Skip to content

Commit dac7d84

Browse files
GaneshPatil7517lprimak
GaneshPatil7517
and
lprimak
authored
Add FlowLogix depchain as easier-than-BOM Shiro-Jakarta-EE dependencies (#219) (#260)
* docs(security): add Security Model documentation - Created src/site/content/security-model.adoc with detailed explanation - Covers trust boundaries, authentication, authorization guarantees - Includes session management and cryptography security considerations - Documents operator responsibilities and deployment recommendations - Follows existing site documentation style and AsciiDoc format * Add FlowLogix depchain as alternative to BOM for Shiro-Jakarta-EE (#219) This commit introduces documentation for the FlowLogix dependency chain as a simpler alternative to managing Apache Shiro Jakarta EE dependencies using the traditional BOM approach. Changes: - Add dependency-chain.adoc with complete documentation covering: - Maven and Gradle configuration examples - Comparison with traditional BOM approach - Complete example project - Migration guide from BOM to dependency chain - Update jakarta-ee.adoc to reference the dependency chain option as the recommended approach alongside existing BOM documentation The FlowLogix shiro-jakarta dependency chain bundles all required Shiro Jakarta EE modules (shiro-core, shiro-web, shiro-jakarta-ee, shiro-cdi, shiro-jaxrs) with the correct jakarta classifier, plus required dependencies like OmniFaces, in a single dependency. Resolves: #219 --------- Co-authored-by: Lenny Primak <[email protected]>
1 parent 5d8fc21 commit dac7d84

File tree

2 files changed

+216
-1
lines changed

2 files changed

+216
-1
lines changed

‎src/site/content/dependency-chain.adoc‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
= Using FlowLogix Dependency Chains with Apache Shiro
2+
:jbake-date: 2026-01-03 00:00:00
3+
:jbake-type: page
4+
:jbake-status: published
5+
:jbake-tags: documentation, jakarta-ee, dependencies, integrations
6+
:idprefix:
7+
:icons: font
8+
9+
Managing Apache Shiro dependencies in Jakarta EE projects can be simplified using the FlowLogix Dependency Chains. This approach provides a cleaner alternative to managing the BOM (Bill of Materials) directly, reducing configuration complexity and common errors.
10+
11+
== What is the FlowLogix Dependency Chain?
12+
13+
FlowLogix provides pre-configured Maven dependency chains that bundle related dependencies together. For Apache Shiro with Jakarta EE, the `shiro-jakarta` module includes all necessary Shiro components with the correct Jakarta classifier, eliminating the need to declare each dependency individually.
14+
15+
== Why Use Dependency Chains Instead of BOM?
16+
17+
Traditional BOM usage requires importing the BOM in `<dependencyManagement>` and then declaring each individual dependency. This approach can lead to:
18+
19+
* Forgetting to include required transitive dependencies
20+
* Inconsistent versions when mixing dependencies
21+
* Verbose configuration with multiple dependency declarations
22+
* Missing the `jakarta` classifier on artifacts
23+
24+
The dependency chain approach bundles everything you need in a single dependency, automatically including:
25+
26+
* `shiro-core` (jakarta classifier)
27+
* `shiro-web` (jakarta classifier)
28+
* `shiro-jakarta-ee` (jakarta classifier)
29+
* `shiro-cdi` (jakarta classifier)
30+
* `shiro-jaxrs` (jakarta classifier)
31+
* `commons-configuration2`
32+
* `omnifaces`
33+
34+
== Maven Configuration
35+
36+
=== Using the Dependency Chain (Recommended)
37+
38+
Add a single dependency to include all Shiro Jakarta EE components:
39+
40+
[source,xml]
41+
----
42+
<dependencies>
43+
<dependency>
44+
<groupId>com.flowlogix.depchain</groupId>
45+
<artifactId>shiro-jakarta</artifactId>
46+
<version>11</version>
47+
<type>pom</type>
48+
</dependency>
49+
</dependencies>
50+
----
51+
52+
=== Comparison with Traditional BOM Approach
53+
54+
For reference, the traditional BOM approach requires significantly more configuration:
55+
56+
[source,xml]
57+
----
58+
<!-- Traditional BOM Approach (more verbose) -->
59+
<dependencyManagement>
60+
<dependencies>
61+
<dependency>
62+
<groupId>org.apache.shiro</groupId>
63+
<artifactId>shiro-bom</artifactId>
64+
<version>${shiro.version}</version>
65+
<scope>import</scope>
66+
<type>pom</type>
67+
</dependency>
68+
</dependencies>
69+
</dependencyManagement>
70+
71+
<dependencies>
72+
<dependency>
73+
<groupId>org.apache.shiro</groupId>
74+
<artifactId>shiro-jakarta-ee</artifactId>
75+
<classifier>jakarta</classifier>
76+
</dependency>
77+
<dependency>
78+
<groupId>org.apache.shiro</groupId>
79+
<artifactId>shiro-cdi</artifactId>
80+
<classifier>jakarta</classifier>
81+
</dependency>
82+
<dependency>
83+
<groupId>org.apache.shiro</groupId>
84+
<artifactId>shiro-core</artifactId>
85+
<classifier>jakarta</classifier>
86+
</dependency>
87+
<dependency>
88+
<groupId>org.apache.shiro</groupId>
89+
<artifactId>shiro-web</artifactId>
90+
<classifier>jakarta</classifier>
91+
</dependency>
92+
<dependency>
93+
<groupId>org.omnifaces</groupId>
94+
<artifactId>omnifaces</artifactId>
95+
<version>LATEST</version>
96+
</dependency>
97+
</dependencies>
98+
----
99+
100+
== Gradle Configuration
101+
102+
=== Using the Dependency Chain
103+
104+
[source,groovy]
105+
----
106+
dependencies {
107+
implementation platform('com.flowlogix.depchain:shiro-jakarta:11')
108+
}
109+
----
110+
111+
For Kotlin DSL:
112+
113+
[source,kotlin]
114+
----
115+
dependencies {
116+
implementation(platform("com.flowlogix.depchain:shiro-jakarta:11"))
117+
}
118+
----
119+
120+
== Version Information
121+
122+
The FlowLogix dependency chain version corresponds to the major release of FlowLogix components:
123+
124+
* Version 11: Compatible with Java 17-25+ and Jakarta EE 11
125+
* Version 10: Compatible with Java 17+ and Jakarta EE 10
126+
127+
Check the https://central.sonatype.com/search?q=com.flowlogix.depchain&sort=published[Maven Central] for the latest available version.
128+
129+
== Additional Resources
130+
131+
* https://docs.flowlogix.com/depchains[FlowLogix Dependency Chains Documentation]
132+
* https://github.com/flowlogix/flowlogix[FlowLogix GitHub Repository]
133+
* link:jakarta-ee.html[Apache Shiro Jakarta EE Integration Guide]
134+
135+
== Complete Example Project
136+
137+
Here is a minimal `pom.xml` for a Jakarta EE web application with Shiro security:
138+
139+
[source,xml]
140+
----
141+
<?xml version="1.0" encoding="UTF-8"?>
142+
<project xmlns="http://maven.apache.org/POM/4.0.0"
143+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
144+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
145+
https://maven.apache.org/xsd/maven-4.0.0.xsd">
146+
<modelVersion>4.0.0</modelVersion>
147+
148+
<groupId>com.example</groupId>
149+
<artifactId>shiro-jakarta-demo</artifactId>
150+
<version>1.0-SNAPSHOT</version>
151+
<packaging>war</packaging>
152+
153+
<properties>
154+
<maven.compiler.source>17</maven.compiler.source>
155+
<maven.compiler.target>17</maven.compiler.target>
156+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
157+
</properties>
158+
159+
<dependencies>
160+
<!-- Jakarta EE API -->
161+
<dependency>
162+
<groupId>jakarta.platform</groupId>
163+
<artifactId>jakarta.jakartaee-api</artifactId>
164+
<version>10.0.0</version>
165+
<scope>provided</scope>
166+
</dependency>
167+
168+
<!-- Shiro Jakarta EE - All-in-one dependency -->
169+
<dependency>
170+
<groupId>com.flowlogix.depchain</groupId>
171+
<artifactId>shiro-jakarta</artifactId>
172+
<version>11</version>
173+
<type>pom</type>
174+
</dependency>
175+
</dependencies>
176+
177+
<build>
178+
<finalName>${project.artifactId}</finalName>
179+
</build>
180+
</project>
181+
----
182+
183+
== Migrating from BOM to Dependency Chain
184+
185+
To migrate an existing project from the traditional BOM approach:
186+
187+
1. Remove the `shiro-bom` import from `<dependencyManagement>`
188+
2. Remove individual Shiro dependency declarations
189+
3. Add the single `shiro-jakarta` dependency chain
190+
4. Remove any manually specified `jakarta` classifiers
191+
192+
The dependency chain automatically handles classifier configuration and ensures all required components are included with compatible versions.

