Re: Permission-based authorization with JAAS

Question

Actually, I am struggling on this topic also. Probably someone else could help
on this. If you only deal with WLS, one solution could be write your own RoleMapper.
When the RoleMapper is called, the subject/principal should be available, at that
time you could do DB search to find roles the principal belongs to and return
all the roles to WLS security manager. WLS take over from there to enforce the
access control defined in ejb-jar.
-John
"Natasha" <[email protected]> wrote:
>
That is very helpful, thank you very much, John!
What about dynamic role definition? Any thoughts on how I should go
about authorizing
based on specific permissions a user has? What I need, essentially,
is to have
only the relevant parts of a given page visible to a user with certain
permissions,
so I want to use JAAS to have a system that would check if the current
instance
of Subject is authorized for a particular action.
Natasha
"John Zhu" <[email protected]> wrote:
One thing you could do is to have all the client logs in through JNDI
lookup API.
And client's principal will be passed to the bean. Inside the bean's
method call
principal.getName() to retrieve the principal. After that you couldsearch
DB
to get ACL related to the principal, then enforce the security.
Principal principal = context.getCallerPrincipal();
logger.info("The principal name: "+principal.getName());
[email protected] (Natasha) wrote:
I need to implement an authorization model in which a user can be
authorized to view a certain page or a part of a page based on their
permissions. The trick is that the role definition is dynamic, andI
can not make a policy file ahead of time. Instead, I would like to
simply retrieve the users permissions and then allow access (or, say,
use a jsp tag to check if a certain part of the page should be
displayed) based of whether the user has the permission required, and
have a configuration file that defines the access policy by mapping
actions to permissions. I am trying to figure out whether I can use
JAAS and the Subject class for this, because all of the examples I
could find map actions to roles, rather than individual permissions.
Also, I am confused as to whether or not I would have to implement
my
own LoginModule if I need to authenticate against a database, in my
case, probably via using Weblogic entity beans. Sun tutorial states
that developers do not need to implement a LoginModule, but I do not
understand how I can do all that without it. I am using Weblogic 7.0
and Struts.
Any help will be greatly appreciated.
Natasha

Answer 1

Did u think about implementing your own AuthorizationProvider and using it in your
security realm. The AuthorizationProvider does the trick of verifying which resource
is being accessed and who can access it.
My only problem is that I am unable to find out how to make the Resource know
what instance it is...
"Natasha" <[email protected]> wrote:
>
I guess I have to see if anyone suggests an alternative, and then decide
whether
it is worth adapting JAAS instead of a quick homegrown solution, as it
seems like
in our case the biggest reason to adopt JAAS is it being the standard.
Thank you very much for your help, John!
Natasha.
"John Zhu" <[email protected]> wrote:
Actually, I am struggling on this topic also. Probably someone elsecould
help
on this. If you only deal with WLS, one solution could be write your
own RoleMapper.
When the RoleMapper is called, the subject/principal should be available,
at that
time you could do DB search to find roles the principal belongs to and
return
all the roles to WLS security manager. WLS take over from there to enforce
the
access control defined in ejb-jar.
-John
"Natasha" <[email protected]> wrote:
That is very helpful, thank you very much, John!
What about dynamic role definition? Any thoughts on how I should go
about authorizing
based on specific permissions a user has? What I need, essentially,
is to have
only the relevant parts of a given page visible to a user with certain
permissions,
so I want to use JAAS to have a system that would check if the current
instance
of Subject is authorized for a particular action.
Natasha
"John Zhu" <[email protected]> wrote:
One thing you could do is to have all the client logs in through JNDI
lookup API.
And client's principal will be passed to the bean. Inside the bean's
method call
principal.getName() to retrieve the principal. After that you couldsearch
DB
to get ACL related to the principal, then enforce the security.
Principal principal = context.getCallerPrincipal();
logger.info("The principal name: "+principal.getName());
[email protected] (Natasha) wrote:
I need to implement an authorization model in which a user can be
authorized to view a certain page or a part of a page based on their
permissions. The trick is that the role definition is dynamic, andI
can not make a policy file ahead of time. Instead, I would like
to
simply retrieve the users permissions and then allow access (or,say,
use a jsp tag to check if a certain part of the page should be
displayed) based of whether the user has the permission required,and
have a configuration file that defines the access policy by mapping
actions to permissions. I am trying to figure out whether I can
use
JAAS and the Subject class for this, because all of the examplesI
could find map actions to roles, rather than individual permissions.
Also, I am confused as to whether or not I would have to implementmy
own LoginModule if I need to authenticate against a database, in
my
case, probably via using Weblogic entity beans. Sun tutorial states
that developers do not need to implement a LoginModule, but I donot
understand how I can do all that without it. I am using Weblogic7.0
and Struts.
Any help will be greatly appreciated.
Natasha