li>
+<li>
+<p><a href="securitymanager.html">SecurityManager</a> - The component that
orchestrates Authorizers and other Shiro components.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+ <hr />
</div>
diff --git a/documentation.html b/documentation.html
index 78b3941f4..babb55815 100644
--- a/documentation.html
+++ b/documentation.html
@@ -230,7 +230,12 @@
<h2 id="introduction">Introduction</h2>
<div class="sectionbody">
<div class="paragraph">
-<p>Helpful if read in order:</p>
+<p>This page serves as the central hub for all Apache Shiro documentation.
Whether you are just getting started or looking for detailed reference
material, you will find links to the appropriate resources here.</p>
+</div>
+<div class="sect2">
+<h3 id="new_to_shiro">New to Shiro?</h3>
+<div class="paragraph">
+<p>If you are new to Apache Shiro, we recommend reading these resources in
order:</p>
</div>
<div class="ulist">
<ul>
@@ -238,16 +243,20 @@
<p><a href="https://www.infoq.com/articles/apache-shiro";>Application Security
with Apache Shiro</a> - full intro article on InfoQ.com</p>
</li>
<li>
-<p><a href="10-minute-tutorial.html">10 Minute Tutorial</a></p>
+<p><a href="10-minute-tutorial.html">10 Minute Tutorial</a> - quick hands-on
introduction</p>
</li>
<li>
-<p><a href="webapp-tutorial.html">Beginner’s Webapp Tutorial: a
step-by-step tutorial to enable Shiro in a web application</a></p>
+<p><a href="webapp-tutorial.html">Beginner’s Webapp Tutorial</a> -
step-by-step guide to enable Shiro in a web application</p>
</li>
<li>
<p><a href="https://start.flowlogix.com";>Flowlogix Starter</a> - generate
Jakarta EE projects with Shiro support</p>
</li>
</ul>
</div>
+<div class="paragraph">
+<p>Once you understand the basics, explore the <a
href="guides.html">Guides</a> page for a complete learning path.</p>
+</div>
+</div>
</div>
</div>
<div class="sect1">
@@ -258,7 +267,7 @@
<div class="ulist">
<ul>
<li>
-<p><a href="reference.html">Reference Manual</a></p>
+<p><a href="reference.html">Reference Manual</a> - comprehensive reference
covering all Shiro concepts and features</p>
</li>
</ul>
</div>
@@ -309,6 +318,12 @@
</li>
</ul>
</div>
+</div>
+<div class="sect2">
+<h3 id="upgrading">Upgrading?</h3>
+<div class="paragraph">
+<p>If you are upgrading from an earlier version of Shiro, see the <a
href="migration-guide.html">Migration Guide</a> for important changes and
upgrade instructions.</p>
+</div>
<h2 id="Lendahandwithdocumentation">Lend a hand with documentation</h2>
<p>While we hope this documentation helps you with the work you're doing with
Apache Shiro, the community is improving and expanding the documentation all
the time. If you'd like to help the Shiro project, please consider correcting,
expanding, or adding documentation where you see a need. Every little bit of
help you provide expands the community and in turn improves Shiro. </p>
diff --git a/feed.xml b/feed.xml
index e83929e0d..f3322b9fe 100644
--- a/feed.xml
+++ b/feed.xml
@@ -4,7 +4,7 @@
<subtitle>Simple. Java. Security.</subtitle>
<link href="https://shiro.apache.org/"/>
<link rel="self" href="https://shiro.apache.org/feed.xml"; />
- <updated>2026-09-26T17:08:16Z</updated>
+ <updated>2026-10-11T06:06:48Z</updated>
<author>
<name>Les Hazlewood</name>
diff --git a/get-started.html b/get-started.html
index 8f682921c..bd607c024 100644
--- a/get-started.html
+++ b/get-started.html
@@ -287,6 +287,45 @@ Articles and Guides written by and for members of the
Apache Shiro community.</p
</ul>
</div>
</div>
+</div>
+<div class="sect1">
+<h2 id="next_steps">Next Steps</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Once you have completed the tutorials above, consider exploring these
topics:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="guides.html">All Guides</a> - Browse the complete collection of
Shiro guides.</p>
+</li>
+<li>
