Default no-arg constructor.
Supporting constructor for a single-realm application.
Supporting constructor for multiple {@link #setRealms realms}.
Binds a {@code Subject} instance created after authentication to the application for later use. <p/> As of Shiro 1.2, this method has been deprecated in favor of {@link #save(hunt.shiro.subject.Subject)}, which this implementation now calls.
Creates a {@code Subject} instance for the user represented by the given method arguments.
This implementation functions as follows: <p/> <ol> <li>Ensures the {@code SubjectContext} is as populated as it can be, using heuristics to acquire data that may not have already been available to it (such as a referenced session or remembered principals).</li> <li>Calls {@link #doCreateSubject(hunt.shiro.subject.SubjectContext)} to actually perform the {@code Subject} instance creation.</li> <li>calls {@link #save(hunt.shiro.subject.Subject) save(subject)} to ensure the constructed {@code Subject}'s state is accessible for future requests/invocations if necessary.</li> <li>returns the constructed {@code Subject} instance.</li> </ol>
Actually creates a {@code Subject} instance by delegating to the internal {@link #getSubjectFactory() subjectFactory}. By the time this method is invoked, all possible {@code SubjectContext} data (session, principals, et. al.) has been made accessible using all known heuristics and will be accessible to the {@code subjectFactory} via the {@code subjectContext.resolve*} methods.
Determines if there is a {@code SecurityManager} instance in the context, and if not, adds 'this' to the context. This ensures the SubjectFactory instance will have access to a SecurityManager during Subject construction if necessary.
Returns the {@code SubjectDAO} responsible for persisting Subject state, typically used after login or when an Subject identity is discovered (eg after RememberMe services). Unless configured otherwise, the default implementation is a {@link DefaultSubjectDAO}.
Returns the {@code SubjectFactory} responsible for creating {@link Subject} instances exposed to the application.
First authenticates the {@code AuthenticationToken} argument, and if successful, constructs a {@code Subject} instance representing the authenticated account's identity. <p/> Once constructed, the {@code Subject} instance is then {@link #bind bound} to the application for subsequent access before being returned to the caller.
Removes (or 'unbinds') the Subject's state from the application, typically called during {@link #logout}.. <p/> This implementation merely delegates to the internal {@link #setSubjectDAO(SubjectDAO) subjectDAO} and calls {@link SubjectDAO#remove(hunt.shiro.subject.Subject) remove(subject)}.
Attempts to resolve an identity (a {@link PrincipalCollection}) for the context using heuristics. This implementation functions as follows: <ol> <li>Check the context to see if it can already {@link SubjectContext#resolvePrincipals resolve an identity}. If so, this method does nothing and returns the method argument unaltered.</li> <li>Check for a RememberMe identity by calling {@link #getRememberedIdentity}. If that method returns a non-null value, place the remembered {@link PrincipalCollection} in the context.</li> </ol>
Attempts to resolve any associated session based on the context and returns a context that represents this resolved {@code Session} to ensure it may be referenced if necessary by the invoked {@link SubjectFactory} that performs actual {@link Subject} construction. <p/> If there is a {@code Session} already in the context because that is what the caller wants to be used for {@code Subject} construction, or if no session is resolved, this method effectively does nothing returns the context method argument unaltered.
Saves the subject's state to a persistent location for future reference if necessary. <p/> This implementation merely delegates to the internal {@link #setSubjectDAO(SubjectDAO) subjectDAO} and calls {@link SubjectDAO#save(hunt.shiro.subject.Subject) subjectDAO.save(subject)}.
Sets the {@code SubjectDAO} responsible for persisting Subject state, typically used after login or when an Subject identity is discovered (eg after RememberMe services). Unless configured otherwise, the default implementation is a {@link DefaultSubjectDAO}.
Sets the {@code SubjectFactory} responsible for creating {@link Subject} instances exposed to the application.
Unbinds or removes the Subject's state from the application, typically called during {@link #logout}. <p/> This has been deprecated in Shiro 1.2 in favor of the {@link #remove(hunt.shiro.subject.Subject) remove} method. The implementation has been updated to invoke that method.
Sets the underlying delegate {@link SessionManager} instance that will be used to support this implementation's <tt>SessionManager</tt> method calls. <p/> This <tt>SecurityManager</tt> implementation does not provide logic to support the inherited <tt>SessionManager</tt> interface, but instead delegates these calls to an internal <tt>SessionManager</tt> instance. <p/> If a <tt>SessionManager</tt> instance is not set, a default one will be automatically created and initialized appropriately for the the existing runtime environment.
Returns this security manager's internal delegate {@link SessionManager SessionManager}.
Calls {@link hunt.shiro.mgt.AuthorizingSecurityManager#afterCacheManagerSet() super.afterCacheManagerSet()} and then immediately calls {@link #applyCacheManagerToSessionManager() applyCacheManagerToSessionManager()} to ensure the <code>CacheManager</code> is applied to the SessionManager as necessary.
Sets any configured EventBus on the SessionManager if necessary.
Ensures the internal delegate <code>SessionManager</code> is injected with the newly set {@link #setCacheManager CacheManager} so it may use it for its internal caching needs. <p/> Note: This implementation only injects the CacheManager into the SessionManager if the SessionManager instance implements the {@link CacheManagerAware CacheManagerAware} interface.
Ensures the internal delegate <code>SessionManager</code> is injected with the newly set {@link #setEventBus EventBus} so it may use it for its internal event needs. <p/> Note: This implementation only injects the EventBus into the SessionManager if the SessionManager instance implements the {@link EventBusAware EventBusAware} interface.
The Shiro framework's default concrete implementation of the {@link SecurityManager} interface, based around a collection of {@link hunt.shiro.realm.Realm}s. This implementation delegates its authentication, authorization, and session operations to wrapped {@link Authenticator}, {@link Authorizer}, and {@link hunt.shiro.session.mgt.SessionManager SessionManager} instances respectively via superclass implementation. <p/> To greatly reduce and simplify configuration, this implementation (and its superclasses) will create suitable defaults for all of its required dependencies, <em>except</em> the required one or more {@link Realm Realm}s. Because {@code Realm} implementations usually interact with an application's data model, they are almost always application specific; you will want to specify at least one custom {@code Realm} implementation that 'knows' about your application's data/security model (via {@link #setRealm} or one of the overloaded constructors). All other attributes in this class hierarchy will have suitable defaults for most enterprise applications. <p/> <b>RememberMe notice</b>: This class supports the ability to configure a {@link #setRememberMeManager RememberMeManager} for {@code RememberMe} identity services for login/logout, BUT, a default instance <em>will not</em> be created for this attribute at startup. <p/> Because RememberMe services are inherently client tier-specific and therefore aplication-dependent, if you want {@code RememberMe} services enabled, you will have to specify an instance yourself via the {@link #setRememberMeManager(RememberMeManager) setRememberMeManager} mutator. However if you're reading this JavaDoc with the expectation of operating in a Web environment, take a look at the {@code hunt.shiro.web.DefaultWebSecurityManager} implementation, which <em>does</em> support {@code RememberMe} services by default at startup.