Hi all, i'm looking to patter/advice with Shiro for the following scenario.
I have domain model where there are Employees and several employees are managed by Supervisors. Employees provide Reports to the system. I need to allow Supervisors to view/edit reports which come only from employees he supervise. And do not allow access to other reports. I'm not sure how i can design permissions here and use declarative solution, is there is any approach? Or just use custom code to pre-filter reports based on roles and actual data? -- View this message in context: http://shiro-user.582556.n2.nabble.com/Advise-on-authorization-strategy-tp6312150p6312150.html Sent from the Shiro User mailing list archive at Nabble.com.
