Data Access control in J2EE technologies

Question

Hi Guys,

I am working on a project that requires that i implement a mechanism for controlling data access to the content that displayed on the pages.

First off to clarify, i am not refering to the ability for different users to log on to a specific page and or view specific pages. That is a different type of access control. I am more interested in the "Data Access" i.e. where multiple users can view the same page but the data that is displayed depend on the data access control privileges they have.

I am intersted to know of the different approaches out there to implementing "data access" control. is there a framework out there for this kind of thing? I am currently using Struts.

Im thinking to do this, i will need to somehow to categorise and store the kinds of data i keep and which configure which users can view/amend it. I want to try and avoid produce something completely from scratch so im wondering how the experts do this and what frameworks technologies assist them in doing it.

Thanks

Answer 1

You are looking for a authorization solution? Have you already checked JAAS, OSUser and similars? The authentication requirements can vary greatly, i think you need to be more specific, try adding a use case.

Answer 2

I guess you need Spring Security Framework. With this framework, you assign different roles to different users. For example, we can define two roles: ROLE_USER, ROLE_ADMIN. Then we assign those roles to users. For example, a user A can have only one role, ROLE_USER and a user B can have both of the roles. Now if on a particular JSP, you want to show something to user B only, you can put the code into a pair of authorization tags:

<sec:authorize ifAllGranted="ROLE_USER, ROLE_ADMIN">
     <!-- html, jsp scriplets, jstl tags inside here will be visible to user B only --> 
</sec:authorize>

Similarly if you want to show something to both of them:

<sec:authorize ifAllGranted="ROLE_USER">
     <!-- anything inside here will be visible to both users --> 
</sec:authorize>

Hope it helps.