title: Apache Shiro, INI-Configuration, Perms per URL: How to get URL params?
body: <p>I want to use <a href="https://shiro.apache.org" rel="nofollow noreferrer" title="Apache Shiro">Apache Shiro</a> in my JSF-Application to perform URL-based authorization checks, configuration done in shiro.ini As I see in the <a href="https://shiro.apache.org/web.html#Web-webini" rel="nofollow noreferrer">Shiro-documentation</a> there is a way to use a "perms"-filter</p>
  
  <pre><code>/remoting/rpc/** = authc, perms["remote:invoke"]
  </code></pre>
  
  <p>In my scenario I want this functionality, but on entity-level<a href="https://shiro.apache.org" rel="nofollow noreferrer" title="Apache Shiro">1</a>, where the entity-Id is in the http-request </p>
  
  <pre><code># "Open settings for user with id=123":
  # /user/settings.xhtml?user_id=123
  /user/settings.xhtml = perms["user:update:XXX"]
  </code></pre>
  
  <p>So, how do I do this with Shiro? How to I tell the perms-filter to check for http-params? Or is this supposed to be done in my Realm-Implemenation, concrete by calling FacesContext?</p>
  
  <p><a href="https://shiro.apache.org" rel="nofollow noreferrer" title="Apache Shiro">1</a> This can be done at least programmatically:</p>
  
  <pre><code>SecurityUtils.getSubject().isPermitted("printer:query:lp7200")
  </code></pre>
  
  <p><a href="https://shiro.apache.org/permissions.html" rel="nofollow noreferrer">https://shiro.apache.org/permissions.html</a></p>