anchor.diff:  
   * the Shiro realm module (`isis-extensions-secman-shiro-realm`) provides the Shiro realm interface that delegates to the Secman database (see discussion <<shiro-integration,above>>)
   
  -* the jbcrypt encryption module (`isis-extensions-secman-encryption-jbcrypt`) provides an implementation of Secman's xref:refguide:extensions:index/secman/api/encryption/PasswordEncryptionService.adoc[PasswordEncryptionService] so that passwords are persisted securely using link:https://www.mindrot.org/projects/jBCrypt/[jBCrypt].
  -
  +* the jbcrypt encryption module (`isis-extensions-secman-encryption-jbcrypt`) provides an implementation of Secman's xref:refguide:extensions:index/secman/applib/user/spi/PasswordEncryptionService.adoc[PasswordEncryptionService] so that passwords are persisted securely using link:https://www.mindrot.org/projects/jBCrypt/[jBCrypt].
  +
  
positive.code: * The `AuthenticatorShiro` calls to the Shiro Security Manager to obtain the authenticated principal.
  * The Shiro Security Manager uses the `shiro.ini` configuration file to look up the realm to perform the authentication; in this case we configure it to use Secman's realm (xref:refguide:extensions:index/secman/shiro/IsisModuleExtSecmanShiroRealm.adoc[IsisModuleExtSecmanShiroRealm]).
  * Secman's realm implementation queries the database and uses this to create an instance of `PrincipalForApplicationUser`, where the `Principal` interface is Shiro's representation of an authenticated user.
  The `PrincipalForApplicationUser` is backed by xref:refguide:extensions:index/secman/api/user/dom/ApplicationUser.adoc[ApplicationUser], which all of the permissions to object members for this particular user.
  * to render a page, the Apache Isis viewer uses configured `Authorizor`, in this case
  Secman's own xref:refguide:extensions:index/secman/api/authorizor/AuthorizorSecman.adoc[AuthorizorSecman].
  This looks up the current xref:refguide:extensions:index/secman/api/user/dom/ApplicationUser.adoc[ApplicationUser] (which will already reside in-memory) and renders the page according to which object members are visible or not.
  
  
  The above configuration allows Secman to be used to authenticate users; the password is stored as an (typically) encrypted property of the xref:refguide:extensions:index/secman/api/user/dom/ApplicationUser.adoc[ApplicationUser].
  These are called "local" users, as per the xref:refguide:extensions:index/secman/api/user/dom/ApplicationUser.adoc[ApplicationUser]'s `accountType` property.
  
  Secman's xref:refguide:extensions:index/secman/shiro/IsisModuleExtSecmanShiroRealm.adoc[Realm implementation] also allows a "delegate" realm to be configured.
  In such cases the authentication of "delegated" users is performed by the delegate realm rather than locally.
  
negative.code: 
  Thus:
  
  * a user (represented by xref:refguide:extensions:index/secman/applib/user/dom/ApplicationUser.adoc[ApplicationUser]) can belong to many roles (xref:refguide:extensions:index/secman/applib/role/dom/ApplicationRole.adoc[ApplicationRole])
  * a role in turn holds a set of permissions (xref:refguide:extensions:index/secman/applib/permission/dom/ApplicationPermission.adoc[ApplicationPermission]).
  Each such permission is either an ``ALLOW`` or a ``VETO`` to an application feature, represented by a fully qualified name
  * this resolves to an xref:refguide:applib:index/services/appfeat/ApplicationFeatureId.adoc[ApplicationFeatureId] (from the core metamodel).
  That feature will be either a namespace, a type or a member.
  +
  The core metamodel also provides xref:refguide:applib:index/services/appfeat/ApplicationFeature.adoc[ApplicationFeature] (each being identified with an xref:refguide:applib:index/services/appfeat/ApplicationFeatureId.adoc[ApplicationFeatureId] that makes it easier to navigate around the application feature hierarchy.
  
  The domain model also shows the xref:refguide:extensions:index/secman/applib/tenancy/spi/ApplicationTenancyEvaluator.adoc[ApplicationTenancyEvaluator] interface and xref:refguide:extensions:index/secman/applib/tenancy/dom/ApplicationTenancy.adoc[ApplicationTenancy] entity.
  These are to support multitenancy, discussed in the section <<Multitenancy,below>>.
  
  
  