Spring Acegi - Social Network platform

Question

Can spring Acegi security be used for a social networking application where users can set their security preferences to share their data only with their friends?

The common scenario of the Acegi tutorials is where you want to authorize actions per user role, but what about authorizing users to view specific data, say, only their friends'?

Is it possible to use Acegi for that? How?

Answer 1

Short answer: yes.

Note that Acegi is now part of Spring, and is now known as Spring Security.

As to how to it, that's a much more complicated question, and likely has as many right answers as those willing to try. Your final solution will depend on the needs of the app your developing, the environment your in, and the organization you are designing for. I'll assume that you want everyone (or most) to see the basic information, and that the sensitive information only appears on the page if the requester is a friend.

I believe the most basic means of all will involve using the SecurityContext within your servlet/controllers/resources (far too many ways to design a web app to make assumptions here), and page templates (jsf, jsp, etc..., etc..), to get get access to the currently authenticated user, and include only the information that user is allowed to access.

Answer 2

The fundamental elements of Spring Security are

- Security Interceptor
  - Authentication Manager
  - Access Decision Manager 
  - Run-As Manager
  - After-Invocation Manager

The actual implementation of a security interceptor will depend on what resource is being secured. If you’re securing a URL in a web application, the security interceptor will be implemented as a servlet filter. But if you’re securing a method invocation, aspects will be used to enforce security.

A security interceptor does little more than intercept access to resources to enforce security. It does not actually apply security rules. Instead, it delegates that responsibility to the various managers.

Through using proper manager(s) you will manage to fulfill your requirements.

Reference: Manning Spring in Action 2nd Edition August 2007