Setting user permissions when running commands

Question

Here's a doosey,
Looking to implement a system which will run "commands" being recieved from the network from a bunch of different users. I want the users to have different permissions depending on their username. I'm thinking the backing store as being an LDAP database. (easy update over the network, no using the policy editor, etc).
Anyone got any advice, experience, existing products which do this? I"m looking at java.security.Profile and java.security.AccessController, java.security.ProtectionDomain and rolling my eyes. Kinda difficult.
Am I barking up the wrong/right tree?
Any ideas?
Many thanks
Keith

Answer 1

I think I understand what you're saying, however i'm using the LDAP database to store the user's permissions (exactly like a policy file). So I"m not using LDAP to handle the authentication, just the data.
It's the process of what you call "assigning the secuirty level" that I wanted to do...
I think I've found what I'm looking for - JAAS. First I implent a java.security.Policy (in particular the getPermissions(ProtectionDomain domain) method). Then create my own java.security.Principal (containing the username) and associate that with a java.security.auth.Subject then use the Subject.doAs method.
IN the command code then I do a AccessController.checkPermission(Permission ) method which will throw an exception if the permission is not found.
I think this is it anyway.