AuthorizationInfo represents a single Subject's stored authorization data (roles, permissions, etc) used during authorization (access control) checks only.
Roles are represented as a
Collection of Strings ( {@link java.util.Collection Collection}< {@link String String}>), typically each element being the Role name.
{@link Permission Permission}s are provided in two ways:
- A
Collection of Strings, where each String can usually be converted into Permission objects by a Realm's {@link org.apache.shiro.authz.permission.PermissionResolver PermissionResolver} - A
Collection of {@link Permission Permission} objects
Both permission collections together represent the total aggregate collection of permissions. You may use one or both depending on your preference and needs.
Because the act of authorization (access control) is orthoganal to authentication (log-in), this interface is intended to represent only the account data needed by Shiro during an access control check (role, permission, etc). Shiro also has a parallel {@link org.apache.shiro.authc.AuthenticationInfo AuthenticationInfo} interface for use during the authenticationprocess that represents identity data such as principals and credentials.
Because many if not most {@link org.apache.shiro.realm.Realm Realm}s store both sets of data for a Subject, it might be convenient for a
Realm implementation to utilize an implementation of the {@link org.apache.shiro.authc.Account Account} interface instead, which is a convenience interface that combines both
AuthenticationInfo and
AuthorizationInfo. Whether you choose to implement these two interfaces separately or implement the one
Account interface for a given
Realm is entirely based on your application's needs or your preferences.
@author Jeremy Haile
@author Les Hazlewood
@see org.apache.shiro.authc.AuthenticationInfo AuthenticationInfo
@see org.apache.shiro.authc.Account
@since 0.9