You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by Steve Vanspall <st...@crmsoftware.com.au> on 2002/12/05 00:03:42 UTC
Restrict acces to certain pages/actions
Hi there,
I was wondering if struts had some mechanism to restrict acces according to
user level.
Basically our users may be of variying levels in our system. From customer
to administrator.
This is defined by a columns in a table in our database.
Each user should have differing levels of access to the web app.
For example a customer can change his/her setails, but not search/view any
other customer.
Naturally a customer also wont have access to the administration section of
the web-app.
I can code up a retriction system. But was wondering if struts already had
one that I could cutomise for my own needs.
Any help would be appreciated
Regards
Steve Vanspall
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Restrict acces to certain pages/actions
Posted by Eddie Bush <ek...@swbell.net>.
CMA is a J2EE standard - not container-specific at all. It's
implementation (how the information is made available) certainly may
vary from server to server :-( but the way you access it is the same -
regardless of your container. David brings up a hot topic - JAAS.
Also, please note that (I should have mentioned this earlier, but I
wasn't thinking) Max Cooper (I believe that is his name) has a security
filter which will make this information available - and wraps the
request, such that you basically have a completely container-independent
solution. The implementation proportedly allows calls to isUserInRole
etc - just as though you were using OEM CMA.
See securityfilter.sourceforge.net for more (requires servlet spec 2.3
or later [it is a filter, after all]).
HTH,
Eddie
(Because it's not "true" CMA, I'm not sure how your admin situation
would "act", but, as I recall, he paid a lot of attention to simulating
the J2EE standard as closely as he could [where it was desirable to do
so], so ... you should really check it out ;-)
Steve Vanspall wrote:
>yeah, no the admin section is fine.
>
>Pity struts doesn't have anything, in the process of a conversion from
>tomcat to websphere (business partnership thing), So I am trying to get away
>from any container specific configurations.
>
>
>
>-----Original Message-----
>From: Eddie Bush [mailto:ekbush@swbell.net]
>Sent: Thursday, 5 December 2002 11:06 AM
>To: Struts Users Mailing List
>Subject: Re: Restrict acces to certain pages/actions
>
>
>Struts doesn't provide any custom authentication/authorization mechanism
>-- make use of that which is provided by your servlet container (lookup
>container-managed authentication). Once this is done, Struts does
>provide you ways to build selective content, based upon the roles you've
>given to a user, through use of the taglibs etc.
>
>... so far as your administrative section goes - you can set it up such
>that it does not even exist for users that do not have the proper role.
> (... and I mean that quite literally - the server will return a 404 for
>unauthorized access!)
>
>Steve Vanspall wrote:
>
>
>
>>Hi there,
>>
>>I was wondering if struts had some mechanism to restrict acces according to
>>user level.
>>
>>Basically our users may be of variying levels in our system. From customer
>>to administrator.
>>
>>This is defined by a columns in a table in our database.
>>
>>Each user should have differing levels of access to the web app.
>>
>>For example a customer can change his/her setails, but not search/view any
>>other customer.
>>
>>Naturally a customer also wont have access to the administration section of
>>the web-app.
>>
>>I can code up a retriction system. But was wondering if struts already had
>>one that I could cutomise for my own needs.
>>
>>Any help would be appreciated
>>
>>Regards
>>
>>Steve Vanspall
>>
>>
>>
>--
>Eddie Bush
>
>
>
>
>--
>To unsubscribe, e-mail:
><ma...@jakarta.apache.org>
>For additional commands, e-mail:
><ma...@jakarta.apache.org>
>
>
>--
>To unsubscribe, e-mail: <ma...@jakarta.apache.org>
>For additional commands, e-mail: <ma...@jakarta.apache.org>
>
>
--
Eddie Bush
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Restrict acces to certain pages/actions
Posted by Steve Vanspall <st...@crmsoftware.com.au>.
yeah, no the admin section is fine.
Pity struts doesn't have anything, in the process of a conversion from
tomcat to websphere (business partnership thing), So I am trying to get away
from any container specific configurations.
-----Original Message-----
From: Eddie Bush [mailto:ekbush@swbell.net]
Sent: Thursday, 5 December 2002 11:06 AM
To: Struts Users Mailing List
Subject: Re: Restrict acces to certain pages/actions
Struts doesn't provide any custom authentication/authorization mechanism
-- make use of that which is provided by your servlet container (lookup
container-managed authentication). Once this is done, Struts does
provide you ways to build selective content, based upon the roles you've
given to a user, through use of the taglibs etc.
