You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@cayenne.apache.org by Carl Mosca <ca...@gmail.com> on 2007/01/31 15:23:46 UTC
security
I am wondering about security (user, query, role level). What approaches
have been taken by those using ROP for a some time?
TIA,
--
Carl J. Mosca
Re: security
Posted by Aristedes Maniatis <ar...@ish.com.au>.
On 01/02/2007, at 12:11 PM, Carl Mosca wrote:
> Your app makes me wonder how cayenne handles views.
Our application uses the essence of a MVC framework, however we have
created our own basic GUI elements subclassing JTextArea, JButton,
etc, etc. These components have additional property keys which we set
(using the Netbeans Matisse Swing editor) to tie them back to Cayenne
field property keys. Of course events and controllers hold all this
glue together. So, because each GUI component 'knows' what Cayenne
field it maps to, lots of interesting functionality is possible,
including validation display and formatting.
So we could very easily map access control onto these fields without
much drama, but I just can't see how that translates to a usable GUI
with various fields missing or greyed out depending on access rights
to that component. Better for us to look at security from a GUI
perspective (tabs, panels, etc) and be diligent about testing how
that access is enabled across the application. This means that it
effectively has nothing to do with Cayenne.
Ari Maniatis
-------------------------->
ish
http://www.ish.com.au
Level 1, 30 Wilson Street Newtown 2042 Australia
phone +61 2 9550 5001 fax +61 2 9550 4001
GPG fingerprint CBFB 84B4 738D 4E87 5E5C 5EFA EF6A 7D2E 3E49 102A
Re: security
Posted by Carl Mosca <ca...@gmail.com>.
Ari,
Thanks much. First off the apps are Swing so your example is very helpful.
I looked at cayenne a while back but I am only recently revisiting it so I
need to build a proof-of-concept before I can digest all that's been said so
far.
Your app makes me wonder how cayenne handles views.
Carl
On 1/31/07, Aristedes Maniatis <ar...@ish.com.au> wrote:
>
>
> On 01/02/2007, at 1:23 AM, Carl Mosca wrote:
>
> > I am wondering about security (user, query, role level). What
> > approaches
> > have been taken by those using ROP for a some time?
>
> We are implementing this in our Swing (Cayenne ROP) application at
> the moment. The best framework we've seen is the acegisecurity
> library. Quite robust and very useful. In our case though it is not
> quite what we need so we are going to roll our own using some ideas
> from that library.
>
> We've found in our Swing app that we want to tie security to GUI
> widgets and not database entities. In other words, we thought about
> security at a Cayenne level which would have been quite easy once
> https://issues.apache.org/cayenne/browse/CAY-400 gave us user
> definable properties. However we had major issues about how that
> would map to the GUI. We want some users to be able to edit students
> in our system, but not to be able to see certain financial data
> related to that student. They might be able to see other financial
> data relating to courses though. It wasn't possible to express this
> as a simple set of table or field properties at the Cayenne level.
>
> So the approach we are taking is to relate security to Swing panels
> and tabs, creating add/edit/view type rights which automatically flow
> down to the editable fields within those panels.
>
> You didn't mention whether your app was Swing or web based...
>
>
> Cheers
> Ari Maniatis
>
>
>
> -------------------------->
> ish
> http://www.ish.com.au
> Level 1, 30 Wilson Street Newtown 2042 Australia
> phone +61 2 9550 5001 fax +61 2 9550 4001
> GPG fingerprint CBFB 84B4 738D 4E87 5E5C 5EFA EF6A 7D2E 3E49 102A
>
>
>
>
>
--
Carl J. Mosca
Re: security
Posted by Andrew Lindesay <ap...@lindesay.co.nz>.
Hello;
This was the same kind of problem I envisaged being the case with a
similar technology -- WebObjects. I know this isn't a WebObjects
list, but I _think_ the same principals may apply. I can't see how,
at the application-server side that you can control authorisation
around data access if data access is automatically vended for an
object-graph over the wire. You do want to control security at the
user interface level as well of course or it would be confusing for
the users, but it would not seem to me to be good to rely on the
clients always being well behaved or not having security-related bugs.
At a basic level; in my applications, I have employed the application-
server as a JSON-RPC provider with various end-points and methods to
be accessed from JSON-RPC clients. Some of the methods require a
session to access and thus can keep an object-graph between requests
on the server-side. Each method has some sort of logic (factored out
or not) to check authorisation (nearly always using the session in
some way) in order to process some inbound request. If data objects
are returned to the client from methods then they are serialised into
JSON and the client is able to communicate back to the server using
global-ids. This approach works well for me _so_far_ although I am
sure it's not exactly the same level of elegance of having the object-
graph in the client-side.
cheers.
