# apache/shiro

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management

Repository: https://github.com/apache/shiro
Canonical: https://ross.abutalabs.com/products/shiro
Homepage: https://shiro.apache.org/
Language: Java
License: Apache-2.0
License Family: permissive
Topics: library, web-framework, shiro, java
Last push: 2026-08-25T17:47:22+00:00

## Health v2 (maintenance only)
Score: 95/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 87, longevity 100
- inputs: {"age_days": 6213, "days_push": 8, "days_rel": 10, "gap_med": 75, "n_releases_24m": 10}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4451, forks 2291 (observed 2026-08-28T04:08:50.480553+00:00)

## What it is
Apache Shiro is a comprehensive Java security framework providing authentication, authorization, cryptography, and enterprise session management behind a deliberately simple, intuitive API. It secures any JVM application - from small mobile or CLI tools to large web and enterprise systems - with pluggable realms for LDAP, JDBC, and Active Directory, URL-based filter chains, and official Spring and Guice integrations.

## Use cases
- add login and authentication to a Java web application
- implement role-based and permission-based access control in Java
- secure REST API endpoints and URLs in a Spring Boot app
- manage user sessions outside a servlet or EJB container
- authenticate users against LDAP, JDBC, or Active Directory
- enable single sign-on across multiple JVM applications
- hash passwords and encrypt data with a simple Java crypto API
- define URL-specific security filter chains for a webapp

## When to choose
- You want one easy-to-learn framework covering authentication, authorization, cryptography, and sessions in a JVM app
- You need fine-grained permissions with a human-readable wildcard syntax rather than only roles
- You need session management that works in web, non-web, clustered, or heterogeneous-client environments
- You want pluggable Realms for LDAP, Active Directory, or JDBC without hand-rolling integrations
- You prefer minimal configuration, e.g. securing a webapp with a single filter definition in web.xml or Spring Boot auto-configuration

## When to avoid
- You need a standalone identity provider or full OAuth2/OpenID Connect server - use Keycloak or similar instead
- You are building a highly Spring-centric stack and prefer deep Spring Security ecosystem integration
- You are on a non-JVM platform such as Python, Node.js, or .NET
- You require standards-heavy enterprise SSO flows out of the box without additional integrations like CAS or pac4j

## Facets
- artifact type: framework
- maturity: active
- function: auth, authorization, cryptography, security, middleware
- domain: security, web-development, backend
- platform: jvm
- tags: java, session-management, single-sign-on, role-based-access-control, fine-grained-permissions, realms, ldap, active-directory, jdbc, spring, spring-boot, guice, jakarta-ee, servlet-filters, remember-me, web-security, web-server

## Member repositories
- apache/shiro (main) score 95

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:08:50.480553+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:20:46.355465+00:00, confidence not recorded.
  - readme: https://github.com/apache/shiro (fetched 2026-08-28T04:08:50.480553+00:00, sha 758838319cef)
  - homepage: https://shiro.apache.org/ (fetched 2026-08-29T09:07:50.043053+00:00, sha ee5d924c30a8)
  - site_page: https://shiro.apache.org/documentation.html (fetched 2026-08-29T09:07:50.052208+00:00, sha 9c9ad7ec771f)
  - site_page: https://shiro.apache.org/web-features.html (fetched 2026-08-29T09:07:50.053998+00:00, sha a3e267a921c4)
  - site_page: https://shiro.apache.org/features.html (fetched 2026-08-29T09:07:50.055696+00:00, sha b8e972a1b537)
  - site_page: https://shiro.apache.org/about.html (fetched 2026-08-29T09:07:50.061325+00:00, sha 653fadf482c3)
  - site_page: https://shiro.apache.org/authentication-features.html (fetched 2026-08-29T09:07:50.062727+00:00, sha 0502932a627d)
  - site_page: https://shiro.apache.org/authorization-features.html (fetched 2026-08-29T09:07:50.064231+00:00, sha 98912c91e541)
  - site_page: https://shiro.apache.org/integration.html (fetched 2026-08-29T09:07:50.057611+00:00, sha 51d6e38b3608)
  - site_page: https://shiro.apache.org/troubleshooting.html (fetched 2026-08-29T09:07:50.059450+00:00, sha 394c62838a12)
- Data as of 2026-08-30T08:39:29.467469+00:00.