[SHIRO-459] Support role-based authorization depending on HTTP request method

• Type: New Feature
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.2.2
• Component/s: Authorization (access control)
• Labels: features newbie
• Assignee: Unassigned
• Reporter: Daniel Bimschas
• Created: 19/Sep/13 14:49
• Updated: 26/Sep/13 07:19

Description

Below is a copy+paste from the Shiro users mailing list:

=====================

Dear Shiro gods!

I'm struggling to figure out how I can do role-based authorization depending on what HTTP method a request is using. I've posted this question on StackOverflow as it seems nobody has been asking it before (at least I couldn't find it with my search terms). I would be incredibly happy if you could take a look!

http://stackoverflow.com/questions/18824670/how-to-do-role-based-authorization-with-apache-shiro-depending-on-http-request-m

Cheers
Daniel Bimschas

=============================

Then, in a second mail I proposed a solution to the issue:

=============================

Digging into the Shiro source codes I found that this feature is in fact not available in Shiro. I've now implemented my own custom filter (extending RolesAuthorizationFilter) that allows you to do exactly what I wanted. Configuration for the filter follows the following example:

[main]
myFilter=my.package.HttpMethodRolesAuthorizationFilter
[urls]
/rest = authcBasic, myFilter[PUT=SERVICE_PROVIDER&EXPERIMENTER,POST=EXPERIMENTER,DELETE=ADMINISTRATOR]

So, in this example

• a user must be authenticated to execute any operation
• a user with both roles SERVICE_PROVIDER and EXPERIMENTER can send a PUT request,
• a user with role EXPERIMENTER can send POST requests, and
• a user with role ADMINISTRATOR can DELETE things

I would be more than happy to contribute this little bit of code to the project in case you're interested!

=============================