Return-Path: X-Original-To: apmail-shiro-user-archive@www.apache.org Delivered-To: apmail-shiro-user-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 6ABC5100C4 for ; Fri, 13 Feb 2015 05:14:17 +0000 (UTC) Received: (qmail 58838 invoked by uid 500); 13 Feb 2015 05:14:14 -0000 Delivered-To: apmail-shiro-user-archive@shiro.apache.org Received: (qmail 58808 invoked by uid 500); 13 Feb 2015 05:14:14 -0000 Mailing-List: contact user-help@shiro.apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: List-Id: Reply-To: user@shiro.apache.org Delivered-To: mailing list user@shiro.apache.org Received: (qmail 58798 invoked by uid 99); 13 Feb 2015 05:14:14 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 13 Feb 2015 05:14:14 +0000 X-ASF-Spam-Status: No, hits=1.5 required=5.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_LOW,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: domain of jason.dillon@gmail.com designates 209.85.216.51 as permitted sender) Received: from [209.85.216.51] (HELO mail-qa0-f51.google.com) (209.85.216.51) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 13 Feb 2015 05:14:09 +0000 Received: by mail-qa0-f51.google.com with SMTP id i13so10994190qae.10 for ; Thu, 12 Feb 2015 21:11:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=date:from:to:message-id:in-reply-to:references:subject:mime-version :content-type; bh=KGITEqUIakjLz8Sy7/1tZitkBdjIYkVLb9LMnmG21/8=; b=aSrNQT/Y5Q5bLrY73QkOcLk0esNj7PJmHKCSWejK4kja8kil0/UJGw6sbZeXB1UgJA yQ4fm1J6J5+tKCN2tY3KRg482BFqyrbMDE267u9eYAWjCRQtjyyasDm1NgStN55JEuCV acXmWK/u5NjsQlv1+G6KefWL7+oPv0CFpUw8M89NxXScAtXje/MXjD8oPNIyPOBkHHh/ 9AZQdcYKVcsFnB6flBx81cMjpUpIkqdvh3OrBT+VxB9Fx2fwztYjr5fJEQjS52gdersX j3hMo360c2gn02sdnVxO1p9xSEtvixTNR5YXcxtyNVrITeT8jgoDYUkulhlOpWzeiOg4 Wliw== X-Received: by 10.140.44.134 with SMTP id g6mr18338650qga.85.1423804293456; Thu, 12 Feb 2015 21:11:33 -0800 (PST) Received: from Lust.local (c-67-188-141-250.hsd1.ca.comcast.net. [67.188.141.250]) by mx.google.com with ESMTPSA id t16sm6184624qac.23.2015.02.12.21.11.31 (version=TLSv1.2 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Thu, 12 Feb 2015 21:11:32 -0800 (PST) Date: Thu, 12 Feb 2015 21:11:29 -0800 From: Jason Dillon To: user@shiro.apache.org, Brian Demers Message-ID: In-Reply-To: References: Subject: Re: Can anonymous user have permissions? X-Mailer: Airmail (249) MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="54dd8782_550b8808_1b5" X-Virus-Checked: Checked by ClamAV on apache.org --54dd8782_550b8808_1b5 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline Tamas tossed up this as an example: https://github.com/sonatype/nexus-oss/commit/ad1d703125ec1be1d0eae0049293= 9d60de38a701=23diff-c82a898a4ce4094080b2cb98d3567affR38 That should work, but it seems like a long way to go for something that =5F= should=5F just work. Another idea to consider, is just setting the default principal to 'anony= mous' via a Subject=46actory https://github.com/bdemers/shiro/compare/bdemers:anonymous-user-roles...a= non-take-2=23diff-c592bbcd955d97db3e51216509533851R10 and then injecting that component:=C2=A0https://github.com/bdemers/shiro/= compare/bdemers:anonymous-user-roles...anon-take-2=23diff-0d740ecf6abf4b3= 6742a10db24b7b8c7R28 (i'm not sure how this plays with the rememberMe functionality, but addin= g just adding this as a thought) =46TR I had no idea there was a DefaultSubject=46actory. =C2=A0I think ho= wever since that might be global, that a filter in this case may be bette= r, but have to think about it more now that I realize there is a feature = to set the default subject via factory. Will this work and property get the anonymous subject managed so that the= rest of Shiros systems behave properly=3F=C2=A0 Tamas had another exampl= e below it that does a login() but I don't think that is proper, as well = as its much more expensive as it dives into shiro frameworks, not somethi= ng we want to do on each request