What is the best approach to store "dynamic" user accessibility ?

Question

Hi all,
We are implemennting security in our ADF BC + Faces application. There is always requirement to hide/disable functionalities that a user is not allowed / authorized to access.
Usually we do this during development time, based on what role the user is in. Using this approach, there is no way to change that , or give access to new role during runtime (after the deployment). This is what I call "static accessibility".
In our apps, we need the give / revoke access to some functionalities during runtime. This is what I call "dynamic accessibility".
One approach that comes to my mind is :
We define the accessibility to each function that we want to protect (hide/unhide) in database tables. Then every time a use enter a page, read these tables through JDBC calls then store tha data in Managed Bean.
Has anybody here implement this "dynamic accessibility" ?
Is there a better approach ?
Thank you very much,
xtanto

Answer 1

Saeed,
SRDemo uses a managed bean that checks is user in role when called and returns true or false. Another approach - more elegant - is the use of a security property resolver as available
http://jsf-security.sourceforge.net
Regarding dynamic permissions, the use of JAAS seems to be a good solution. ADF Security uses JAAS permissions to assign component access to users.
E.g. if the user role manager has access to edit the salary column, then the security constraint added to the update button could be
#{!bindings.<attribute binding>.updateable}
Note that ADF Security sets the updateable flag on an attribute.
Or you use
#{bindings.<iterator binding>.permissionInfo.create}
#{bindings.<attribute binding>.permissionInfo.update}
#{bindings.permissionInfo['pageDefName'].view}
etc. to determine what a user can do or can't.
Note that I haven't tested if the permissions are cached for a specific application or if they are checked each time again. If they are checked each time then this would be a performance penalty but allows to dynamically set permissions to user groups as obviously needed in your applications.
No, we don't have tutorial for this. But a Oracle By Example for end-to-end security implementation is on my collateral plan for JDeveloper 11 (just need to write a doc writer ;-) )
Frank