Need role based access on a DAO

[pramodr]

Hi group,

I have a design problem described as follows.

I have a simple application which I need to make secure, which
currently is not. I am planning to implement security at the DAO
level. For instance I have a DAO, say AuditScheduleDAO which requires
a role based access. A user with role admin can add/modify/view an
AuditSchedule in the DB (Postgres db) thru the DAO. However the admin
cannot delete it, which could be done only by the superAdmin.

Similarly I have a two more other roles - auditor (add/view only) ,
user (view only)

What could be the best design possible ? I use struts as front end
and tomcat 5.5 server. I am planning to implement JAAS security and
<security-constraint> defined in web.xml to protect the urls whichever
are not accessible, however I cannot use <security-constraint> for
role based access of java objects.

Any suggestions ?

regards
Pramod Ramachandran

 

[Giovanni Azua]

hello,

You could proxy over/ wrap the dao interface (proxy pattern) to control
access to it i.e add security so this proxy can be attached without
modifying the concrete dao implementations to add the security concern.

You could have a look at Spring but I would bet it is not far from this
concept.

Sorry for not elaborating more ... responding from iPhone now

HTH,
Giovanni

 

[Arne Vajhøj]

I have a design problem described as follows.

I have a simple application which I need to make secure, which
currently is not. I am planning to implement security at the DAO
level. For instance I have a DAO, say AuditScheduleDAO which requires
a role based access. A user with role admin can add/modify/view an
AuditSchedule in the DB (Postgres db) thru the DAO. However the admin
cannot delete it, which could be done only by the superAdmin.

Similarly I have a two more other roles - auditor (add/view only) ,
user (view only)

What could be the best design possible ? I use struts as front end
and tomcat 5.5 server. I am planning to implement JAAS security and
<security-constraint> defined in web.xml to protect the urls whichever
are not accessible, however I cannot use <security-constraint> for
role based access of java objects.

Any suggestions ?

I am skeptical about the approach. I believe that the security
should be implemented in the business logic layer not in the
data access layer.

I would find it very tempting to use AOP for this. More
specifically AspectJ.

Arne

 

[pramodr]

I am skeptical about the approach. I believe that the security
should be implemented in the business logic layer not in the
data access layer.

I would find it very tempting to use AOP for this. More
specifically AspectJ.

Arne- Hide quoted text -

- Show quoted text -

Thanks but I still dont not know if JAAS could be used to protect a
method inside a class. I heard that JAAS could be used to protect
codebase (jar/classes) from unauthorised access. Not sure how to apply
security at the method level.

 

[Arne Vajhøj]

Thanks but I still dont not know if JAAS could be used to protect a
method inside a class. I heard that JAAS could be used to protect
codebase (jar/classes) from unauthorised access. Not sure how to apply
security at the method level.

I can not see why JAAS could not be used to protect the method
call. JAAS can check any permission anywhere in the code.

(as far as I remember - it is a long time since I have used JAAS)

Arne