# Apache Shiro — Versatile Java Security Framework

> Apache Shiro is a powerful and easy-to-use Java security framework that handles authentication, authorization, cryptography, and session management for any application.

## Install

Save in your project root:

# Apache Shiro — Versatile Java Security Framework

## Quick Use
```xml
<!-- Maven dependency -->
<dependency>
  <groupId>org.apache.shiro</groupId>
  <artifactId>shiro-core</artifactId>
  <version>2.0.2</version>
</dependency>
```
```java
Subject currentUser = SecurityUtils.getSubject();
currentUser.login(new UsernamePasswordToken("admin", "secret"));
if (currentUser.hasRole("editor")) {
    // authorized action
}
```

## Introduction
Apache Shiro provides a clean API for securing Java applications without tying developers to a specific framework or container. It works in any environment — from simple command-line tools to large Spring-based web applications — and keeps security logic readable rather than buried in annotations or XML.

## What Apache Shiro Does
- Authenticates users against pluggable credential stores including LDAP, JDBC, and custom Realms
- Authorizes access through roles and fine-grained permissions with a simple string-based syntax
- Manages sessions independent of the servlet container, enabling use in non-web contexts
- Provides cryptographic utilities for hashing passwords and encrypting data
- Integrates with Spring, Spring Boot, and Jakarta EE through dedicated modules

## Architecture Overview
Shiro is organized around a SecurityManager that coordinates authentication and authorization workflows. Realms connect Shiro to identity data sources — each Realm knows how to look up credentials and permissions for a given principal. The Subject API represents the current user and delegates every security check to the SecurityManager. Session management is abstracted behind a SessionDAO, allowing sessions to live in memory, a database, or a distributed cache like Redis without changing application code.

## Self-Hosting & Configuration
- Add `shiro-core` (and `shiro-web` for servlet apps) to your Maven or Gradle dependencies
- Define one or more Realms that connect to your user store (JDBC, LDAP, or INI file for prototyping)
- Configure the SecurityManager in a `shiro.ini` file or programmatically via Spring beans
- For Spring Boot, add `shiro-spring-boot-starter` — auto-configuration handles filter chain setup
- Deploy as part of your application; Shiro has no external service to run

## Key Features
- Framework-agnostic design works in plain Java, Spring, Guice, or Jakarta EE environments
- Human-readable permission strings like `document:edit:123` simplify authorization rules
- Native session management works outside servlet containers, supporting CLI tools and microservices
- Built-in password hashing with salted iterations out of the box
- Lightweight footprint with minimal transitive dependencies

## Comparison with Similar Tools
- **Spring Security** — Tightly integrated with the Spring ecosystem; Shiro is framework-agnostic and simpler to configure
- **Keycloak** — Full identity provider with SSO; Shiro is an embedded library, not a standalone server
- **Auth0 / Okta** — Cloud-hosted auth services; Shiro runs inside your application with no external dependency
- **Jakarta Security (JAAS)** — Container-managed and spec-driven; Shiro provides a more intuitive programmatic API
- **pac4j** — Protocol-focused (OAuth, SAML); Shiro covers broader security concerns including sessions and crypto

## FAQ
**Q: Can Shiro work with Spring Boot?**
A: Yes. The `shiro-spring-boot-starter` module provides auto-configuration for filter chains, Realm wiring, and annotation-based authorization.

**Q: Does Shiro support OAuth 2.0 or OpenID Connect?**
A: Not natively, but you can write a custom Realm or combine Shiro with a library like pac4j for OAuth flows.

**Q: How does Shiro compare to Spring Security in complexity?**
A: Shiro's API is intentionally smaller and more readable. Projects that do not already use Spring often find Shiro faster to integrate.

**Q: Is Apache Shiro still actively maintained?**
A: Yes. The project is maintained under the Apache Software Foundation with regular releases and security patches.

## Sources
- https://github.com/apache/shiro
- https://shiro.apache.org/documentation.html

---
Source: https://tokrepo.com/en/workflows/asset-b9f6a84f
Author: AI Open Source