Using FlowLogix Dependency Chains with Apache Shiro

Managing Apache Shiro dependencies in Jakarta EE projects can be simplified using the FlowLogix Dependency Chains. This approach provides a cleaner alternative to managing the BOM (Bill of Materials) directly, reducing configuration complexity and common errors.

This guide is intended for Jakarta EE projects using Apache Shiro for security.

For Spring / SpringBoot projects, you need to use a traditional BOM approach

FlowLogix provides pre-configured Maven dependency chains that bundle related dependencies together. For Apache Shiro with Jakarta EE, the shiro-jakarta module includes all necessary Shiro components with the correct Jakarta classifier, eliminating the need to declare each dependency individually.

Traditional BOM usage requires importing the BOM in <dependencyManagement> and then declaring each individual dependency. This approach can lead to:

• Forgetting to include required transitive dependencies

• Inconsistent versions when mixing dependencies

• Verbose configuration with multiple dependency declarations

• Missing the jakarta classifier on artifacts

The dependency chain approach bundles everything you need in a single dependency, automatically including:

• shiro-core (jakarta classifier)

• shiro-web (jakarta classifier)

• shiro-jakarta-ee (jakarta classifier)

• shiro-cdi (jakarta classifier)

• shiro-jaxrs (jakarta classifier)

• commons-configuration2

• omnifaces

Using the Dependency Chain (Recommended)

<dependencies>
 <dependency>
 <groupId>com.flowlogix.depchain</groupId>
 <artifactId>shiro-jakarta</artifactId>
 <!-- replace LATEST with a version number -->
 <version>LATEST</version>
 </dependency>
</dependencies>

Comparison with Traditional BOM Approach

<!-- Traditional BOM Approach (more verbose) -->
<dependencyManagement>
 <dependencies>
 <dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-bom</artifactId>
 <version>2.2.1</version>
 <scope>import</scope>
 <type>pom</type>
 </dependency>
 </dependencies>
</dependencyManagement>
<dependencies>
 <dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-jakarta-ee</artifactId>
 <classifier>jakarta</classifier>
 </dependency>
 <dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-cdi</artifactId>
 <classifier>jakarta</classifier>
 </dependency>
 <dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-core</artifactId>
 <classifier>jakarta</classifier>
 </dependency>
 <dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-web</artifactId>
 <classifier>jakarta</classifier>
 </dependency>
 <dependency>
 <groupId>org.omnifaces</groupId>
 <artifactId>omnifaces</artifactId>
 <version>LATEST</version>
 </dependency>
</dependencies>

Using the Dependency Chain

dependencies {
 // replace LATEST with a version number
 implementation platform('com.flowlogix.depchain:shiro-jakarta:LATEST')
}

dependencies {
 // replace LATEST with a version number
 implementation(platform("com.flowlogix.depchain:shiro-jakarta:LATEST"))
}

• FlowLogix Dependency Chains Documentation

• Dependency Chain - GitHub Repository

• FlowLogix Base POM - GitHub Repository

• FlowLogix Jakarta EE Components - GitHub Repository

• Apache Shiro Jakarta EE Integration Guide

You can create a complete, testable project using the FlowLogix Starter that supports Shiro with Jakarta EE, Jakarta Faces, PrimeFaces, and Omnifaces.

Here is a minimal pom.xml for a Jakarta EE web application with Shiro security:

To migrate an existing project from the traditional BOM approach:

1. Remove the shiro-bom import from <dependencyManagement>

2. Remove individual Shiro dependency declarations

3. Add the single shiro-jakarta dependency chain

4. Remove any manually specified jakarta classifiers

The dependency chain automatically handles classifier configuration and ensures all required components are included with compatible versions.