Instance Based Authorization

Question

I am trying to find a way to access the instance of a Resource in an AuthorizationProvider
in order to be able to determine if a specific user can access one instance of
that resource.
Example, my Resource is an EntityBean named: TestEntityBean, the code is as follow:
public abstract class TestEntityBean implements EntityBean{
// some defaul methods
public java.lang.Long ejbCreate(Long key, String name) throws CreateException
System.out.println("TestEntityBean.ejbCreate");
setSecurityid(key);
setSecurityname(name);
return getSecurityid();
public abstract Long getSecurityid();
public abstract void setSecurityid(Long securityid);
public abstract String getSecurityname();
public abstract void setSecurityname(String securityname);
public void ejbPostCreate(Long key, String name) throws CreateException {
System.out.println("TestEntityBean.ejbPostCreate");
I am using CMP, and my DB is ORACLE. When my authorization provider intercepts
the request to getSecurityName() I can see:
This defines my resource being used (aka my TestEntityBean and the method) but
how can I find out what is the EntityBean content? i.e. for example how can I
define what is the primary key of this object?
If I am offline, would u have recommendations on how to implement an instance
based authorization model? (ref to articles...?)
Thank you

Answer 1

This is what the AuthorizationProvider named MmlFileAuthorizationProviderImpl gives
me:
MmlFileAuthorizationProviderImpl.isAccessAllowed
subject = Subject:
Principal: user1
Principal: myGroup
Principal: developers
Principal: mySecondGroup
Private Credential: principals=[user1, myGroup, developers, mySecondGrou
p]
roles = Anonymous,writer_user,reader_user,creator_user
resource = type=<ejb>, application=_appsdir_mml_ear, module=tests
ecurity.jar, ejb=TestEntityEJB, method=getSecurityname, methodInterface=Local,
s
ignature={}
direction = ONCE
handler = weblogic.ejb20.internal.DummyContextHandler@1c32369
MmlFileAuthorizationProviderImpl.isAccessAllowed
subject = Subject:
Principal: user1
Principal: myGroup
Principal: developers
Principal: mySecondGroup
Private Credential: principals=[user1, myGroup, developers, mySecondGrou
p]
roles = Anonymous,writer_user,reader_user,creator_user
resource = type=<ejb>, application=_appsdir_mml_ear, module=tests
ecurity.jar, ejb=TestEntityEJB, method=getSecurityname, methodInterface=Local,
s
ignature={}
direction = ONCE
handler = weblogic.ejb20.internal.EJBContextHandler@1372a7a
Resource hashcode: -1318771256
ID: 2145579658558124
Type: <ejb>
Keys[0]: application
Keys[1]: module
Keys[2]: ejb
Keys[3]: method
Keys[4]: methodInterface
Keys[5]: signature
Values[0]: appsdirmml_ear
Values[1]: testsecurity.jar
Values[2]: TestEntityEJB
Values[3]: getSecurityname
Values[4]: Local
Values[5]: {}
Looking for policy for resource(type=<ejb>, application=_appsdir_mml_ear, module
=testsecurity.jar, ejb=TestEntityEJB, method=getSecurityname, methodInterface=Lo
cal, signature={})
I get all the information about the resource ... i.e. which entitybean object
is being used, but I can not have access to nay of the bean onformation, and this
is what I need to enable Instance base Authorization for this bean.
Basically how else can I say:
User Paul can do anyhting with this TestEntityBean being object "123" ?
User Jonh can only read the TestEntityBean "123" but can access and write in all
other bean TestEntityBean ?
Am i making sense? Can anyon help?
"Seyvet" <[email protected]> wrote:
>
I am trying to find a way to access the instance of a Resource in an
AuthorizationProvider
in order to be able to determine if a specific user can access one instance
of
that resource.
Example, my Resource is an EntityBean named: TestEntityBean, the code
is as follow:
public abstract class TestEntityBean implements EntityBean{
// some defaul methods
public java.lang.Long ejbCreate(Long key, String name) throws CreateException
System.out.println("TestEntityBean.ejbCreate");
setSecurityid(key);
setSecurityname(name);
return getSecurityid();
public abstract Long getSecurityid();
public abstract void setSecurityid(Long securityid);
public abstract String getSecurityname();
public abstract void setSecurityname(String securityname);
public void ejbPostCreate(Long key, String name) throws CreateException
System.out.println("TestEntityBean.ejbPostCreate");
I am using CMP, and my DB is ORACLE. When my authorization provider
intercepts
the request to getSecurityName() I can see:
This defines my resource being used (aka my TestEntityBean and the method)
but
how can I find out what is the EntityBean content? i.e. for example how
can I
define what is the primary key of this object?
If I am offline, would u have recommendations on how to implement an
instance
based authorization model? (ref to articles...?)
Thank you