How to do role-based authorization with Apache Shiro depending on HTTP request method

Question

I'm struggling to figure out how I can do role-based authorization depending on what HTTP method a request is using. I use HTTP basic auth and depending on the users role and the HTTP method used a request should succeed or fail.

Example:

• a GET request to http://localhost/rest/ should always be allowed, even to non-authenticated users (anon access)
• a PUT request to http://localhost/rest/ (same resource!) should only be allowed if user is authenticated
• a DELETE request to http://localhost/rest/ (same resource!) should only be allowed if user is authenticated and has the role ADMINISTRATOR

My current (non-working) attempt of configuring shiro.ini looks like this:

/rest = authcBasic[PUT], roles[SERVICE_PROVIDER]
/rest = authcBasic[POST], roles[EXPERIMENTER]
/rest = authcBasic[DELETE], roles[ADMINISTRATOR]
/rest = authcBasic

Update

I've just found https://issues.apache.org/jira/browse/SHIRO-107 and updated my shiro.ini to be

/rest/**:put    = authcBasic, roles[SERVICE_PROVIDER]
/rest/**:post   = authcBasic, roles[EXPERIMENTER]
/rest/**:delete = authcBasic, roles[ADMINISTRATOR]
/rest/**        = authcBasic

but it still doesn't work. It seems that only the last rule matches. Also, the commit comment also seems to indicate that this only works with permission-based authorization. Is there no equivalent implementation for role-based authz?

Answer 1

I think HttpMethodPermissionFilter is the one you need to configure: http://shiro.apache.org/static/1.2.2/apidocs/org/apache/shiro/web/filter/authz/HttpMethodPermissionFilter.html This should enable you to map the HTTP method to Shiro's "create,read,update,delete" permissions as outlined in the javadoc for the class.