Package org.apache.shiro.web.mgt

Class DefaultWebSecurityManager

java.lang.Object
org.apache.shiro.mgt.CachingSecurityManager
org.apache.shiro.mgt.RealmSecurityManager
org.apache.shiro.mgt.AuthenticatingSecurityManager
org.apache.shiro.mgt.AuthorizingSecurityManager
org.apache.shiro.mgt.SessionsSecurityManager
org.apache.shiro.mgt.DefaultSecurityManager
org.apache.shiro.web.mgt.DefaultWebSecurityManager
All Implemented Interfaces:
org.apache.shiro.authc.Authenticator, org.apache.shiro.authz.Authorizer, org.apache.shiro.cache.CacheManagerAware, org.apache.shiro.event.EventBusAware, org.apache.shiro.lang.util.Destroyable, org.apache.shiro.mgt.SecurityManager, org.apache.shiro.session.mgt.SessionManager, WebSecurityManager
public class DefaultWebSecurityManager extends org.apache.shiro.mgt.DefaultSecurityManager implements WebSecurityManager
Default WebSecurityManager implementation used in web-based applications or any application that requires HTTP connectivity (SOAP, http remoting, etc.).
Since:
0.2

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    HTTP_SESSION_MODE
    Deprecated.
    static final String
    NATIVE_SESSION_MODE
    Deprecated.

    Fields inherited from class org.apache.shiro.mgt.DefaultSecurityManager

    rememberMeManager, subjectDAO, subjectFactory

  • Constructor Summary

    Constructors
    Constructor
    Description
    DefaultWebSecurityManager()
     
    DefaultWebSecurityManager(Collection<org.apache.shiro.realm.Realm> realms)
     
    DefaultWebSecurityManager(Supplier<byte[]> keySupplier)
     
    DefaultWebSecurityManager(org.apache.shiro.realm.Realm singleRealm)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    protected void
    afterSessionManagerSet()
     
    protected void
    beforeLogout(org.apache.shiro.subject.Subject subject)
     
    protected org.apache.shiro.subject.SubjectContext
    copy(org.apache.shiro.subject.SubjectContext subjectContext)
     
    protected org.apache.shiro.session.mgt.SessionContext
    createSessionContext(org.apache.shiro.subject.SubjectContext subjectContext)
     
    protected org.apache.shiro.session.mgt.SessionManager
    createSessionManager(String sessionMode)
     
    protected org.apache.shiro.subject.SubjectContext
    createSubjectContext()
     
    protected org.apache.shiro.session.mgt.SessionKey
    getSessionKey(org.apache.shiro.subject.SubjectContext context)
     
    String
    getSessionMode()
    Deprecated.
    boolean
    isHttpSessionMode()
    Security information needs to be retained from request to request, so Shiro makes use of a session for this.
    protected void
    removeRequestIdentity(org.apache.shiro.subject.Subject subject)
     
    void
    setSessionManager(org.apache.shiro.session.mgt.SessionManager sessionManager)
     
    void
    setSessionMode(String sessionMode)
    Deprecated.
    since 1.2
    void
    setSubjectDAO(org.apache.shiro.mgt.SubjectDAO subjectDAO)
     

    Methods inherited from class org.apache.shiro.mgt.DefaultSecurityManager

    bind, createSubject, createSubject, delete, doCreateSubject, ensureSecurityManager, getRememberedIdentity, getRememberMeManager, getSubjectDAO, getSubjectFactory, login, logout, onFailedLogin, onSuccessfulLogin, rememberMeFailedLogin, rememberMeLogout, rememberMeSuccessfulLogin, resolveContextSession, resolvePrincipals, resolveSession, save, setRememberMeManager, setSubjectFactory, stopSession, unbind

    Methods inherited from class org.apache.shiro.mgt.SessionsSecurityManager

    afterCacheManagerSet, afterEventBusSet, applyCacheManagerToSessionManager, applyEventBusToSessionManager, destroy, getSession, getSessionManager, start

