Hi, companyid + username is what uniquely identifies your user.
Your queries for both authenticationinfo and authorizationinfo should obviously be based on both companyid & username. The companyid can be handled as additional principal as already mentioned. You can consider extending the DefaultSubject implementation to provided a method to return additional subject metadata such as company id. You might also consider introducing a unique userid for each user, which can be a principal , that be used for look up of additional user metadata. Manoj On Thu, Jul 7, 2011 at 6:11 PM, dreamage <[email protected]> wrote: > Thanks for the quick response. I understand you solutions, but I think that > my problem is a little bit more complex that I thought. > > My application serve multiple sites, and the main problem is that I have > only one "users" table in my database, with 3 columns, companyId, username > and password_hash. The username is unique per company but the same username > can exist in more than one company (so the primary key is companyId + > username). > > Depending on the subdomain name (companyname.mysite.com), I select a > company, and then I would like all my calls to Shiro (login, permissions > check, ...) to take that into account so that my realm can use the companyId > in the queries. > > My first thought was to create one realm per company (using one spring > application context per company, or something like that), but I don't see > how the threadlocal model of Shiro would be able to handle that. > > Any thoughts on that ? > > Thanks > > Mathieu > > -- > View this message in context: > http://shiro-user.582556.n2.nabble.com/Subject-custom-data-from-database-tp6559272p6560652.html > Sent from the Shiro User mailing list archive at Nabble.com. > -- http://khangaonkar.blogspot.com/
