Security Design

Question

The way I've done security in the past is to define, in an external XML file or database, the roles that can perform certain actions. Then, using Struts, I create a SecureAction that extends Action. This class looks up the requested action, checks it against the user's role, and either calls an abstract method named doAction (if the user has the role) or returns an HTTP error 403. All other struts Action classes extend SecureAction and implement doAction (not execute). Using this method also allows me to create a custom tag called secureLink with an attribute "action" that will render its contents only if the current user has the ability to perform the action. This custom tag also uses the XML file to make this determination.
Thus, with one XML file, I can do the following:
1) Ensure that actions will not be executed if the user does not have authorization by simple inheritance
2) Avoid rendering controls that might initiate actions a user does not have authorization for
3) Keep all security configuration in one place
I would like to do something similar using JSF. The XML file and custom tag are no problem, but the action paradigm is quite different. I need something that can intercept an action and either allow processing to continue or abort processing with an HTTP error 403. Something like a filter or a servlet might work, except that I need to know the action string specified in the command component, and I don't know how to decode this from the incoming request.
Can I do this by specifying a global ActionListener implementation in faces-config (i.e. <application><action-listener>my.package.ActionListener</action-listener></application)? I looked at the ActionListener interface and the processAction( ) method only receives an ActionEvent...is there a way to get the name of the action from the ActionEvent (I don't see one...)?
I also thought about implementing a custom NavigationHandler, but I think at that point it's too late...the action has already been executed. I'd like to intercept the request before the action is performed if possible.
Is there another way? Or is there a way to get the action from the ServletRequest object in a filter or servlet?
Thanks,
- Jesse

Answer 1

Looking at the HTML source generated by the taglib, I see that the "id" and "action" attributes get translated in the following way:
<faces:commandButton id="myId" action="myAction" value="myValue"/>generates:
<input type="submit" id="myId:myAction" name="myId:myAction" value="myValue">
<input type="hidden" id="myAction" value="myAction">Thus, theoretically, I can infer the action from the request by:
1) iterating through all of the parameter names and selecting those that contain colons
2) tokenizing the resulting names by colon into "id" and "action" variables, respectively
3) look in the request for a parameter with the same name contained in the "action" variable
Can anyone verify that this will work? Is there an easier way? For example, is there a utility class that I can pass the request to and get all of this information, like in Struts?
Thanks,
- Jesse