How can one put ACLs on "content" not just objects....?

Question

All,
The security realms available in Weblogic Server only allows one to put
ACL control on an "object" and not anything about putting security on the
"content" that moves through that object or is accessible by that object. I
wonder how people are designing around this "restriction".
For example, I would like to be able to have a policy based system that says
that, even though client A and Client B both can "execute" a servlet XYZ
that sends a form, I would like to only allow client A to modify the
contents and Client B to modify and send updates.
Does anyone have any suggestions or know of any tools for doing this
"declaratively" so it does not have to be hand coded in the servlet / EJB
etc. Ideally one using some emerging standard like XACL?
TIA
Bart Jenkins,CTO
Globeflow SA

Answer 1

Hello,
Other than doing something similar, I believe weblogic pushes a productcalled
entegrity that provides fine grained security for weblogic....The product is called AssureAccess and the company is called Entegrity
Solutions. AssureAccess achieves fine-grained, policy-based access control
for EJBs, JSPs, Corba objects, and other web resources.
For example, I would like to be able to have a policy based system that
says
that, even though client A and Client B both can "execute" a servlet
XYZ
that sends a form, I would like to only allow client A to modify the
contents and Client B to modify and send updates.You can do precisely that using AssureAccess. Let me know if you'd like
additional details.
Thanks,
Randeep
"mark lesk" <[email protected]> wrote in message
news:[email protected]...
>
We have implemented a fine grained security scheme that we coupled withStruts.
We define our fine grained permissions in the Struts configuration file onan
action by action basis and then also in our jsp pages to restrict thecontent
returned to the user. Out Struts controller servlet is responsible forenforcing
those permissions by checking with a permission cache that is populatedfrom a
database.
Other than doing something similar, I believe weblogic pushes a productcalled
entegrity that provides fine grained security for weblogic....
"Bart Jenkins" <[email protected]> wrote:
All,
The security realms available in Weblogic Server only allows one to
put
ACL control on an "object" and not anything about putting security on
the
"content" that moves through that object or is accessible by that object.
I
wonder how people are designing around this "restriction".
For example, I would like to be able to have a policy based system that
says
that, even though client A and Client B both can "execute" a servlet
XYZ
that sends a form, I would like to only allow client A to modify the
contents and Client B to modify and send updates.
Does anyone have any suggestions or know of any tools for doing this
"declaratively" so it does not have to be hand coded in the servlet /
EJB
etc. Ideally one using some emerging standard like XACL?
TIA
Bart Jenkins,CTO
Globeflow SA