shiro-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Kalle Korhonen <kalle.o.korho...@gmail.com>
Subject Re: Aspectj integration
Date Mon, 11 Jan 2010 18:27:45 GMT
Thanks J-C. Yeah, that's sort of what I thought. Creating aspects
isn't hard with AspectJ though it takes a while to get used to the
syntax and thinking. One size likely doesn't fit all, so at this point
my initial thinking is that we should make it an example first, then
see if we can generalize some parts of it. I don't want to force (or
even suggest as the primary option) compile-time weaving to standalone
projects (there are other ways to deal with annotations as well).
Runtime weaving on the other hand incurs relatively heavy costs on
memory consumption, which of course is more of a concern for desktop
apps. We are missing a good standalone application example anyway.
What do you think Les?

Kalle

On Mon, Jan 11, 2010 at 10:01 AM, Jean-Cédric Desrochers
<jcdesrochers@gmail.com> wrote:
> Maybe my initial post was not clear, I was just curious to see if you guys
> would be interested in the integration I'm doing. Let me shed some light on
> that...
> I have to integrate application-level security in our platform and Shiro
> came across my search results. After looking at it, I found the perfect
> little framework I needed: simple API for authentication, annotation based
> authorization, realms to support known and/or custom datasources, stability
> (jsecurity existed for a while)... I decided to start a proof of concept
> project to integrate Shiro and to see how it goes (the devil is in the
> details..). I soon realized that the "authorization based on annotation"
> feature was not available to me as we are not using spring (which is a
> must-have requirement for us). So what I've done here is a simple adaptation
> between aspectj and the AnnotationsAuthorizingMethodInterceptor model that
> already exists in Shiro. In details I have:
>
> a pointcut that targets each method that is decorated by an annotation
> define by Shiro
> an advice that gets call before any "secured" method invocation
> a piece of logic that adapts the aspectj JoinPoint class into a
> Shiro MethodInvocation
> and finally it delegates the authorizing task to the existing code of
> the org.apache.shiro.authz.aop package
>
> All this works well within eclipse (I'm halfway done) and I'm working on the
> configuration required to run this adaptation using the aspectj load-time
> weaver tool (for our own production deployment purposes).
> What I'm proposing here is to donate the piece of code I'v done + the
> configuration and documentation required to seamlessly integrate shiro and
> aspectj for the purpose exposed here.
> Hope this clarifies things.
> Regards,
>    J-C
>
> On 11-Jan-2010, at 11:25, Kalle Korhonen wrote:
>
> I'm not quite sure what you are proposing, J-C, but I can look over it
> and help creating the aspectj module (having heavily used aspectj
> before). J-C, can you elaborate more on it, what's the generalized
> concept here? I.e. how are you thinking on processing the annotations
> yet make it extensible?
>
> Kalle
>
>
> On Mon, Jan 11, 2010 at 7:55 AM, Les Hazlewood <lhazlewood@apache.org>
> wrote:
>
> J-C,
>
> If you contribute a patch, can you ensure that you create a new child
>
> Maven module under the support directory? i.e. support/aspectj?
>
> Thanks,
>
> Les
>
> On Mon, Jan 11, 2010 at 10:48 AM, Les Hazlewood <lhazlewood@apache.org>
> wrote:
>
> Hi J-C,
>
> This is a big +1 from me.  I would love if you could contribute this
>
> back to Shiro, as it is something I've worried about for a while, but
>
> haven't had the time to work on personally.
>
> Could you please add what you've done in the form of a patch or .zip
>
> attachment (or both if necessary) to a Jira issue?  I'm very excited
>
> to see what you've done!
>
> Thanks for offering to help - it is much appreciated!
>
> Best,
>
> Les
>
> P.S.  Please join the dev list if you haven't already for any tech
>
> discussions related to the submissions.
>
> On Mon, Jan 11, 2010 at 10:03 AM, Jean-Cédric Desrochers
>
> <jcdesrochers@gmail.com> wrote:
>
> First of, I want to say that what you've done is great. I was looking for a
> framework to help me setup security in our platform and Shiro is exactly
> what I needed.  It's a simple framework that do not pretend to perform
> everything for you and (best of all) it's "embeddable" in any situation. It
> does not provide built-in audits (which is a requirement I have), but I can
> easily do that myself using the events generated by the framework.
>
> In my case, the situation is not a web app and not a spring container. We
> want to perform authorization based on annotations for seamless development
> and integration. However I realized that it is not currently available for
> me... only spring-aop can do this for now. I looked in the forums and I
> found that I'm not the only one that want's to do that.
>
> So I decided to jump in and do what it needed to use aspectj for what I
> wanted to do (validating actions programmatically is not really an option
> for me). I currently have a prototype working and I need to work on the
> run-time now: integration of the compiler and/or the code weaving (in a
> seamless manner). But nonetheless, I thing it could be a great addition to
> Shiro. Would you guys be interested in a donation so that the community can
> benefit???
>
> Regards,
>
>  J-C
>
>
>
>

Mime
View raw message