... so far as your administrative section goes - you can set it up such
that it does not even exist for users that do not have the proper role.
(... and I mean that quite literally - the server will return a 404 for
unauthorized access!)
Steve Vanspall wrote:
>Hi there,
>
>I was wondering if struts had some mechanism to restrict acces according to
>user level.
>
>Basically our users may be of variying levels in our system. From customer
>to administrator.
>
>This is defined by a columns in a table in our database.
>
>Each user should have differing levels of access to the web app.
>
>For example a customer can change his/her setails, but not search/view any
>other customer.
>
>Naturally a customer also wont have access to the administration section of
>the web-app.
>
>I can code up a retriction system. But was wondering if struts already had
>one that I could cutomise for my own needs.
>
>Any help would be appreciated
>
>Regards
>
>Steve Vanspall
>
--
Eddie Bush
--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Restrict acces to certain pages/actions
Posted by Eddie Bush <ek...@swbell.net>.
Struts doesn't provide any custom authentication/authorization mechanism
-- make use of that which is provided by your servlet container (lookup
container-managed authentication). Once this is done, Struts does
provide you ways to build selective content, based upon the roles you've
given to a user, through use of the taglibs etc.
... so far as your administrative section goes - you can set it up such
that it does not even exist for users that do not have the proper role.
(... and I mean that quite literally - the server will return a 404 for
unauthorized access!)
Steve Vanspall wrote:
>Hi there,
>
>I was wondering if struts had some mechanism to restrict acces according to
>user level.
>
>Basically our users may be of variying levels in our system. From customer
>to administrator.
>
>This is defined by a columns in a table in our database.
>
>Each user should have differing levels of access to the web app.
>
>For example a customer can change his/her setails, but not search/view any
>other customer.
>
>Naturally a customer also wont have access to the administration section of
>the web-app.
>
>I can code up a retriction system. But was wondering if struts already had
>one that I could cutomise for my own needs.
>
>Any help would be appreciated
>
>Regards
>
>Steve Vanspall
>
--
Eddie Bush
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Restrict acces to certain pages/actions
Posted by gus <gu...@gmx.net>.
Steve Vanspall schrieb:
> ahhh, that's what I was looking for, makes alot more sense. So does every
> user have to be entered into the tomcat-users.xml, or can you just define
> the user types there.
If your using the Tomcat MemoryRealm you have to enter all users in
tomcat-users.xml.
> Will look it up anyway, basically there could be any number of users in the
> database, one of a handful of role codes. So it would be great if I could
> dynamically implements the role based security.
I'm using the security filter from http://www.securityfilter.org/ and
wrote my own Active Directory (ADSI) Realm for it which takes the
Win2K groups as roles.
Regards
gus
> -----Original Message-----
> From: Craig R. McClanahan [mailto:craigmcc@apache.org]
> Sent: Thursday, 5 December 2002 11:26 AM
> To: Struts Users Mailing List
> Subject: Re: Restrict acces to certain pages/actions
>
>
>
>
> On Thu, 5 Dec 2002, Steve Vanspall wrote:
>
>
>>Date: Thu, 5 Dec 2002 10:03:42 +1100
>>From: Steve Vanspall <st...@crmsoftware.com.au>
>>Reply-To: Struts Users Mailing List <st...@jakarta.apache.org>
>>To: Struts User Mailing List <st...@jakarta.apache.org>
>>Subject: Restrict acces to certain pages/actions
>>
>>Hi there,
>>
>>I was wondering if struts had some mechanism to restrict acces according
>
> to
>
>>user level.
>>
>>Basically our users may be of variying levels in our system. From customer
>>to administrator.
>>
>>This is defined by a columns in a table in our database.
>>
>>Each user should have differing levels of access to the web app.
>>
>>For example a customer can change his/her setails, but not search/view any
>>other customer.
>>
>>Naturally a customer also wont have access to the administration section
>
> of
>
>>the web-app.
>>
>>I can code up a retriction system. But was wondering if struts already had
>>one that I could cutomise for my own needs.
>>
>
>
> The normal advice is to use the container managed security provided by
> your servlet container, and set things up so that your "user levels"
> correspond to "roles" in the security constraints. Then, you can use the
> "role" attribute on your <action> elements to restrict which users can
> actually call a particular action (i.e. your administrative ones), and/or
> use security constraints in the web.xml file to limit which JSP pages can
> be accessed based on role.
>
> How you map the container's security mechanisms to your database of users
> is container dependent. For example, if you're using Tomcat it's pretty
> easy to use JDBCRealm and configure it to talk to your user database
> tables when it authenticates users for you.
