Authorization engine in java

Question

In the course of my work i need to develop an authorization engine ( i'm already authenticated and i check access of a user to an action ) in order to store all the authorization logic inside a same place and be able to reuse it and i have created the mini library.

http://github.com/eltados/canny

what do you think about it?

Is there any lightweight Authorization engine library i could have a look at?

Answer 1

I'd use Spring Security before I developed anything of my own. Authorization and authentication are cross-cutting concerns. Spring properly puts them in aspects that you can configure down to the method level.

Answer 2

I only had a brief look and was wondering whether you had considered the following questions:

• I'm not a fan of using a static attribute to store the Authorisation object and all the rules, this could lead to problems in clustered environments or when multiple applications share an appserver (I'm thinking shared classloader problems with JBoss here)
• The canny engine provides no out-of-the-box functionality for dynamically accessing authorisation stores. As far as I can tell in order to get user/permission information from LDAP or a database, a custom rule needs to be created.
• I'm not sure whether having the definitions of the rules in code is the best place, as it will mean having to rewrite/rebuild/redeploy code to change the rules.

Note, maybe I have misunderstood some of the concerns, but the readme and test classes were a little bit sparse.

Personally, Spring Security has been my Authentication/Authorisation framework of choice.

Hope that helps.