Standard extension of JAAS for instance based authorization?
3 Message(s) by 2 Author(s) originally posted in java security
| From: zets |
Date: Sunday, February 11, 2007
|
I'm wondering what is the best to do the following:
I'd like to
extend the
standard role based access
control check
which is done by JAAS (based on the role needed to
run the
method and
the role the user has), with a test that will check if the user is
allowed to run the method on the given params.
What I've in mind is something like this: for each
EJB I'll have
permission class (possibly most of them will share the same), and an
interceptor that'd call something like SecurityManager (or
Access Controller) checkPermission. I'm missing quite a lot of the
picture though. Not enough that I'm not sure this is the right thing,
I'm also not sure on the details of how to do it. For example, how
would I map Permission class to a method in an EJB?
Has anyone done this kinda thing? any recommendation on the right way?
Thanks.
| From: sh3khar.jha |
Date: Monday, February 12, 2007
|
wrote in message:
I'm wondering what is the best to do the following:
I'd like to extend the standardrole basedaccess control check
which is done by JAAS (based on the role needed to run the method and
the role the user has), with a test that will check if the user is
allowed to run the method on the given params.
What I've in mind is something like this: for each EJB I'll have
permission class (possibly most of them will share the same), and an
interceptor that'd call something like SecurityManager (or
AccessController) checkPermission. I'm missing quite a lot of the
picture though. Not enough that I'm not sure this is the right thing,
I'm also not sure on the details of how to do it. For example, how
would I map Permission class to a method in an EJB?
Has anyone done this kinda thing? any recommendation on the right way?
Thanks.
Take a look at JACC which solves the exact problem you are talking
about :)
http://JAVA.sun.com/J2EE/JAVAacc/index.html
| From: zets |
Date: Monday, February 12, 2007
|
wrote in message:
wrote in message:
> I'm wondering what is the best to do the following:
> I'd like to extend the standardrole basedaccess control check
> which is done by JAAS (based on the role needed to run the method and
> the role the user has), with a test that will check if the user is
> allowed to run the method on the given params.
> What I've in mind is something like this: for each EJB I'll have
> permission class (possibly most of them will share the same), and an
> interceptor that'd call something like SecurityManager (or
> AccessController) checkPermission. I'm missing quite a lot of the
> picture though. Not enough that I'm not sure this is the right thing,
> I'm also not sure on the details of how to do it. For example, how
>'d I map Permission class to a method in an EJB?
> Has anyone done this kinda thing? any recommendation on the right way?
> Thanks.
Take a look at JACC which solves the exact problem you are talking
about :)
http://JAVA.sun.com/J2EE/JAVAacc/index.html
Thanks, can you please
reference an example on how to do it with JACC?
I could not find any, or a tutorial. All I could find is the JSR
specification.
Next Message: Simple remote authentication
Blogs related to Standard extension of JAAS for instance based authorization?
IBM Test 257
developer must ensure that
instance of classes from a certain
Java package are
... (res-
auth) set to "Application". How should the
JAAS authentication alias be
... What type of element should the developer configure in the WS
Extension ...