Instance-level authorization...

Question

Hi, i'm working on an application using Toplink. We connect to the database using an internal connection pool with a common user/password. We need to filter any results returned to the client based on the requesting user's authorizations, probably using an ACL with privileges, principals, etc. So for instance, a query might return a list of Report objects but the user can only see a subset of the list. This application is not using EJB. Has anyone implemented something like this? i was thinking of either a custom built solution within this application or extending JAAS.
Any suggestions would be greatly appreciated.
-Tim Watson

Answer 1

Yes, without VPD you will need to engineer some way to filter the data at the database level.
Potentially other Fine Grained Access control is available ( database dependant), or you could create TopLink queries that filter directly based on the user that is executing them. For example you could add an extra field to the selection criteria and provide the user specific value in the row passes to executeQuery
ReadObjectQuery roQuery = new ReadObjectQuery(IsolatedClass.class);
ExpressionBuilder builder = roQuery.getExpressionBuilder();
Expression expression = builder.get("name").equal(builder.getParameter("NAME"));
expression = expression.and(builder.getField("SEC_ROLE").equal(builder.getParameter("Sec_Role")));
roQuery.addArgument("NAME");
roQuery.addArgument("Sec_Role");
Vector arguments = new Vector(2);
arguments.set(0, "Bob");
arguments.set(2, currentUser.getSecurityRole());
clientSession.executeQuery(roQuery, arguments);--Gordon