Need suggestion on security

Question

Hello,
I need some suggestions on what might be the best way to handle security in my application.
The application acts as a control panel with an initial login screen. When a user logs in it needs to be given access to certain menus and buttons based on the user group in which it belongs. The user groups need to be configurable (so policies will change over time).
Is JAAS a viable solution? I am not concerned with the OS level of security. The application needs its own level of security. For example, user JohnDoe logs in to application. JohnDoe belongs to the GroupA user group. GroupA has AccessPrivsA, which currently allows him to view menus A B and C. Later on AccessPrivsA is changed by user Admin to only have access to menus A and B.
Any ideas fellas?

Answer 1

JAAS will allow you to authenticate the user and to obtain the users credentials via the OS or another source (depending on the LoginModule used) but it will not allow you to control access to various features in your application. For this you need to create an ACL (Access Control List) based framework within your application. An ACL is a list of groups/users that have a certain privileges. You would create an ACL for each of the features within your app that you want to control access to. The various classes within your app could check with the ACL management system to see if the current user has access to a specific feature. For example assume the following (not thread safe) code:
public class AclMgr{
  private AclMgr _singleton;
  private HashMap _aclmap;
  private Subject _subject;
  private AclMgr(){
    _aclmap = new HashMap();
    // read in the ACLs and store in HashMap. This could be in a properties file.
    // e.g.
    // #My ACL property file
    // #format: feature=ACl
    // view.sensitve.data=ADMIN,SUPER
    // get a reference to the current Subject (which is essentially the user with credentials).
    // This assumes your using JAAS - you could also roll your own if you choose to.
    _subject = UserAuth.getInstance().getCurrentSubject();
  public static AclMgr getInstance(){
    if(_singleton == null){
      _singleton = new AclMgr();
    return _singleton;
  public boolean isAuthorized(String feature){
    boolean authorized = false;
    if(_aclmap.containsKey(feature)){
      // check the Subjects credentials (groups etc) against the ACL for this feature.
      // if the user is in a group that exists in this features ACL then set authorized=true .
    return authorized;
public class MyJFrame extends JFrame{
  public MyJFrame (){
    super();
    // set up the UI
    // when we get ready to see if we add a feature then do something like this:
    if(AclMgr.getInstance().isAuthorized("view.sensitve.data")){
      // the user has access so add yer button!
}Of course, this is overly simplified but gets the general idea across. We have implemented something similar in our Enterprise application and it works nicely. With a little more work you can probably provide an UI for authorized users (admins etc) to edit Access Control Lists for various features. Security will be increased if you store the ACL property file on a server somewhere so you can control access to its editing. Or even store it in a Database� lots of fun to be had here ;-)
Hope this helps,
Shane