Not able to decide on : Mission Configurable Authorization

Question

Hello,
I post here after begging people to
please understand my problem first.this is what I need to achieve:
It is about dynamic authorization.
My application will have an admin page where the admin will be able to give access rights to users for certain actions on certain pages. these could be any permutation and combination.
I need to be able to authorize them based on this condition.
For example :
If it were a mechanic application.
The admin will be able to authorize MechA to be able to perform "Add, Delete" actions on garage A, but only VIEW rights on garage B.
similarly MechB to be able to only "ADD" in garage A, but ADD,DELETE in garageB.Again, the number of garages can be many. the admin will be able to add a garage and delete a garage.
(ofcourse, based on the current access rights they have, the JSP will display those current access rights)
I have poured over google search and forums and security frameworks to decide on an approach for this.
I initially had thought that I will have a table which will have two cols USER and PERMISSIONS.
where users would be the suers and permissions would be URLs. Ex. :
mechA | garageA/add.jsp
mechA | garageA/delete.jsp
mechA | garageb/view.jsp
However, this premature understanding will not work because of obvious reasons (if I need to update or delete the URL for the user.. I am screwing up everything).
Then, now I am thinking of an XML based authorization now. where the parent node will be the user name and his child nodes will be the URLs he has access to. Though i have not worked on this, I know this will be of no use, because my application will have the capability to switch between a db and LDAP. I have very little knowledge of LDAP though.
No secuirty framework is going to be of help ( i have looked extensively through JAAS and Acegi).
because they function majorly on ROLES. In my case I have no ROLES at all :-(
I have been pulling my hair out trying for a solution for this kind of a configurable scenario, where the user base could be on a DB and on LDAP.
Any ideas/help/pointers towards an approach would be highly appreciated.
thanks in advance for your time.

Answer 1

If you don't have roles now, rethink your design.
What if another mechanic comes in as a replacement
for an existing mechanic who left or goes on holiday?
Do you really want to have to assign all permissions
to the new mechanic again? No, you want to be able to
say: this new mechanic has the same role(s) as the
original mechanic and be done with it. Or what if a
mechanic gets promoted? Instead of having to add and
remove all the accompanying permissions, just set or
add the new roles.Well, there will also be Groups, to which the mechanics can be assigned, but it is not a necessity for them to be under a group.
A mechanic can be an individual with individual rights, or can be a part of a group which has certain permissions. In my case, everything needs to be highly configurable. Creating a single user(with specific permissions) or creating the group(with specific permissions) and then assigning mechanics to the group, will really be the admins choice, who will set the users up.
If you realy, really, really can't think of any roles
that make sense, you can pretend each mechanic
defines his own special role (the role is the same as
the mechanic) and still use those frameworks.hmmm... I have typically assigned URLS with wildcard chars. like /admin/*.* with ROLE_ADMIN thing.
In this case,I will probably have to have many relative URLS mapped with a singular ROLE. However, how I can change/update these URLs based on the admins input, still remains a mystery to me.
Any other suggestions ?