Security when ownership defined in database

Question

I have a couple of tables in a database and each table has an owner column. The owner
column represents the user that added that row to the table.
I'd like to implement security for the rows in the table such that only the owner and
any user that belongs to an administrator group can modify the row.
How would I go about doing this?
I was hoping to use isUserInRole() because I've implemented coarse container level security using <security-contraints>.
Any help is much appreciated.
Raj

Answer 1

Here's what I've done to achieve what I want:
1. I have a beforePhase listener on the form that will be performing the row edit.
2. The method for the beforePhase listener checks the permissions. If the user is not
allowed to perform the edit, then the servlet response returns error 403. The error page
for code 403 displays an insufficient security privilege page. Here's a snippet of the
unpolished code that performs the check:
String user = FacesContext.getCurrentInstance().getExternalContext().getRemoteUser();
if (!user.equals(row.getOwner()) {
     HttpServletResponse resp = (HttpServletResponse) FacesContext.getCurrentInstance().getExternalContext().getResponse();
     resp.sendError(403);
NOTE: The only drawback is that I have to do this for each page/form.
Any comments?