Security (permissions)

Question

Hello,
As I understand permissions can be set on beans and their methods, but what if I need to check object state to decide whether user can change it or not?
What I need is to implement permissions system that can be changed on the fly and some advanced checks are required (objects states + users permissions on objects states).
Can I implement it using standart J2EE security featurs? System must be configurable (need to develop administration tool that will allow permissions assignemnt to the users and objects (for axample object can be changed if it is in state 'A' and user 'Paul' can change it)). I need to make it in one way not in several (not like: one part using standart J2EE features and other using my own permission system).
With regards,
Pavel Krupets

Answer 1

Pavel,
I belive you are looking for a way to configure access to your components such that who can access them
is a function of component state. You can write portable components such that this is the case, but J2EE
does not standardize how one might configure the impact of component state on such a policy model.
On all J2EE platforms, you can configure role membership such that it effects who can do what given a
static model for what roles are able to do what in each component state. You can either protect different
methods with different roles, or test the caller for membership in a specific role seclected by the
component based on the state of the component.
As an added consideration, the Java Authorization Contract for Containers (JACC), which is a required
element of all J2EE 1.4 containers, defines a pluggability model for policy providers and a way (policy
context handlers) for such providers to obtain from the container the parameters of the component
invocation. The parameters of the invocation are not quite the same thing as the instance state, but one
way that you could accomplish much of what you are trying to do would be to develop a custom policy
provider that could be configured to apply the parameters of the invocation in its policy decisions. As a
result of JACC, on dispatch into the component, a proper access control context including a subject
representing the component runAs identity has been bound to the call thread, and thus you can use the
j2se security api's to check whether that context is granted any j2se security permission.
Custom policy providers are an evolving J2EE capability, so I must confess that you would
likely encounter portability challenges should you adopt this approach. I described it to you to
expose our thinking regarding how we believe more sophisticated access control functionality
could be integrated with the j2ee container security architecture.
Ron Monzillo