[SHIRO-392] Shiro Extension for JAX-RS

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.4.0-RC2
• Assignee: Unassigned
• Reporter: Jan Stamer
• Created: 26/Oct/12 13:43
• Updated: 21/Nov/16 23:15
• Resolved: 21/Oct/16 14:53

Description

We've added an extension to Shiro which enables Shiro annotations in the JAX-RS implementation Sun Jersey.
You can do the following with it:

@Path("/changelog")
@RequiresPermissions("repository:read")
public class ChangelogResourceImpl {

@POST
@Consumes(MediaType.APPLICATION_JSON)
@Path("/addObject")
@Override
@RequiresPermissions("repository:write")
public Response addObject(ObjectJson objectJson)

{ someService.addObject(object); return Response.ok().build(); }

}

If the user is not authenticated Http Status Code 401 is returned. If the user has insufficient privileges Status Code 403 is returned.

Right now we've only added support for the annoation @RequiresPermissions. The other Shiro annoations could easily be added in the same fashion. Yet currently that's the only one we need.

Issue Links

• relates to: SHIRO-603 Endless recursion in ShiroSecurityContext.getUserPrincipal()