Using credentials to control access to public methods: good or badidea?

[Olli Plough]

Hi,

in the application I'm working on there are some methods I don't want
the application developer to call (it's not the way to do things and
the use could corrupt data). In order to program truly against an
interface and have generic code I have to put these methods into the
respective Java interface, though. Problem is that the user should not
call these methods but use a different approach. My idea is now that
those methods require some credentials to be passed on as a parameter
and the "kernel" verifies whether the credentials that only the kernel
knows are correct. If not an exception is thrown. Now I'm asking
myself whether this is a good idea or rather brain damaged. My concern
is that the problem should rather be solved on a design level rather
than doing tricky things. But I see no way round putting those methods
into the respective Java interface class. Otherwise the framework
cannot call them itself ...

Any ideas or opinions would be appreciated.
Regards, Oliver Plohmann

 

[Manish Pandit]

Hi,

in the application I'm working on there are some methods I don't want
the application developer to call (it's not the way to do things and
the use could corrupt data). In order to program truly against an
interface and have generic code I have to put these methods into the
respective Java interface, though. Problem is that the user should not
call these methods but use a different approach. My idea is now that
those methods require some credentials to be passed on as a parameter
and the "kernel" verifies whether the credentials that only the kernel
knows are correct. If not an exception is thrown. Now I'm asking
myself whether this is a good idea or rather brain damaged. My concern
is that the problem should rather be solved on a design level rather
than doing tricky things. But I see no way round putting those methods
into the respective Java interface class. Otherwise the framework
cannot call them itself ...

Any ideas or opinions would be appreciated.
Regards, Oliver Plohmann

From what I understood, you're right. Passing credentials to a method
and the method determining whether to execute or not is not a good
idea under most circumstances.

That is why Java EE supports the security model based on descriptors,
where by you declare roles, assign users to those roles and then have
the permissions managed on the methods based on these roles, all
external to the application in the form of deployment descriptors.
This is also referred to as the declarative security model (vs. the
programmatic security model you've mentioned in the post).

Here is a good tutorial by Sun on EE Security :
http://java.sun.com/javaee/5/docs/tutorial/doc/bnbwk.html

-cheers,
Manish

 

[Martin Gregorie]

From what I understood, you're right. Passing credentials to a method
and the method determining whether to execute or not is not a good
idea under most circumstances.

That is why Java EE supports the security model based on descriptors,
where by you declare roles, assign users to those roles and then have
the permissions managed on the methods based on these roles, all
external to the application in the form of deployment descriptors.
This is also referred to as the declarative security model (vs. the
programmatic security model you've mentioned in the post).

Here is a good tutorial by Sun on EE Security :
http://java.sun.com/javaee/5/docs/tutorial/doc/bnbwk.html

I assume the OP has these sensitive classes in a package. If so, why
can't they simply be declared as "protected class", which would restrict
access to package members?