apache/shiro

Health v2 · maintenance only

Adoption not part of the score

4451 stars · 2291 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Apache Shiro is a comprehensive Java security framework providing authentication, authorization, cryptography, and enterprise session management behind a deliberately simple, intuitive API. It secures any JVM application - from small mobile or CLI tools to large web and enterprise systems - with pluggable realms for LDAP, JDBC, and Active Directory, URL-based filter chains, and official Spring and Guice integrations.

Use cases

• add login and authentication to a Java web application
• implement role-based and permission-based access control in Java
• secure REST API endpoints and URLs in a Spring Boot app
• manage user sessions outside a servlet or EJB container
• authenticate users against LDAP, JDBC, or Active Directory
• enable single sign-on across multiple JVM applications
• hash passwords and encrypt data with a simple Java crypto API
• define URL-specific security filter chains for a webapp

When to choose

• You want one easy-to-learn framework covering authentication, authorization, cryptography, and sessions in a JVM app
• You need fine-grained permissions with a human-readable wildcard syntax rather than only roles
• You need session management that works in web, non-web, clustered, or heterogeneous-client environments
• You want pluggable Realms for LDAP, Active Directory, or JDBC without hand-rolling integrations
• You prefer minimal configuration, e.g. securing a webapp with a single filter definition in web.xml or Spring Boot auto-configuration

When to avoid

• You need a standalone identity provider or full OAuth2/OpenID Connect server - use Keycloak or similar instead
• You are building a highly Spring-centric stack and prefer deep Spring Security ecosystem integration
• You are on a non-JVM platform such as Python, Node.js, or .NET
• You require standards-heavy enterprise SSO flows out of the box without additional integrations like CAS or pac4j

Facets

framework · maturity active

auth authorization cryptography security middleware security web-development backend jvm java session-management single-sign-on role-based-access-control fine-grained-permissions realms ldap active-directory jdbc spring spring-boot guice jakarta-ee servlet-filters remember-me web-security web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="apache/shiro")