‎src/site/content/jakarta-ee.adoc‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,30 @@ Jakarta EE module depends on CDI and Jax-RS submodules to fully integrate with t
3939
In addition to all Shiro annotations, Jakarta EE module allows to specify Jakarta EE security annotations such as `@RolesAllowed`, `@DenyAll` and `@PermitAll` on your beans
4040

4141
=== How to use Jakarta 9+ (jakarta.* namespace)
42-
Use the Shiro artifacts with Jakarta classifiers:
42+
43+
There are two approaches to include Shiro Jakarta EE dependencies in your project:
44+
45+
==== Option 1: FlowLogix Dependency Chain (Recommended)
46+
47+
The simplest approach is to use the FlowLogix dependency chain, which bundles all required Shiro Jakarta EE components in a single dependency:
48+
49+
[source,xml]
50+
----
51+
<dependencies>
52+
<dependency>
53+
<groupId>com.flowlogix.depchain</groupId>
54+
<artifactId>shiro-jakarta</artifactId>
55+
<version>11</version>
56+
<type>pom</type>
57+
</dependency>
58+
</dependencies>
59+
----
60+
61+
This approach automatically includes all Shiro modules (`shiro-core`, `shiro-web`, `shiro-jakarta-ee`, `shiro-cdi`, `shiro-jaxrs`) with the correct Jakarta classifier, plus required dependencies like OmniFaces. See the link:dependency-chain.html[Dependency Chain Guide] for more details, Gradle examples, and migration instructions.
62+
63+
==== Option 2: Traditional BOM with Individual Dependencies
64+
65+
Alternatively, use the Shiro artifacts with Jakarta classifiers directly:
4366
[source,xml]
4467
----
4568
<dependency>

0 commit comments

Comments
 (0)