Securing certain parts of an application.

Question

Hi,

If someone logs on to my application this user contains a dictionary with certain permissions.

ex: module.view.workspace = true
    module.view.reporting = false
    ...

Then we know to what parts of the application the user has access. What I want to know is how we can apply these permissions on the view. We are working in an AS 3 (FLEX) environment.

This is what we came up with so far (but I wanna have an idea of other possibilities). We have a modelLocator storing the loggedOnUser (which contains it's permissions). these permissions are added to a permissionObject in the modellocator. We Create a SecurityManager class that has a function called hasAccess("permission"). This object will check the PermissionObject in the modellocator and return true/false. In the view we just check if the user has access and then show the control.

If (SecurityManager.hasAccess("module.view.workspace") {
     // code that generates the workspace;
}

I just don't know if this is the best practice. Please help me out here.

Regards, Sem

Answer 1

Sem,

I have a similar method and it worked fine so far. My application is written in C#.NET but the method is still valid. Since mine is a WinForms application I have to do other stuff but basically there is at some point an If statement asking that very same "question".

Martin.

Answer 2

The approach is basically valid. I would recommend defining a class with static const that map to your different permissions and referencing that:

SecurityManager.hasAccess(SecurityManager.MODULE_VIEW_WORKSPACE)

This will save you a lot of manual search/replace work if you start to change the names of your permission items.