+<p><a href="reference.html">Reference Documentation</a> - Comprehensive
reference covering all Shiro features.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - Learn how to connect Shiro to your user
data sources.</p>
+</li>
+<li>
+<p><a href="migration-guide.html">Migration Guide</a> - If you are upgrading
from an older Shiro version.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="need_help">Need Help?</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
+<li>
+<p><a href="mailing-lists.html">Mailing Lists</a> - Ask questions and get help
from the community.</p>
+</li>
+<li>
+<p><a href="issues.html">Issue Tracker</a> - Report bugs or request
features.</p>
+</li>
+</ul>
+</div>
+</div>
</div>
<hr />
diff --git a/guides.html b/guides.html
index e577776ed..2d54184df 100644
--- a/guides.html
+++ b/guides.html
@@ -226,27 +226,105 @@
</table>
</div>
+<div id="preamble">
+<div class="sectionbody">
<div class="paragraph">
-<p>Here are some basic guides on how to use Shiro.</p>
+<p>This page collects the primary guides for learning Apache Shiro. Whether
you are new to Shiro or looking to deepen your understanding, these guides
provide practical, step-by-step instructions.</p>
</div>
<div class="paragraph">
<p>Please post any errata to the user or dev mailing lists.</p>
</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="getting_started">Getting Started</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>If you are new to Shiro, start here:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="10-minute-tutorial.html">10 Minute Tutorial</a> - A quick hands-on
introduction to Shiro’s core API and concepts.</p>
+</li>
+<li>
+<p><a href="tutorial.html">Your First Shiro Application</a> - Build a simple
application secured by Shiro from scratch.</p>
+</li>
+<li>
+<p><a href="webapp-tutorial.html">Beginner’s Webapp Tutorial</a> - A
step-by-step guide to enabling Shiro in a web application.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="core_concepts">Core Concepts</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Once you understand the basics, explore these guides to learn how
authentication and authorization work in Shiro:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="java-authentication-guide.html">Authentication Guide</a> - Learn
how to verify user identity using Shiro’s authentication API.</p>
+</li>
+<li>
+<p><a href="java-authorization-guide.html">Authorization Guide</a> -
Understand how to control access to resources based on roles and
permissions.</p>
+</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="advanced_topics">Advanced Topics</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>After mastering the core concepts, consider these topics:</p>
+</div>
<div class="ulist">
<ul>
<li>
-<p><a href="10-minute-tutorial.html">10 Minute Tutorial</a></p>
+<p><a href="realm.html">Realm Guide</a> - Learn how Realms connect Shiro to
your user data sources.</p>
</li>
<li>
-<p><a href="java-authentication-guide.html">Authentication Guide</a></p>
+<p><a href="session-management.html">Session Management</a> - Understand how
Shiro manages user sessions across environments.</p>
</li>
<li>
-<p><a href="java-authorization-guide.html">Authorization Guide</a></p>
+<p><a href="cryptography.html">Cryptography</a> - Explore Shiro’s
simplified cryptography APIs.</p>
</li>
+</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="upgrading_shiro">Upgrading Shiro</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
<li>
-<p><a href="migration-guide.html">Migration Guide: Upgrading Shiro 1.x → 2.x →
3.x</a></p>
+<p><a href="migration-guide.html">Migration Guide: Upgrading Shiro 1.x → 2.x →
3.x</a> - Step-by-step instructions for upgrading between major Shiro
versions.</p>
</li>
</ul>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="see_also">See Also</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