>> I am wondering about security (user, query, role level). What
>> approaches
>> have been taken by those using ROP for a some time?
>
> We are implementing this in our Swing (Cayenne ROP) application at
> the moment. The best framework we've seen is the acegisecurity
> library. Quite robust and very useful. In our case though it is not
> quite what we need so we are going to roll our own using some ideas
> from that library.
>
> We've found in our Swing app that we want to tie security to GUI
> widgets and not database entities. In other words, we thought about
> security at a Cayenne level which would have been quite easy once
> https://issues.apache.org/cayenne/browse/CAY-400 gave us user
> definable properties. However we had major issues about how that
> would map to the GUI. We want some users to be able to edit
> students in our system, but not to be able to see certain financial
> data related to that student. They might be able to see other
> financial data relating to courses though. It wasn't possible to
> express this as a simple set of table or field properties at the
> Cayenne level.
>
> So the approach we are taking is to relate security to Swing panels
> and tabs, creating add/edit/view type rights which automatically
> flow down to the editable fields within those panels.
>
> You didn't mention whether your app was Swing or web based...
___
Andrew Lindesay
www.lindesay.co.nz
Re: security
Posted by Aristedes Maniatis <ar...@ish.com.au>.
On 01/02/2007, at 1:23 AM, Carl Mosca wrote:
> I am wondering about security (user, query, role level). What
> approaches
> have been taken by those using ROP for a some time?
We are implementing this in our Swing (Cayenne ROP) application at
the moment. The best framework we've seen is the acegisecurity
library. Quite robust and very useful. In our case though it is not
quite what we need so we are going to roll our own using some ideas
from that library.
We've found in our Swing app that we want to tie security to GUI
widgets and not database entities. In other words, we thought about
security at a Cayenne level which would have been quite easy once
https://issues.apache.org/cayenne/browse/CAY-400 gave us user
definable properties. However we had major issues about how that
would map to the GUI. We want some users to be able to edit students
in our system, but not to be able to see certain financial data
related to that student. They might be able to see other financial
data relating to courses though. It wasn't possible to express this
as a simple set of table or field properties at the Cayenne level.
So the approach we are taking is to relate security to Swing panels
and tabs, creating add/edit/view type rights which automatically flow
down to the editable fields within those panels.
You didn't mention whether your app was Swing or web based...
Cheers
Ari Maniatis
-------------------------->
ish
http://www.ish.com.au
Level 1, 30 Wilson Street Newtown 2042 Australia
phone +61 2 9550 5001 fax +61 2 9550 4001
GPG fingerprint CBFB 84B4 738D 4E87 5E5C 5EFA EF6A 7D2E 3E49 102A
Re: security
Posted by Andrus Adamchik <an...@objectstyle.org>.
On Jan 31, 2007, at 4:40 PM, Juergen Saar wrote:
> What I'm still missing are user-depended DataNodes ...
> we have several installations with usergroups with different databases
DataDomains were initially intended to address that. With some manual
metadata manipulation, this is still a great option (ROP or server-
side - all the same). I have a few ideas in mind to make DataDomain
concept really useful, still not sure how much demand there is to
implement non-ROP security at the ORM level.
Andrus
Re: security
Posted by Juergen Saar <ju...@jsaar.org>.
I fear you will be shocked ...
We use cayenne for our web-applications
and configure one seperate host in tomcat for each database we need.
Each of this hosts has it's own cayenne.xml where the *.map.xml are
symbolic links and the *.driver.xml are special.
Our login-routine is driven by a xindice-database
and from there redirected to the url leading to the
satisfying host for this user.
So we have no special Configuration handling to implement
but some more installation and configuration needs.
2007/1/31, Carl Mosca <ca...@gmail.com>:
>
> Juergen,
>
> Can you elaborate on what you have done?
>
> Carl
>
> On 1/31/07, Juergen Saar <ju...@jsaar.org> wrote:
> >
> > What I'm still missing are user-depended DataNodes ...
> > we have several installations with usergroups with different databases
> >
> > 2007/1/31, Carl Mosca <ca...@gmail.com>:
> > >
> > > I am wondering about security (user, query, role level). What
> > approaches
> > > have been taken by those using ROP for a some time?
> > >
> > > TIA,
> > > --
> > > Carl J. Mosca
> > >
> >
> >
>
>
> --
> Carl J. Mosca
>
>
Re: security
Posted by Carl Mosca <ca...@gmail.com>.
