On Tue, 9 May 2017, praba wrote:
I have three web applications which are App1, App2 and App3 developed in
SpringMVC and Apache Shiro framework.
- App1: App1 has own users and roles
- App2: App2 has own users and roles
App1 and App2 has different users and roles.
- App3: App3 doesn’t have own users and roles, it is common application
for both App1 and App2
My scenario:
1. If one user logged in App1 and the user should be able to view App3
with his roles and permission. At the same time the user should not able to
view App2.
2. If one user logged in App2 and the user should be able to view App3
with his roles and permission. At the same time the user should not able to
view App1.
How to achieve this? Please give me your valuable suggestions.
CAS is the Central Authentication Service. It performs authentication and
supports Single-Sign-On by persisting a session.
Each application delegates authentication to CAS and has its own
application session. Each application should be responsible for its own
authorization (access control).
Handle authorization (access control) separately in each app. It is not
the purpose of CAS to provide access control. CAS returns attributes that
can help the application make an authorization decision, such as,
"affiliation=employee", but the application should use its own rules to
decide if a user has access.
Andy