+<li>
+<p><a href="reference.html">Reference Documentation</a> - Complete reference
for all Shiro features.</p>
+</li>
+<li>
+<p><a href="documentation.html">Documentation Hub</a> - Central hub for all
Shiro documentation resources.</p>
+</li>
+<li>
+<p><a href="articles.html">Community Articles</a> - Articles and tutorials
contributed by the Shiro community.</p>
+</li>
+</ul>
+</div>
+</div>
</div>
<hr />
diff --git a/issues.html b/issues.html
index 1aba1e9dc..bd8c9aacf 100644
--- a/issues.html
+++ b/issues.html
@@ -20,9 +20,9 @@
<meta charset="utf-8"/>
<title>Apache Shiro Bug & Issue Tracking | Apache Shiro</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
- <meta name="description" content="Report bugs, request features, and track
issues for Apache Shiro using GitHub Issues tracking system.">
- <meta property="og:description" content="Report bugs, request features,
and track issues for Apache Shiro using GitHub Issues tracking system.">
- <meta name="keywords" content='issues,bugs,jira,bug-tracking,support'>
+ <meta name="description" content="Report bugs, request features, and track
issues for Apache Shiro using GitHub Issues.">
+ <meta property="og:description" content="Report bugs, request features,
and track issues for Apache Shiro using GitHub Issues.">
+ <meta name="keywords" content='issues,bugs,bug-tracking,support'>
<meta name="generator" content="JBake">
<meta name="google-site-verification"
content="QIax6uT5UX3enoU0G8Pz2pXbQ45KaQuHZ3nCh9V27mw">
<meta name="google-site-verification"
content="ecFap6dWJgS_GCCtxmJQJ_nFYQhM6EgSpBPZDU7xsCE">
@@ -36,7 +36,6 @@
<meta property="article:modification_time" content="2010-03-18T00:00:00Z"/>
<meta property="article:tag" content='issues'/>
<meta property="article:tag" content='bugs'/>
- <meta property="article:tag" content='jira'/>
<meta property="article:tag" content='bug-tracking'/>
<meta property="article:tag" content='support'/>
<meta property="og:locale" content="en_US" />
diff --git a/java-authentication-guide.html b/java-authentication-guide.html
index 6260469c6..886e89fe5 100644
--- a/java-authentication-guide.html
+++ b/java-authentication-guide.html
@@ -244,6 +244,7 @@
</ul>
</li>
<li><a href="#logging_out">Logging Out</a></li>
+<li><a href="#see_also">See Also</a></li>
</ul>
</div>
<div id="preamble">
@@ -496,6 +497,33 @@ After the login, your identity has been verified and
<code>isAuthenticated()=TRU
<p>When you log out in Shiro it will close out the user session and removes
any associated identity from the subject instance. If you’re using
RememberMe in a web environment, then <code>.logout()</code> will, by default,
also delete the RememberMe cookie from the browser.</p>
</div>
</div>
+</div>
+<div class="sect1">
+<h2 id="see_also">See Also</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Now that you understand authentication in Shiro, continue learning with
these resources:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="java-authorization-guide.html">Java Authorization Guide</a> -
Learn how to control access to resources after authentication.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - Learn how to connect Shiro to your user
data sources.</p>
+</li>
+<li>
+<p><a href="authentication.html">Authentication Concepts</a> - Deeper dive
into Shiro’s authentication architecture.</p>
+</li>
+<li>
+<p><a href="authenticator.html">Authenticators</a> - Understand the component
that performs authentication.</p>
+</li>
+<li>
+<p><a href="subject.html">Subject</a> - Learn more about the Subject API.</p>
+</li>
+</ul>
+</div>
+</div>
</div>
<hr />
diff --git a/java-authorization-guide.html b/java-authorization-guide.html
index 69d0862c6..bc0e87acb 100644
--- a/java-authorization-guide.html
+++ b/java-authorization-guide.html
@@ -533,7 +533,34 @@ public void openAccount( Account acct ) {
