Users, Roles & Access Control in Struts Applications - Where to get information?

[Tom Bednarz <li...@bednarz.ch>]

Hello,

I need some pointers and information about the assignment and management 
of users and roles in a Struts based web application.

I currently run that application (Struts 1.0 and Velocity) with very 
limited control over WHO is allowed to do WHAT. Currently I only have 
three roles and all I do after logon is to present a different menu for 
each user role. All of that is hard-coded. I need more flexibility, 
security and a mechanism to define and assign new roles quickly.

The application  has  several  datasources:

- database (Sybase SQL)
- several CORBA servers providing services and access to data

I plan to update to Struts 1.1. When reading parts of the documentation 
I learned that there is now support for role-checking on Action-level. I 
should also have a menu, that supports roles (an administrator sees 
different things than a normal user etc...)

Since a database that allows me to extend the datamodel is part of the 
whole system, I prefer storing information about users, groups and their 
roles in that database.

Authentication is done by a login-check on a Windows NT or Active 
Directory domain (I have written sprecific CORBA servers with a JavaBean 
based client). Currently the users get a login form where they can 
select where to login (NT or any Active Directory Domain [W2K or W2K3 
domain controlers]). During the login operation I check some memberships 
in specific groups on NT / W2K / W2K3 to find out a 'role' of a user. I 
am looking for an OS-independant solution.

Questions:
========

1) How are Roles defined? Where are they stored?
   I don't want these things stored in a XML file. Is there a way to 
store these things in a database? Is there any documentation about a 
datamodel (Fields, datatypes etc)

2) How are roles assigned to users or groups of users? Where are these 
assignments stored? Basically roles should be assigned to groups. Users 
will then join or leave groups with specific privileges.

3) What do I need to do in Struts to configure all this? I read that 
since 1.1 I can define a role property in ActionMappings. How and 
against what is that definition verified? Are there any standard/basic 
mechanisms that can be extended ?

4) Is there any menu system available, that supports roles and can be 
integrated in a Struts based application?

5) Are there any special considerations when moving from Struts 1.0 to 
1.1? With other words, is the code backward compatible or will my 
working code for 1.0 not work anymore on 1.1?


Many thanks for any help, suggestions and resources for further 
information on the above topics.

Thomas


---------------------------------------------------------------------
To unsubscribe, e-mail: struts-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: struts-user-help@jakarta.apache.org