[SHIRO-752] Unnecessary realm checks in ModularRealmAuthorizer

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.5.2
• Component/s: Authorization (access control)
• Assignee: Unassigned
• Reporter: Benjamin Marwell
• Created: 01/Apr/20 15:46
• Updated: 01/Apr/20 15:47

Description

Problem description

`public boolean[] isPermitted(PrincipalCollection principals, List<Permission> permissions)` will check every realm for every permission and does not short circuit.

if (permissions != null && permissions.length > 0) { 

  boolean[] isPermitted = new boolean[permissions.length];

  for (int i = 0; i < permissions.length; i++) { 
    isPermitted[i] = isPermitted(principals, permissions[i]);
  }

  return isPermitted; 
}

return new boolean[0];

Expected outcome

Check realm-by-realm, and only those permissions which are not already true

Actual outcome

Each realm is checked anyway.

Sample implementation

https://github.com/riccardomodanese/shiro/commit/7b60f8be0a599dc5975e9a4b12f277a3475fdc93