You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Morten Andersen <bl...@blobcom.com> on 2006/02/28 13:48:19 UTC
Finegrained access control
How do you implement fine-grained access control?
For a project I need to implement a fine-grained access control. My idea
is to let a JDBC-Realm handle the login and to implement the
fine-grained access-control where the role may vary for the specific
users and the pages they look at.
This I would implement in RequestProcessor.processActionPerform(...)
where I check the users role for the specific page and based on that get
the respons taylored for that role and check whether they may do what
they intend.
Example: Some users may edit a page. Who that may edit the page varies
over time. The users role on the page is set per page.
As far as I understand Realm only checks whether the user may use a
specific method (action). No finegrained access-control is possible.
I'm surely not the first to do something like this. So please enlighten
me with ideas on how you'd implement this.
Morten Andersen
Denmark
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Finegrained access control
Posted by Mark Lowe <me...@gmail.com>.
On 2/28/06, Dave Newton <ne...@pingsite.com> wrote:
> Morten Andersen wrote:
> > Now if I can determine whether the user has logged in. How can I use
> > the request parameters to determine the users role on specific pages?
> > I know that I can invent my own control, it just seems like something
> > many others would need. Any tools available?
You'll know the user is logged in otherwise s/he can only see the login page.
When you login to a realm, non matter what you're using to login (jaas
module, jdbc/datasource realm auth, ldap) whatever, the authenticator
has to but a security principal in the user's session that must be
accessible by request.getUserPrincipal() also request.isUserInRole()
(or some jazz llike that).
First make sure you login is all working and then in you welcome page
do something like
<%= request.getUserPrincipal() %> if it works it should give you a
toString representation of a class that implements principal.. In
tomcat its something like GenericUserPrincipal.. Assuming you;ve used
a jbdc or datasource realm and the query works etc and so on the
Principal has the roles listed from the relevant query..
Get this far and you're done, you can use finer grained control (which
roles can do which actions in struts config).
<action path="/foo" roles="manager,slave" ..
Mark
>
> I still don't get this: why would you want request parameters to have
> anything to do with determining security/access levels? That seems
> really dangerous.
>
> Are you talking about adding request _attributes_ to determine view issues?
>
> Dave
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Finegrained access control
Posted by Morten Andersen <bl...@blobcom.com>.
Dave Newton skrev:
> Morten Andersen wrote:
>
>> Now if I can determine whether the user has logged in. How can I use
>> the request parameters to determine the users role on specific pages?
>> I know that I can invent my own control, it just seems like something
>> many others would need. Any tools available?
>>
>
> I still don't get this: why would you want request parameters to have
> anything to do with determining security/access levels? That seems
> really dangerous.
>
Here's an example:
The user: "Peter" may edit the page "Home". On all other pages he just
sees the page but on "Home" an extra button is added: "Edit this page".
Then when Peter presses that button he is brought to the editing page.
There he can edit the page but only if his role is really "editor" on
that page.
Not all users may use an action on all pages.
I use Realm to figure out whether the user has logged in by putting the
action that brings the user to the editing page under security
restriction, but it just doesn't handle the handle the finer-grained
access control where I can match a page and a user to check the users
role on that specific page.
Why is this dangerous?
How can I avoid these dangers?
Morten
> Are you talking about adding request _attributes_ to determine view issues?
>
> Dave
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Finegrained access control
Posted by Dave Newton <ne...@pingsite.com>.
Morten Andersen wrote:
> Now if I can determine whether the user has logged in. How can I use
> the request parameters to determine the users role on specific pages?
> I know that I can invent my own control, it just seems like something
> many others would need. Any tools available?
I still don't get this: why would you want request parameters to have
anything to do with determining security/access levels? That seems
really dangerous.
Are you talking about adding request _attributes_ to determine view issues?
Dave
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Finegrained access control
Posted by Morten Andersen <bl...@blobcom.com>.
Mark Lowe skrev:
> On 2/28/06, Emmanouil Batsis <Em...@eurodyn.com> wrote:
>
>> Dave Newton wrote:
>>
>>
>>> If you want _fine_-grained access control drop Spring on top of Struts
>>> and use Acegi.
>>>
>>>
>>>
>> For us not wanting to put yet another framework into the table, any
>> advice and pointers from more experienced people out there?
>>
>> My usual requirement is operation rights for roles in groups (due to
>> resources belonging to groups) and i am currently trying to fit JAAS
>> into the picture and take advantage of doclet etc, but i still havent
>> even scratched the surface on this one.
>>
>
> JAAS can be complex.... Sounds like the problem is do to with realm
> configuration and how to use the servlet spec security model.. A JDBC
> or DataSource realm will fit most requirements, rather than getting
> bogged down in Jaas.
