Search code examples
apacheauthenticationclouderashirohortonworks-data-platform

authorize users based on user name but not user roles in shiro.ini

I connected my ldap account to shiro.ini. Is there a way in which I can configure shiro.ini to have user names instead of user roles.

eg: Right now this is possible

[urls]

/api/interpreter/** = authc, roles[admin]

but is there a way like below:

[urls]

/api/interpreter/** = authc, users[user1]

Solution

  • You could write your own filter. Take a look at org.apache.shiro.web.filter.authz.RolesAuthorizationFilter It should be pretty simple to create.

    Though generally speaking, I'd advise against it. Instead map your users to roles/permissions (even if it it outside of your LDAP server). That way your users are decoupled from your configuration.