    Methods inherited from class org.apache.shiro.mgt.AuthorizingSecurityManager

    afterRealmsSet, checkPermission, checkPermission, checkPermissions, checkPermissions, checkRole, checkRoles, checkRoles, getAuthorizer, hasAllRoles, hasRole, hasRoles, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll, setAuthorizer

    Methods inherited from class org.apache.shiro.mgt.AuthenticatingSecurityManager

    authenticate, getAuthenticator, setAuthenticator

    Methods inherited from class org.apache.shiro.mgt.RealmSecurityManager

    applyCacheManagerToRealms, applyEventBusToRealms, getRealms, setRealm, setRealms

    Methods inherited from class org.apache.shiro.mgt.CachingSecurityManager

    applyEventBusToCacheManager, getCacheManager, getEventBus, setCacheManager, setEventBus

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.apache.shiro.authc.Authenticator

    authenticate

    Methods inherited from interface org.apache.shiro.authz.Authorizer

    checkPermission, checkPermission, checkPermissions, checkPermissions, checkRole, checkRoles, checkRoles, hasAllRoles, hasRole, hasRoles, isPermitted, isPermitted, isPermitted, isPermitted, isPermittedAll, isPermittedAll

    Methods inherited from interface org.apache.shiro.mgt.SecurityManager

    createSubject, login, logout

    Methods inherited from interface org.apache.shiro.session.mgt.SessionManager

    getSession, start

  • Field Details

  • Constructor Details

  • Method Details

    • createSubjectContext

      protected org.apache.shiro.subject.SubjectContext createSubjectContext()
      Overrides:
      createSubjectContext in class org.apache.shiro.mgt.DefaultSecurityManager

    • setSubjectDAO

      public void setSubjectDAO(org.apache.shiro.mgt.SubjectDAO subjectDAO)
      Overrides:
      setSubjectDAO in class org.apache.shiro.mgt.DefaultSecurityManager

    • afterSessionManagerSet

      protected void afterSessionManagerSet()
      Overrides:
      afterSessionManagerSet in class org.apache.shiro.mgt.SessionsSecurityManager

    • copy

      protected org.apache.shiro.subject.SubjectContext copy(org.apache.shiro.subject.SubjectContext subjectContext)
      Overrides:
      copy in class org.apache.shiro.mgt.DefaultSecurityManager

    • getSessionMode

      @Deprecated public String getSessionMode()
      Deprecated.

    • setSessionMode

      @Deprecated public void setSessionMode(String sessionMode)
      Deprecated.
      since 1.2
      Parameters:
      sessionMode -

    • setSessionManager

      public void setSessionManager(org.apache.shiro.session.mgt.SessionManager sessionManager)
      Overrides:
      setSessionManager in class org.apache.shiro.mgt.SessionsSecurityManager

    • isHttpSessionMode

      public boolean isHttpSessionMode()
      Description copied from interface: WebSecurityManager
      Security information needs to be retained from request to request, so Shiro makes use of a session for this. Typically, a security manager will use the servlet container's HTTP session but custom session implementations, for example based on EhCache, may also be used. This method indicates whether the security manager is using the HTTP session or not.
      Specified by:
      isHttpSessionMode in interface WebSecurityManager
      Returns:
      true if the security manager is using the HTTP session; otherwise, false.
      Since:
      1.0

    • createSessionManager

      protected org.apache.shiro.session.mgt.SessionManager createSessionManager(String sessionMode)

    • createSessionContext

      protected org.apache.shiro.session.mgt.SessionContext createSessionContext(org.apache.shiro.subject.SubjectContext subjectContext)
      Overrides:
      createSessionContext in class org.apache.shiro.mgt.DefaultSecurityManager

    • getSessionKey

      protected org.apache.shiro.session.mgt.SessionKey getSessionKey(org.apache.shiro.subject.SubjectContext context)
      Overrides:
      getSessionKey in class org.apache.shiro.mgt.DefaultSecurityManager

    • beforeLogout

      protected void beforeLogout(org.apache.shiro.subject.Subject subject)
      Overrides:
      beforeLogout in class org.apache.shiro.mgt.DefaultSecurityManager

    • removeRequestIdentity

      protected void removeRequestIdentity(org.apache.shiro.subject.Subject subject)