>
> http://tomcat.apache.org/tomcat-5.0-doc/realm-howto.html
>
OK. I'm currently using Realm almost like suggested by Mark. The only
exception is that I only let some of the actions be under security. In
practice this means that I can show something (like a website) for
people that are not logged in while only showing the editor-buttons to
people that are logged in.
Now if I can determine whether the user has logged in. How can I use the
request parameters to determine the users role on specific pages? I know
that I can invent my own control, it just seems like something many
others would need. Any tools available?
Morten
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Finegrained access control
Posted by Mark Lowe <me...@gmail.com>.
On 2/28/06, Emmanouil Batsis <Em...@eurodyn.com> wrote:
> Dave Newton wrote:
>
> >If you want _fine_-grained access control drop Spring on top of Struts
> >and use Acegi.
> >
> >
>
> For us not wanting to put yet another framework into the table, any
> advice and pointers from more experienced people out there?
>
> My usual requirement is operation rights for roles in groups (due to
> resources belonging to groups) and i am currently trying to fit JAAS
> into the picture and take advantage of doclet etc, but i still havent
> even scratched the surface on this one.
JAAS can be complex.... Sounds like the problem is do to with realm
configuration and how to use the servlet spec security model.. A JDBC
or DataSource realm will fit most requirements, rather than getting
bogged down in Jaas.
http://tomcat.apache.org/tomcat-5.0-doc/realm-howto.html
Once the context is configured you need to tell your webapp what to do
in web.xml..
<security-constraint>
<display-name>Access control</display-name>
<web-resource-collection>
<web-resource-name>Protected Area</web-resource-name>
<url-pattern>/*</url-pattern>
<http-method>DELETE</http-method>
<http-method>GET</http-method>
<http-method>POST</http-method>
<http-method>PUT</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<realm-name>myrealm</realm-name>
<form-login-config>
<form-login-page>/login.html</form-login-page>
<form-error-page>/loginError.html</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>user</role-name>
</security-role>
The fields in your html form must follow the spec (action, and field
names) to work with the realm stuff.
<form action="j_security_check" method="POST">
<input type="text" name="j_username" />
<input type="text" name="j_password" />
</form>
Mark
>
> Manos
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Finegrained access control
Posted by Emmanouil Batsis <Em...@eurodyn.com>.
Dave Newton wrote:
>If you want _fine_-grained access control drop Spring on top of Struts
>and use Acegi.
>
>
For us not wanting to put yet another framework into the table, any
advice and pointers from more experienced people out there?
My usual requirement is operation rights for roles in groups (due to
resources belonging to groups) and i am currently trying to fit JAAS
into the picture and take advantage of doclet etc, but i still havent
even scratched the surface on this one.
Manos
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Finegrained access control
Posted by Morten Andersen <bl...@blobcom.com>.
Dave Newton skrev:
> Morten Andersen wrote:
>
>> This I would implement in RequestProcessor.processActionPerform(...)
>> where I check the users role for the specific page and based on that get
>> the respons taylored for that role and check whether they may do what
>> they intend.
>>
>
> RequestProcessor.processRoles?
>
The role thing should be used for 2 things:
* Access control. May the user submit or view a page?
* View control. The role decides what the user sees.
>> Example: Some users may edit a page. Who that may edit the page varies
>> over time. The users role on the page is set per page.
>>
>> As far as I understand Realm only checks whether the user may use a
>> specific method (action). No finegrained access-control is possible.
>>
>
> How fine-grained do you want it? If the Realm stuff allows method-level
> access that seems finer-grain than URL, but I think I'm just not
> completely understanding your question.
>
In the web.xml I can set some security constraints for URL patterns. I
basically want to use some request parameters to determine the role.
> If you want _fine_-grained access control drop Spring on top of Struts
> and use Acegi.
>
I'll look into that.
> Dave
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
> For additional commands, e-mail: user-help@struts.apache.org
>
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: Finegrained access control
Posted by Dave Newton <ne...@pingsite.com>.
Morten Andersen wrote:
> This I would implement in RequestProcessor.processActionPerform(...)
> where I check the users role for the specific page and based on that get
> the respons taylored for that role and check whether they may do what
> they intend.
RequestProcessor.processRoles?
>
> Example: Some users may edit a page. Who that may edit the page varies
> over time. The users role on the page is set per page.
>
> As far as I understand Realm only checks whether the user may use a
> specific method (action). No finegrained access-control is possible.
How fine-grained do you want it? If the Realm stuff allows method-level
access that seems finer-grain than URL, but I think I'm just not
completely understanding your question.
If you want _fine_-grained access control drop Spring on top of Struts
and use Acegi.
Dave
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org