[Enhancement] Improve Shiro's Spring Support

[bdemers]

Search before asking

• I had searched in the issues and found no similar issues.

Enhancement Request

I think, it would be better for Shiro's Spring support to integrate with Spring Security (e.g. Spring Sec, delegate to Shiro), instead of as a replacement  This would reduce a lot of code, footprint, and complexity of the integration.

Describe the solution you'd like

Create a Spring Security AuthenticationProvider that delegates to Shiro.

I've hacked on this a couple of times but I ran into a few minor issues each time, and then ran out of time to continue.

I'd love to hear other thoughts on this

Are you willing to submit PR?

• Yes I am willing to submit a PR!

[lprimak]

I think this is a great idea!

[lprimak]

Supersedes #1236

[lprimak]

Does this mean that Shiro/Spring can finally be configured via shiro.ini as well?

[bdemers]

I hadn't thought about that 🤔 Possibly...

[SilenceLurker]

Being compatible with Spring Security and implementing it by creating an AuthenticationProvider is indeed a good idea, but it doesn't seem to address the warning from BeanPostProcessorChecker caused by ShiroFilterFactoryBean in issue #1236.

[vgaur]

I have done this in my project , but all I have done is delegated the authentication to shiro using AuthenticationProvider and called the realm methods.
All security context is managed by spring its just a pure authentication delegation.