[SHIRO-400] Allow access to AuthenticationInfo when making decision of it's cache key

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.2.1
• Component/s: Authentication (log-in)
• Assignee: Unassigned
• Reporter: Tuomas Kiviaho
• Created: 26/Nov/12 13:40
• Updated: 09/Feb/15 07:24

Description

Currently it is not possible to utilize generated authentication info in it's key generation when it is written to cache.

I'm unable to override the getAuthenticationInfo and cacheAuthenticationInfoIfPossible due to their private and final nature and therefore I suggest that there would be a protected Object getAuthenticationCacheKey(AuthenticationToken token, AuthenticationInfo info) variant which would fall back to the original implementation by default thus being backwards compliant as well. This variant would be used only when writing to the cache.

My current workaround options are to mutilate the token itself or duplicate the cache handling at assertCredentialsMatch.

Issue Links

• relates to: SHIRO-332 Change access level of method 'isPermitted' in org.apache.shiro.realm.AuthorizingRealm (line 461) from private to protected