Data-related security Implementation

Question

Using Shiro we have a great security framework embedded in our enterprise application running on GF. You define users, roles, permissions and we can control at any fine-grain level if a user can access the application, a certain page or even click a specific button.

Is there a recipe or pattern, that allows on top of that, to restrict a user from seeing certain data ?

Sample: You have a customer table for 3 factories (part of one company). An admin user can see all customer records, but the user at the local factory must not see any customer data of other factories (for whatever reason).

Te security feature should be part of the role definition.

Thanks for any input and ideas

Answer 1

Add one or more security tables to your application that contain UserID and a foreign key to the Primary Key of the table containing the resource to be securitized.

Create records in the new table for each User/Resource combination that you want to grant access.

Then, when the resource is requested from the database, just join the security table to the resource table using the Resource keys, and filter on the UserID of the security table for the user that is currently logged in. This will trim the output, removing any records for which the user does not have access.

It is relatively straightforward to create forms that allow you to set up the new records in the security table granting users access to resources.

NOTE: In the specific case that you mentioned, you just need a field in the User database that holds the value of the Primary Key in the customer database for which the user has access.