1 /*
2 * Licensed to the Apache Software Foundation (ASF) under one
3 * or more contributor license agreements. See the NOTICE file
4 * distributed with this work for additional information
5 * regarding copyright ownership. The ASF licenses this file
6 * to you under the Apache License, Version 2.0 (the
7 * "License"); you may not use this file except in compliance
8 * with the License. You may obtain a copy of the License at
9 *
10 * http://www.apache.org/licenses/LICENSE-2.0
11 *
12 * Unless required by applicable law or agreed to in writing,
13 * software distributed under the License is distributed on an
14 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15 * KIND, either express or implied. See the License for the
16 * specific language governing permissions and limitations
17 * under the License.
18 */
19 package org.apache.shiro;
20
21 import org.apache.shiro.mgt.SecurityManager;
22 import org.apache.shiro.subject.Subject;
23 import org.apache.shiro.util.ThreadContext;
24
25
26 /**
27 * Accesses the currently accessible {@code Subject} for the calling code depending on runtime environment.
28 *
29 * @since 0.2
30 */
31 public abstract class SecurityUtils {
32
33 /**
34 * ONLY used as a 'backup' in VM Singleton environments (that is, standalone environments), since the
35 * ThreadContext should always be the primary source for Subject instances when possible.
36 */
37 private static volatile SecurityManager securityManager;
38
39 /**
40 * Returns the currently accessible {@code Subject} available to the calling code depending on
41 * runtime environment.
42 * <p/>
43 * This method is provided as a way of obtaining a {@code Subject} without having to resort to
44 * implementation-specific methods. It also allows the Shiro team to change the underlying implementation of
45 * this method in the future depending on requirements/updates without affecting your code that uses it.
46 *
47 * @return the currently accessible {@code Subject} accessible to the calling code.
48 * @throws IllegalStateException if no {@link Subject Subject} instance or
49 * {@link SecurityManager SecurityManager} instance is available with which to obtain
50 * a {@code Subject}, which which is considered an invalid application configuration
51 * - a Subject should <em>always</em> be available to the caller.
52 */
53 public static Subject getSubject() {
54 Subject subject = ThreadContext.getSubject();
55 if (subject == null) {
56 subject = (new Subject.Builder()).buildSubject();
57 ThreadContext.bind(subject);
58 }
59 return subject;
60 }
61
62 /**
63 * Sets a VM (static) singleton SecurityManager, specifically for transparent use in the
64 * {@link #getSubject() getSubject()} implementation.
65 * <p/>
66 * <b>This method call exists mainly for framework development support. Application developers should rarely,
67 * if ever, need to call this method.</b>
68 * <p/>
69 * The Shiro development team prefers that SecurityManager instances are non-static application singletons
70 * and <em>not</em> VM static singletons. Application singletons that do not use static memory require some sort
71 * of application configuration framework to maintain the application-wide SecurityManager instance for you
72 * (for example, Spring or EJB3 environments) such that the object reference does not need to be static.
73 * <p/>
74 * In these environments, Shiro acquires Subject data based on the currently executing Thread via its own
75 * framework integration code, and this is the preferred way to use Shiro.
76 * <p/>
77 * However in some environments, such as a standalone desktop application or Applets that do not use Spring or
78 * EJB or similar config frameworks, a VM-singleton might make more sense (although the former is still preferred).
79 * In these environments, setting the SecurityManager via this method will automatically enable the
80 * {@link #getSubject() getSubject()} call to function with little configuration.
81 * <p/>
82 * For example, in these environments, this will work:
83 * <pre>
84 * DefaultSecurityManager securityManager = new {@link org.apache.shiro.mgt.DefaultSecurityManager DefaultSecurityManager}();
85 * securityManager.setRealms( ... ); //one or more Realms
86 * <b>SecurityUtils.setSecurityManager( securityManager );</b></pre>
87 * <p/>
88 * And then anywhere in the application code, the following call will return the application's Subject:
89 * <pre>
90 * Subject currentUser = SecurityUtils.getSubject();</pre>
91 *
92 * @param securityManager the securityManager instance to set as a VM static singleton.
93 */
94 public static void setSecurityManager(SecurityManager securityManager) {
95 SecurityUtils.securityManager = securityManager;
96 }
97
98 /**
99 * Returns the SecurityManager accessible to the calling code.
100 * <p/>
101 * This implementation favors acquiring a thread-bound {@code SecurityManager} if it can find one. If one is
102 * not available to the executing thread, it will attempt to use the static singleton if available (see the
103 * {@link #setSecurityManager setSecurityManager} method for more on the static singleton).
104 * <p/>
105 * If neither the thread-local or static singleton instances are available, this method throws an
106 * {@code UnavailableSecurityManagerException} to indicate an error - a SecurityManager should always be accessible
107 * to calling code in an application. If it is not, it is likely due to a Shiro configuration problem.
108 *
109 * @return the SecurityManager accessible to the calling code.
110 * @throws UnavailableSecurityManagerException
111 * if there is no {@code SecurityManager} instance available to the
112 * calling code, which typically indicates an invalid application configuration.
113 */
114 public static SecurityManager getSecurityManager() throws UnavailableSecurityManagerException {
115 SecurityManager securityManager = ThreadContext.getSecurityManager();
116 if (securityManager == null) {
117 securityManager = SecurityUtils.securityManager;
118 }
119 if (securityManager == null) {
120 String msg = "No SecurityManager accessible to the calling code, either bound to the " +
121 ThreadContext.class.getName() + " or as a vm static singleton. This is an invalid application " +
122 "configuration.";
123 throw new UnavailableSecurityManagerException(msg);
124 }
125 return securityManager;
126 }
127 }