Web users/security

Question

Hi,
We are implementing a JBoss application, using stateless session beans and a Swing client (used by employees from the intranet).
Now we need to implement a web client to allow the customers themselves to place orders etc from the Internet.
We'll probably use Struts.
The problem is that, as opposed to the swing client, from the web client the user should only access his specific data; A web user may obviously not see or edit other info (customer info, orders etc) than the one "owned" by himself. Customer id is stored in the relation database, and I guess we'll create a table where the web user's user name and password are stored together with the customer id.
On the EJB/EJB-remote-method-level we currently use admin, guest and internetuser roles. But the problem above is how to narrow the permissions within the internetuser role.
I'd appreciate any suggestions (links to articles etc) to how this problem may be approached in the most effective way.
Best regard,
AC

Answer 1

For what its worth...
I have a similar app whereby Resources are avialable to a Person if they are acting in a Role that has a Permission on the Resource in question.
However, I also added the concept of a Private Resource for things that would only ever belong to one Person.
This meant that I didn't have to set up a Role and Permission for a Resource that would only ever be accessed by a single person.
The private Resource is just a normal Resource with a null owner.