Juergen,
Can you elaborate on what you have done?
Carl
On 1/31/07, Juergen Saar <ju...@jsaar.org> wrote:
>
> What I'm still missing are user-depended DataNodes ...
> we have several installations with usergroups with different databases
>
> 2007/1/31, Carl Mosca <ca...@gmail.com>:
> >
> > I am wondering about security (user, query, role level). What
> approaches
> > have been taken by those using ROP for a some time?
> >
> > TIA,
> > --
> > Carl J. Mosca
> >
>
>
--
Carl J. Mosca
Re: security
Posted by Juergen Saar <ju...@jsaar.org>.
What I'm still missing are user-depended DataNodes ...
we have several installations with usergroups with different databases
2007/1/31, Carl Mosca <ca...@gmail.com>:
>
> I am wondering about security (user, query, role level). What approaches
> have been taken by those using ROP for a some time?
>
> TIA,
> --
> Carl J. Mosca
>
Re: security
Posted by Carl Mosca <ca...@gmail.com>.
Thanks much Andrus.
BTW, I am using trunk builds of 3.0 in production on a very active
> site since September. Runs rather smoothly, but of course I am
> responsible for fixing references to the new evolving API with every
> build upgrade.
>
>
>
--
Carl J. Mosca
Re: security
Posted by Andrus Adamchik <an...@objectstyle.org>.
On Jan 31, 2007, at 7:50 PM, Carl Mosca wrote:
> Is there a published timetable for 3.0?
We are preparing the first milestone (alpha) of 3.0. It should go out
pretty soon. Otherwise - no, there's no timetable (standard open
source disclaimer about volunteer labour goes here), but there is a
good idea of the scope.
BTW, I am using trunk builds of 3.0 in production on a very active
site since September. Runs rather smoothly, but of course I am
responsible for fixing references to the new evolving API with every
build upgrade.
Andrus
Re: security
Posted by Carl Mosca <ca...@gmail.com>.
Andrus,
Thank you. I'll take a look and see what I can come up with once I get
started.
Is there a published timetable for 3.0?
Carl
On 1/31/07, Andrus Adamchik <an...@objectstyle.org> wrote:
>
> Hi Carl,
>
> To be honest a few ROP projects that I've done used all-or-nothing
> security (if you are authenticated, you can do anything). Still I've
> been also thinking about more fine-grained approach. My solution
> would be to set up a custom 'org.apache.cayenne.DataChannel'
> decorator, adding custom security checks to 'onQuery()' and 'onSync'
> methods. In the simplest case, you can have the following security
> levels:
>
> 1. Restricted: only NamedQuery requests are honored, 'onSync' is denied.
> 2. Read-only: onQuery() allows all but SQLTemplate queries, 'onSync'
> is denied.
> 3. Full
> 4. Custom - check custom rules.
>
> Also I haven't yet explored the use of the new 3.0 callbacks as a
> security mechanism, probably there are some opportunities there:
>
> http://cayenne.apache.org/preview/CAYDOC/lifecycle-callbacks.html
>
> Andrus
>
>
> On Jan 31, 2007, at 4:23 PM, Carl Mosca wrote:
>
> > I am wondering about security (user, query, role level). What
> > approaches
> > have been taken by those using ROP for a some time?
> >
> > TIA,
> > --
> > Carl J. Mosca
>
>
--
Carl J. Mosca
Re: security
Posted by Andrus Adamchik <an...@objectstyle.org>.
Hi Carl,
To be honest a few ROP projects that I've done used all-or-nothing
security (if you are authenticated, you can do anything). Still I've
been also thinking about more fine-grained approach. My solution
would be to set up a custom 'org.apache.cayenne.DataChannel'
decorator, adding custom security checks to 'onQuery()' and 'onSync'
methods. In the simplest case, you can have the following security
levels:
1. Restricted: only NamedQuery requests are honored, 'onSync' is denied.
2. Read-only: onQuery() allows all but SQLTemplate queries, 'onSync'
is denied.
3. Full
4. Custom - check custom rules.
Also I haven't yet explored the use of the new 3.0 callbacks as a
security mechanism, probably there are some opportunities there:
http://cayenne.apache.org/preview/CAYDOC/lifecycle-callbacks.html
Andrus
On Jan 31, 2007, at 4:23 PM, Carl Mosca wrote:
> I am wondering about security (user, query, role level). What
> approaches
> have been taken by those using ROP for a some time?
>
> TIA,
> --
> Carl J. Mosca