Apache Shiro External Interfaces

Handy Hint

Shiro v1 and v2 version end-of-life notice

As of February 28, 2024, Shiro v1 was superseded by v2.

As of June 29, 2026, Shiro v2 was superseded by v3.

Table of Contents

Java API
Configuration interfaces
Web interfaces
Framework integrations
Command line tools
Compatibility

This page describes every external software interface of the released Apache Shiro artifacts, and points to the detailed documentation for each. Shiro is a library embedded in an application; it does not open network ports or run as a service of its own.

Java API

The public Java API is the primary interface. Types and packages in the released artifacts are documented in the API documentation (also available at javadoc.io). The main entry points are:

Interface Purpose

Interface	Purpose
`org.apache.shiro.SecurityUtils`, `Subject`	Obtain the current user and perform authentication, authorization and session operations. See Architecture and Authentication.
`SecurityManager`, `Realm`, `AuthenticationStrategy`, `CredentialsMatcher`	Extension points for credential verification and data sources. See Realms.
`Authorizer`, permissions, annotations (`@RequiresAuthentication`, `@RequiresPermissions`, `@RequiresRoles`)	Authorization checks. See Authorization.
`SessionManager`, `SessionDAO`	Session management and persistence. See Session Management.
`CipherService`, `Hash`, `HashService`, `PasswordService`	Cryptography. See Cryptography.
`CacheManager`	Caching of authentication and authorization data. See Caching.

org.apache.shiro.SecurityUtils, Subject

Obtain the current user and perform authentication, authorization and session operations. See Architecture and Authentication.

SecurityManager, Realm, AuthenticationStrategy, CredentialsMatcher

Extension points for credential verification and data sources. See Realms.

Authorizer, permissions, annotations (@RequiresAuthentication, @RequiresPermissions, @RequiresRoles)

Authorization checks. See Authorization.

SessionManager, SessionDAO

Session management and persistence. See Session Management.

CipherService, Hash, HashService, PasswordService

Cryptography. See Cryptography.

CacheManager

Caching of authentication and authorization data. See Caching.

Configuration interfaces

Configuration is supplied by the application’s operator and is trusted input. See Configuration for the full reference.

The INI format (shiro.ini), including the [main], [users], [roles] and [urls] sections.
Programmatic configuration through the Java API, and Spring, Spring Boot, Guice, CDI and Jakarta EE configuration.
Java system properties and environment settings documented for individual features.

Web interfaces

The web modules integrate through standard Jakarta Servlet mechanisms. They consume HTTP requests (path, headers, cookies, form parameters) from untrusted clients, apply the configured filter chains and cookie handling, and produce redirects and responses. See Web Support, Web Features, Jakarta EE and the security model for the trust assumptions that apply.

Framework integrations

Optional modules integrate Shiro with Spring, Spring Boot, Guice, CDI, EJB, JAX-RS, AspectJ, Quartz and JCache. Each integration is documented on its own page linked from the documentation hub and in the reference manual.

Command line tools

The command line hasher (shiro-tools-hasher) hashes passwords and data from the command line. See Command Line Hasher.

Compatibility

Supported release lines are listed on the support page.