w/o authentication. This branch also has a special realm, but I'm not sure if that is actuall= y needed or something like =22n/a=22 for realm-name as you have in your e= xample w/o a realm bound to that name is sufficient=3F Yeah, the anonymous realm would be a better way to deal with that, that w= ay you could force this user to the anonymous realm (by making it first i= n your realm list) which means you would not need to worry about the odd = case of a person trying to login with the 'anonymous' user and becoming a= uthenticated. Anonymous realm seems to also provide easy way to shut off anonymous, ano= ther requirement/use-case we have. And yes, generally we'd like to be able to have a way to grant =5Fguest=5F= a set of roles/permissions but presently the shiro frameworks only can d= o this if a subject has a principal and a =5Fguest=5F is a subject w/o a = principal. I'd like to hear other thoughts on this, because I've banged my head on t= his before.=C2=A0 I feel you should be able to assign roles/permissions t= o the =5Fguest=5F user, currently the only way to do this is to force a f= ake principal into the mix (and then you are no longer really a =5Fguest=5F= ) Ya, it would be nice if the default delegating impl had some means to say= give me the permissions for =5Fguest=5F user. =C2=A0I think we could bui= ld that ourselves, but it seems like something missing from the core fram= ework. =C2=A0Would be easier if the delegating took the subject instead o= f the the subject.principal, and left that detail up to the securitymanag= er impl. It may not matter however for our case, if you remember, we have to be ab= le to allow the =5Fanonymous=5F username to be changed for some crazy rea= son, so we can not really use the =5Fguest=5F concept at all, but have to= continue using an =5Fanonymous=5F (non-authenticated, non-remembered, no= n-logged-in) user. Yeah, in your case, that dated back to an old odd requirement (the idea w= as to allow the anonymous user's info to be pulled from an external sourc= e i.e. LDAP) Yar, we can=E2=80=99t even fully remember the details except for somethin= g like =E2=80=9Cif you use active-directory the =5Fanonymous=5F user is c= alled =5Fguest=5F. =C2=A0But I think we are on a path now to make this wo= rk in a simpler fashion, removing the subject.login() should really help.= I think though that shiro could really do with some proper api around is = subject.Guest() or subject.isAnonymous() =C2=A0(pick one they mean basica= lly the same thing), vs. assuming subject.principal=3Dnull implies this a= nd has no permissions. =C2=A0Many use-cases I think to want to use the pe= rmission system to allow folks who are anonymous/guest to have access. =C2= =A0Certainly we have these use-cases. =C2=A0Needing to force in a fake no= n-authenticated user complicates things, and voids some of the use of =40= RequireGuest apis. ATM if we progress we can=E2=80=99t use Shiro concept of =5Fguest=5F at a= ll. =C2=A0And would have to re-implement =40RequiresGuest and =40Requires= User to be aware of this special subject.principal=3D. =C2=A0 = Its do able, and we=E2=80=99ll likely move forward to to this. =C2=A0But = the framework itself IMO should cope with this edge-case, which isn=E2=80= =99t limited to use if you ask google. =C2=A0* * * =46TR, shiro is very simple if you use it as explained in the limited exa= mples, but as soon as you get off the path, its vastly complex and hard t= o comprehend. Anyways, we may need more input from you guys and I appreciate the respon= se with details. =C2=A0If there is anything we can contribute back, of co= urse, we=E2=80=99ll be more than happy to do so=E2=80=A6 but I think this= specific issues is a core design limitation to the framework/api that ca= n as-is only be worked around at present. =E2=80=94jason --54dd8782_550b8808_1b5 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable Content-Disposition: inline