Application Security

Thread View: borland.public.jbuilder.java.swing

2 messages

[T] Back to Threads [V] Tree View [G] Group Articles

2 total messages Started by David Bolsover Sun, 17 Apr 2005 18:51

#651

Author: David Bolsover
Date: Sun, 17 Apr 2005 18:51

27 lines
2118 bytes

Hi all

I have been working on a database application for about 12 months now - the 
app was deployed abut 6 months ago - I belive that the users are happy with 
performane.

Time has now come to refactor certain aspects of the app - and I am keen to 
address some shortcomings in the area of application security and access 
rights.

In particular, I need to be able to control users access rights to certain 
menu items in the application - for example, administrators need 
unrestricted access, supervisors need access to the maintenance screens, 
users need access to a more restricted set of menus.  The access rights need 
to be ontrolled on a user by user basis not just on a role basis.

I am looking for suggestions on how best to implement the required security 
features. Pointers to relevant resources and design patterns would be most 
welcome.

One area that is particularly challenging, is how to control access to nodes 
in a tree data structure - this needs to be highly configurable - some users 
can access the whole tree; others just a restricted set of nodes.

All suggestions welcome.

db

Re: Application Security

#652

Author: Tony
Date: Mon, 18 Apr 2005 07:36

32 lines
2097 bytes

David,

I have recently developed a framework to accomplish the same objective.
I can suggest the following implementation hints. I apologize if they sound 
trivial.

1. Make sure that all actions in your application are implemented as Swing
Actions. I implemented an extension to AbstractAction, which in addition to 
many
other things encapsulates a security token which allows to check it's 
permission
against a set of security tokens, managed by your own security 
implementation.
That way, when you define your action in one place in your application in 
the same
place you give it a security token.

2. Never build your menus/trees manually. Define your own nested data 
structure,
which you will use to code a nested set of Actions. Then pass your data 
structure to
a factory method, which can generate a tree or a menu, based on the data 
structure.
Among other things your factory method can easily check permissions for the 
security
token in the Action and choose to exclude the node from the tree based on 
the results
of such check, naturally if your factory will be building a menu you can 
choose whether to
keep the action as disabled or omit it.

Tony.

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads