I hear you. The documentation isn't as complete as it could be which creates for a steep learning curve. It took me a significant volume of trial and error and finding examples and help from many dusty corners of the internet! :)
I think what you want to do is possible by creating a custom realm. If you extend one of the realm classes and implement the proper methods, you can do whatever you want in the authentication methods, such as delegate to another process, and then implement your authorization methods as desired too. I'm creating a realm by extending AuthorizingRealm. If you were to do the same, your implementation of doGetAuthenticationInfo() can be modified to depend on something you pass to the AuthenticationToken after someone returns from a Google Accounts authentication. -----Original Message----- From: stenrap [mailto:[email protected]] Sent: Thursday, December 05, 2013 12:57 PM To: [email protected] Subject: Shiro for authorization/permissions only I'm working on a Google App Engine project. I'd like to use Google accounts for authentication, and Shiro for authorization/permissions. I've been trying to get this working based on Shiro's cryptic and incomplete documentation (the INI examples are just too simplistic to be helpful), but it seems Shiro is very tightly coupled to both authentication and authorization—it just really, really, /really/ wants to do both. Is this even possible? If so, where do I start?! -- View this message in context: http://shiro-user.582556.n2.nabble.com/Shiro-for-authorization-permissions-only-tp7579436.html Sent from the Shiro User mailing list archive at Nabble.com. The information transmitted, including attachments, is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this e-mail in error, please notify the sender immediately by replying to the message and deleting the material from your computer.
