P.S. The principals should be super lightweight - basically an ID or username or email and nothing else. It is expected that you will use this id to then query your datastore of choice to obtain a User object (or whatever other information you require).
You can store all of the attributes in the PrincipalCollection, (and will be able to in Shiro 2.0), but the the < 2.0 design encourages only storing 'pointers' to your data and not the full data. Best, Les On Thu, Jan 30, 2014 at 2:07 PM, Les Hazlewood <[email protected]>wrote: > Your realm populates the PrincipalCollection at the time the account is > authenticated (or looked up). > > In your Realm's getAuthenticationInfo (or doGetAuthenticationInfo) > implementation, you return an AuthenticationInfo instance from your realm, > and info.getPrincipals() contains whatever you populate them with. You > shouldn't really need to populate the PrincipalCollection outside of the > Realm - the rest of the app should basically just be able to read the > principals and not need to modify them. > > On a side note: this will be much more intuitive in in Shiro 2.0: as > things stand now, you'll likely be able to do things like > subject.getAttributes().get("whatever"), instead of by the (much inferior) > type-based lookup that is in place today. > > HTH! > > Les > > On Thu, Jan 30, 2014 at 9:53 AM, David Barron <[email protected]> wrote: > >> Maybe I wasn't clear. I know how to get the existing principles. How do >> I >> add to them? Is there anything in the API for doing it or does it require >> something custom written? >> In a web application, where in the authentication process would I do it? >> >> >> >> >> -- >> View this message in context: >> http://shiro-user.582556.n2.nabble.com/PrincipleCollection-tp7579605p7579607.html >> Sent from the Shiro User mailing list archive at Nabble.com. >> > >
