[SHIRO-465] Support externalized principal mapping in AuthenticatingRealm and ModularRealmAuthenticator

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.2.2
• Fix Version/s: 2.0.0
• Component/s: Authentication (log-in)
• Labels: patch patch-with-test
• Assignee: Unassigned
• Reporter: Kevin Minder
• Created: 15/Oct/13 04:52
• Updated: 06/Mar/23 08:06

Description

The basic idea is to provide a plug-in point that can be used to resolve principals to things like groups or effective principals. The primary use case that is driving this for me is to be able to resolve authenticated principals to a set of groups where that user to group mapping is external to the user repository. In addition other mappings can be done like mapping a real user principal to an effective user principal. This would be useful when a translation is required from an external identity store (e.g. LDAP) to some application specific identities. The existing pattern for things like RolePermissionResolver should be followed for consistency.

Issue Links

• is depended upon by: SHIRO-631 Principal mapping rules similar to Hadoop's auth_to_local
• is related to: SHIRO-464 Support role mapping similar to PermissionResolver and RolePermissionResolver
• is related to: SHIRO-631 Principal mapping rules similar to Hadoop's auth_to_local