>
>
>>Any help would be appreciated
>>
>>Regards
>>
>>Steve Vanspall
>>
>
>
> Craig
>
>
> --
> To unsubscribe, e-mail:
> <ma...@jakarta.apache.org>
> For additional commands, e-mail:
> <ma...@jakarta.apache.org>
>
>
> --
> To unsubscribe, e-mail: <ma...@jakarta.apache.org>
> For additional commands, e-mail: <ma...@jakarta.apache.org>
>
>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
RE: Restrict acces to certain pages/actions
Posted by Steve Vanspall <st...@crmsoftware.com.au>.
ahhh, that's what I was looking for, makes alot more sense. So does every
user have to be entered into the tomcat-users.xml, or can you just define
the user types there.
Will look it up anyway, basically there could be any number of users in the
database, one of a handful of role codes. So it would be great if I could
dynamically implements the role based security.
'role based security' that was the term I was looking for. Probably would
have got here sooner if I had said that.
Regards
Steve
-----Original Message-----
From: Craig R. McClanahan [mailto:craigmcc@apache.org]
Sent: Thursday, 5 December 2002 11:26 AM
To: Struts Users Mailing List
Subject: Re: Restrict acces to certain pages/actions
On Thu, 5 Dec 2002, Steve Vanspall wrote:
> Date: Thu, 5 Dec 2002 10:03:42 +1100
> From: Steve Vanspall <st...@crmsoftware.com.au>
> Reply-To: Struts Users Mailing List <st...@jakarta.apache.org>
> To: Struts User Mailing List <st...@jakarta.apache.org>
> Subject: Restrict acces to certain pages/actions
>
> Hi there,
>
> I was wondering if struts had some mechanism to restrict acces according
to
> user level.
>
> Basically our users may be of variying levels in our system. From customer
> to administrator.
>
> This is defined by a columns in a table in our database.
>
> Each user should have differing levels of access to the web app.
>
> For example a customer can change his/her setails, but not search/view any
> other customer.
>
> Naturally a customer also wont have access to the administration section
of
> the web-app.
>
> I can code up a retriction system. But was wondering if struts already had
> one that I could cutomise for my own needs.
>
The normal advice is to use the container managed security provided by
your servlet container, and set things up so that your "user levels"
correspond to "roles" in the security constraints. Then, you can use the
"role" attribute on your <action> elements to restrict which users can
actually call a particular action (i.e. your administrative ones), and/or
use security constraints in the web.xml file to limit which JSP pages can
be accessed based on role.
How you map the container's security mechanisms to your database of users
is container dependent. For example, if you're using Tomcat it's pretty
easy to use JDBCRealm and configure it to talk to your user database
tables when it authenticates users for you.
>
> Any help would be appreciated
>
> Regards
>
> Steve Vanspall
>
Craig
--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>
Re: Restrict acces to certain pages/actions
Posted by "Craig R. McClanahan" <cr...@apache.org>.
On Thu, 5 Dec 2002, Steve Vanspall wrote:
> Date: Thu, 5 Dec 2002 10:03:42 +1100
> From: Steve Vanspall <st...@crmsoftware.com.au>
> Reply-To: Struts Users Mailing List <st...@jakarta.apache.org>
> To: Struts User Mailing List <st...@jakarta.apache.org>
> Subject: Restrict acces to certain pages/actions
>
> Hi there,
>
> I was wondering if struts had some mechanism to restrict acces according to
> user level.
>
> Basically our users may be of variying levels in our system. From customer
> to administrator.
>
> This is defined by a columns in a table in our database.
>
> Each user should have differing levels of access to the web app.
>
> For example a customer can change his/her setails, but not search/view any
> other customer.
>
> Naturally a customer also wont have access to the administration section of
> the web-app.
>
> I can code up a retriction system. But was wondering if struts already had
> one that I could cutomise for my own needs.
>
The normal advice is to use the container managed security provided by
your servlet container, and set things up so that your "user levels"
correspond to "roles" in the security constraints. Then, you can use the
"role" attribute on your <action> elements to restrict which users can
actually call a particular action (i.e. your administrative ones), and/or
use security constraints in the web.xml file to limit which JSP pages can
be accessed based on role.
How you map the container's security mechanisms to your database of users
is container dependent. For example, if you're using Tomcat it's pretty
easy to use JDBCRealm and configure it to talk to your user database
tables when it authenticates users for you.
>
> Any help would be appreciated
>
> Regards
>
> Steve Vanspall
>
Craig
--
To unsubscribe, e-mail: <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>