@Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        Subject subject = SecurityUtils.getSubject();

        // pre-check
        if (!subject.isAuthenticated()) {
            log.error("The request should be authed before tenant authentication, user:{}, path:{}",
                    subject.getPrincipal(),
                    httpServletRequest.getServletPath());
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
            return;
        }

        // tenant auth
        UserInfo loginUserInfo = (UserInfo) subject.getPrincipal();
        String tenant = httpServletRequest.getHeader(BASIC_AUTH_TENANT_HEADER);
        try {
            Preconditions.expectNotBlank(tenant, "tenant should not be null or blank");
            subject.login(new TenantToken(loginUserInfo.getName(), tenant));
        } catch (Exception ex) {
            log.error("tenant auth error: {}", ex.getMessage());
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN, ex.getMessage());
            return;
        }

        // check tenant auth result
        if (!subject.isAuthenticated()) {
            log.error("Access denied for user:{}, tenant:{}, path:{} ", subject.getPrincipal(), tenant,
                    httpServletRequest.getServletPath());
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN);
            return;
        }

        // next filter
        chain.doFilter(request, response);
    }
Shiro filter to check if the request user has the permission to target tenant.
inlong-manager/manager-web/src/main/java/org/apache/inlong/manager/web/auth/tenant/TenantAuthenticatingFilter.java