<h2 id="caching_authorization">Caching Authorization</h2>
<div class="sectionbody">
<div class="paragraph">
-<p>TBD</p>
+<p>Shiro supports caching authorization data to improve performance. When
authorization checks are performed frequently, caching avoids repeated lookups
to the underlying data source. For more information on how caching works in
Shiro, see the <a href="caching.html">Caching Documentation</a>.</p>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="see_also">See Also</h2>
+<div class="sectionbody">
+<div class="paragraph">
+<p>Now that you understand authorization in Shiro, continue learning with
these resources:</p>
+</div>
+<div class="ulist">
+<ul>
+<li>
+<p><a href="permissions.html">Permissions</a> - Deep dive into Shiro’s
permission model.</p>
+</li>
+<li>
+<p><a href="realm.html">Realms</a> - Learn how Realms provide authorization
data.</p>
+</li>
+<li>
+<p><a href="authorization.html">Authorization Concepts</a> - Deeper dive into
Shiro’s authorization architecture.</p>
+</li>
+<li>
+<p><a href="authorizer.html">Authorizers</a> - Understand the component that
performs authorization.</p>
+</li>
+<li>
+<p><a href="java-authentication-guide.html">Java Authentication Guide</a> - If
you haven’t already, learn about authentication.</p>
+</li>
+</ul>
</div>
</div>
</div>
diff --git a/reference.html b/reference.html
index 088b0cd45..4a89af598 100644
--- a/reference.html
+++ b/reference.html
@@ -226,6 +226,25 @@
</table>
</div>
+<div id="preamble">
+<div class="sectionbody">
+<div class="paragraph">
+<p>This reference manual provides comprehensive documentation for all Apache
Shiro features. Use this as your primary reference when implementing security
in your applications.</p>
+</div>
+<div class="admonitionblock tip">
+<table>
+<tr>
+<td class="icon">
+<i class="fa icon-tip" title="Tip"></i>
+</td>
+<td class="content">
+<div class="paragraph">
+<p>If you are new to Shiro, we recommend starting with the <a
href="10-minute-tutorial.html">10 Minute Tutorial</a> or the <a
href="guides.html">Guides</a> before diving into the reference material.</p>
+</div>
+</td>
+</tr>
+</table>
+</div>
<div class="olist arabic">
<ol class="arabic">
<li>
@@ -361,6 +380,26 @@
</div>
</li>
</ol>
+</div>
+</div>
+</div>
+<div class="sect1">
+<h2 id="see_also">See Also</h2>
+<div class="sectionbody">
+<div class="ulist">
+<ul>
+<li>
+<p><a href="guides.html">Guides</a> - Tutorials and step-by-step
instructions.</p>
+</li>
+<li>
+<p><a href="documentation.html">Documentation Hub</a> - Central hub for all
Shiro documentation.</p>
+</li>
+<li>
+<p><a href="migration-guide.html">Migration Guide</a> - For users upgrading
between major versions.</p>
+</li>
+</ul>
+</div>
+</div>
</div>
<hr />
diff --git a/sitemap.xml b/sitemap.xml
index 3ead291f8..70ad7d6b3 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -56,6 +56,10 @@
<loc>https://shiro.apache.org/get-started.html</loc>
<lastmod>2010-03-18</lastmod>
</url>
+ <url>
+ <loc>https://shiro.apache.org/authorizer.html</loc>
+ <lastmod>2010-03-18</lastmod>
+ </url>
<url>
<loc>https://shiro.apache.org/java-cryptography-guide.html</loc>
<lastmod>2010-03-18</lastmod>
@@ -112,6 +116,10 @@
<loc>https://shiro.apache.org/commercial-support.html</loc>
<lastmod>2010-03-18</lastmod>
</url>
+ <url>
+ <loc>https://shiro.apache.org/authenticator.html</loc>
+ <lastmod>2010-03-18</lastmod>
+ </url>
<url>
<loc>https://shiro.apache.org/what-is-shiro.html</loc>
<lastmod>2010-03-18</lastmod>
@@ -568,14 +576,6 @@
<loc>https://shiro.apache.org/release-archive.html</loc>
<lastmod>2022-06-28</lastmod>
</url>
- <url>
- <loc>https://shiro.apache.org/authorizer.html</loc>
- <lastmod>2026-05-25</lastmod>
- </url>
- <url>
- <loc>https://shiro.apache.org/authenticator.html</loc>
- <lastmod>2026-05-25</lastmod>
- </url>
<url>
<loc>https://shiro.apache.org/team.html</loc>
<lastmod>2023-02-08</lastmod>
