0

I have developed a web application with following architecture:

  • Frontend : Angular 6
  • Backend : Java REST APIs with Springboot

I want to add authentication and authorization to it. For that I'm looking for some open source application (e.g. KeyCloak, Gluu etc.). I would like to know in which tool the below scenarios are supported.

  • There will be predefined set of Activities on UI (e.g. Add, Edit, Delete etc)
  • There will be predefined Access Levels (e.g. Read, Write, No Access)
  • I should be able to create Roles, then assign activities and access levels to those roles and assign those roles to user.

Can you please help me to find out a tool which supports my above scenario?

I tried something for KeyCloak, but i couldn't find a way to add activities, access levels and map roles to it. I think everything there is governed by Role only.

I just realized that I need Activity based authorization and not Role based authorization. Please help me find some tool for that.

1 Answer 1

0

I'm not sure what is meant by activity based authorization but i suspect you actually mean permission based authorization, in example: Grant permissions to users to perform certain actions.

Shiro offers you permissions and role based authorization out of the box.
You can create roles, add permissions to these roles and assign them to a user. Supported are implicit and explicit roles, whereas one role can hold any number of permissions. You can even work with wildcards and group the permissions.

For more information you should take a look at the official Shiro entry and especially the web documentation for your project in particular. Shiro offers full support for Spring-Boot applications, you can find a HowTo here.

Shiro fully supports your described scenario.

2
  • Hi UnlikePluto, thanks for edits and reply. I know Shiro provides that but i thinks it lacks the UI to manage Users, Roles & Permissions. Which KeyCloak or Gluu provides. Do you have some more information on Admin / Self Service UI for Shiro ? Jun 21, 2018 at 10:33
  • Shiro itself does not offer any UI to manage roles and permissions as it is just a security implementation. Instead, Shiro gathers its user, role and permission models from its different realms. For example, you can define a database realm (JdbcRealm) which requires you to have certain database tables depicting the mentioned models. Realms can be defined in anyway, even as plain text files or as a remote server. How these realms are managed is up to you, your implementation and tools (mysql). For example, you could design your web application to handle the realm itself via the rest server. Jun 21, 2018 at 10:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.