Apache Shiro Part 2 - Realms, Database and PGP Certificates

This is second part of series dedicated to Apache Shiro. We started previous part with simple unsecured web application. When we finished, the application had basic authentication and authorization. Users could log in and log out. All web pages and buttons had access rights assigned and enforced. Both authorization and authentication data have been stored in static configuration file.

As we promised in the end of last part, we will move user account data to database. In addition, we will give users an option to authenticate themselves via PGP certificates. As a result, our application will have multiple alternative log in options: log in with user name/password and log in with certificate. We will finish by turning alternative log in options mandatory.

Apache Shiro Part 1 - Basics

Apache Shiro, originally called JSecurity, is Java security framework. It was accepted and became Apache top level project in 2010. It aims to be powerful and easy to be used.

The project is in active development with active both users and developers mailing lists. Most important areas are documented on its web page. However, it has lot of gaps in documentation. It is not possible to learn to use most Shiro features from documentation alone. Luckily, the code is well commented and where I tried it was also easily readable.

Main Shiro features are:

• authentication,
• authorization,
• cryptography,
• session management.

In this article article we try and demonstrate various Shiro features. We start with simple unsecured web application, then we add security features into it.  All code code is available in SimpleShiroSecuredApplication project on Github.

Women, Development, Analysis and Accusations

According to some statistics, tech women leave the field more often then men. The same statistics shows us going into analysis a lot and that career move is supposed to show that women are mistreated by hostile tech culture.

I have no problem with the stats themselves. If they show women moving from tech to analysis, then it is what it is. What I do have a problem with is the implication.

If one dislikes communication with male tech colleges, moving into analysis is likely to be a monumental mistake. Significant part of analyst job is to communicate with techies. In a sense, communication with techies is the job itself. Women in tech know this.