Permission based access

Question

I'm guessing this is a fairly common need, but I'm not sure what the proper
way to implement it is.
I need to enable our WL7 application to support users with custom
permissions. I have already implemented a set of custom security providers
that allow us to authenticate against our database. The next step is
supporting "feature" or permission based access to various application
components. I understand how to configure the security on weblogic
resources, but that is not granular enough for me.
In our system, each user is granted a set of features or functions that they
have access to. This may be a global action, such as "Create a user" or it
may be very specific such as "Change zip code". Our application logic needs
to check these permissions (and either deny access or modify a menu or some
other logic).
My first pass at this was to get security working at the weblogic resource
level. Then I wrote a utility class that will take a subject and check if
it has the permission in our database. This works, but it's done outside of
the JAAS security model and I'm trying to do this the "right" way. It seems
to me that I need to setup a JAAS security policy and associate Permission
objects for the features that I need to secure, but I don't know how to do
this in the context of a weblogic application.
What is the proper way to do this? Can someone give me some tips or point
me towards some usefull documentation?
Thanx,
Matt

Answer 1

I don't have any code that I can send you right now (it would take me too
long to rip out my companies proprietary stuff), but here's the approach I
took.
I started from the sample providers that are available on dev2dev (
http://dev2dev.bea.com/code/codedirect.jsp?highlight=codedirect ). From
there, I just removed the providers that I didn't need. In the sample
framework, there are a set of database classes that implement the user
storage. In the samples, the users are stored in a properties file on the
disk. I just replaced the code in those files with the appropriate database
lookups in my environment.
Couple things that took me time to work through:
1. You must create a user that is in the Admin group for the server to start
under. I was not successfull in separating the authentication mechanism for
the server id and the users.
2. You cannot use the weblogic datasources or connection pools to access
your database. Since the server id is authenticating against your custom
provider, the datasources and pools have not yet been created.
3. I had trouble configuring my realm using the console. There seemed to be
an intermittent bug that kept my realm information from being persisted into
the security store. I exported the security realm configuration into an xml
file, modified the xml file to exactly what I wanted, and loaded it back
into the server. The process for doing this is available in the docs (
http://e-docs.bea.com/wls/docs70/admin_domain/failures.html#1106023 ).
I would love a workaround for 1 and 2, but so far I haven't found one.
Good luck!
Matt Galvin
GoSolutions
"Amit" <[email protected]> wrote in message
news:[email protected]...
>
Hi Matt
In your mail to BEA groups you have mentioned that you
have implemented authorization/access privileges
against your DB.
I need to implement similar functionality where I need
to store userid, password, role in the DB and then
make users access Weblogic 7.0 resources based on the
roles stored in the DB. Could you provide me some code
or pointers that would could help me?
Thanks and regards,
Amit
"Matt Galvin" <[email protected]> wrote:
I'm guessing this is a fairly common need, but I'm not sure what the
proper
way to implement it is.
I need to enable our WL7 application to support users with custom
permissions. I have already implemented a set of custom security
providers
that allow us to authenticate against our database. The next step is
supporting "feature" or permission based access to various application
components. I understand how to configure the security on weblogic
resources, but that is not granular enough for me.
In our system, each user is granted a set of features or functions that
they
have access to. This may be a global action, such as "Create a user"
or it
may be very specific such as "Change zip code". Our application logic
needs
to check these permissions (and either deny access or modify a menu or
some
other logic).
My first pass at this was to get security working at the weblogicresource
level. Then I wrote a utility class that will take a subject and check
if
it has the permission in our database. This works, but it's done outside
of
the JAAS security model and I'm trying to do this the "right" way. It
seems
to me that I need to setup a JAAS security policy and associatePermission
objects for the features that I need to secure, but I don't know how
to do
this in the context of a weblogic application.
What is the proper way to do this? Can someone give me some tips or
point
me towards some usefull documentation?
Thanx,
Matt