Skip to content
Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Apache Shiro support for the Jersey JAX-RS implementation.


Shiro 1.4 has been released and includes a new official JAX-RS module shiro-jaxrs based on shiro-jersey.

The official shiro-jaxrs module offers feature parity with the generic JAX-RS functionality of shiro-jersey. The main difference is that shiro-jaxrs does not support the Jersey specific injections of shiro-jersey.


Adding the shiro-jersey dependency

Add the following dependencies to pom.xml in an existing project already using Jersey:


Version compatibility:

Jersey Shiro Jersey
2.0-2.25 0.2.0
1.x 0.1.1

If you are upgrading from Jersey 1.x, see the upgrade instructions.

Configuring Shiro in a Jersey web application

An example web application is provided complete with source code and web content.

The rest of this section describes how Shiro has been added to the example application.

Add the Shiro servlet filter in web.xml:





Then register the following components in the JAX-RS application:

public class ApiApplication extends ResourceConfig {
    public ApiApplication() {
        register(new SubjectFactory());
        register(new AuthInjectionBinder());

Configuring Shiro

Finally configure shiro.ini in the default package on the classpath:


exampleuser = examplepassword, examplerole

examplerole = something:readpermission

/** = noSessionCreation, authcBasic

Real applications should of course not store users and passwords in the INI-file. See the Shiro configuration documentation.

Using Shiro from JAX-RS

This section describes the different alternatives for how Shiro can be used from JAX-RS.

Declarative authorization with annotations

JAX-RS resource classes and methods can be annotated with the standard Shiro annotations.

The authorization requirements can for example be declared with @RequiresPermissions on JAX-RS resource classes / methods:

public class AuthResource {

    public String get() {
        return "OK";

    public String set(String value) {
        return value;

The example above can be summarized as:

  • HTTP GET access requires the user to have the permission protected:read
  • HTTP PUT access requires the user to have both permissions protected:read and protected:write

Programmatic authorization

Programmatic authorization is done by injecting the Shiro Subject as a method parameter:

public class AuthResource {

    public String get(@Auth Subject subject) {
        return "OK";

Injecting the Subject is just a convenience over calling SecurityUtils.getSubject().

Declarative and programmatic authorization are often combined when some permissions are static and some are dynamic:

public class AuthResource {

    public String get(@Auth Subject subject) {
        return "OK";

Optionally using an application specific user class

Instead of using the Shiro Subject class directly one can use an application specific user class for programmatic authorization:

public class AuthResource {

    public String get(@Auth User user) {
        return "OK";

A custom User class is a convenient way of implementing application specific authorization based on business rules on the user's data.

More authorization as rules means less authorization as permissions and hence fewer permissions to maintain.


  • The example User class.
  • The example UserFactory which must be registered as a JAX-RS component.
    • The class TypeFactory can be extended for injection of custom classes with the @Auth annotation.

Migrating from 0.1.x

These instructions assume that the JAX-RS application is a subclass of org.glassfish.jersey.server.ResourceConfig.

Note that JAX-RS component registration is done by ResourceConfig.register() instead of

  • AuthorizationFilterFeature replaces ShiroResourceFilterFactory

    Remove the configuration of ShiroResourceFilterFactory from web.xml and register AuthorizationFilterFeature as a JAX-RS component.

  • SubjectFactory replaces SubjectInjectableProvider

  • TypeFactory replaces AuthInjectableProvider


Running the integration tests

The integration tests for this project can be run as follows:

mvn -Pintegration-tests test


Support for securing Jersey JAX-RS applications with Apache Shiro.