ddd4j-boot Auth

Overview

Covers Sa-Token, Shiro, Spring Security, SubjectProvider, exceptions, and request cleanup uniformly, not split per artifact. Before use, confirm the maintenance line through ddd4j-boot-version-selection.

When to Use

• Choosing among Sa-Token, Apache Shiro, and Spring Security for a ddd4j-boot service and assembling it through the boot auth auto-configuration.
• Wiring a SubjectProvider so the ddd4j Subject contract is populated from the chosen security framework.
• Mapping authentication exceptions (expired token, insufficient role) onto the web error contract.
• Auditing request cleanup — that tokens and Subject state do not leak across pooled request threads.
• Configuring or overriding the auth defaults (user beans versus @ConditionalOnMissingBean defaults) on a specific Boot line (2.3–4.1).
• Verifying the full auth behavior matrix: anonymous, valid, expired, insufficient-role, logout, and thread reuse.

When NOT to Use

Do not use this skill when: