JAAS: How to create Group of Resources to define permissions hierarchically

Question

Hi,
Is there a way to create a group of resources in JAAS ? What I mean is to create a group of pages, a group of bank Accounts ( say loan accounts ), a group of business rules, etc. I have observed that Group extends Principal, and a subject can have several Groups, apart from the User Principal. Similar example implementations for a Role can also be found on the net. But Group in this sense is a group of Users or a group of Roles,or may even be a group of groups.
Instead, what I want is to group some protected resources by a name so that I can grant permissions to a group of users over a group of resources (say pages). Infact JAAS does not mention the concept of resource in a concrete way. Every Permission implementation class has defined the protected resource in its own way, so I'm wondering if it is possible to define a group of resources when resource it self is abstract concept in JAAS.
Let me explain my problem a little more clearly. Let's say I have Accounts, Pages, and Business Rules as resources. There can be several types of accounts , several categories of pages, and several categories of rules. I want to create Loan Accounts Group, Savings Account Group, Administration pages Group,support request pages group, end-user pages Group, etc so that i can define a "view,edit,suspend" actions over this Group to a user or another user group.
here is an example of what i want to do :
grant Principal com.example.product.GroupPrincipal "AdvacnedUsers" {
permission com.example.product.GroupPermission "CurrentAccounts" "view,edit,suspend";
That would save me the effort of granting permission on every Current Account in the database.
Heirarchical permission assignement is being done in FilePemission, but that is based on recursiveness or wildcard criteria, which is not possible in the above mentioned scenario. Could some one help me understand how this works in JAAS ?
Thanks and Regards,
Samba
Edited by: MasterJ on Feb 26, 2009 12:34 AM

Answer 1

You're defining the Permission classes. It is completely up to you what the name and the actions actually mean.