Standard Entitlements Model

Question

I am currently building a Java financial application that I need to add entitlements to, and was wondering what approaches people have taken to solve this problem, and whether there are any third party Java libraries that people would recommend.

Currently I have a number of users that can be broadly categorised into roles (e.g. "trader"). Each role can have zero or more permissions associated with it (e.g. "create trade").

Design Decisions:

Is it better to have more general permissions (e.g. "trade") plus accompanying actions ("create", "update", "delete") or more descriptive permissions ("e.g. "create trade")?

What's a good way to model the fact that some permissions are parameterised (e.g. User X has permission "create trade" but only for stocks traded on the LSE)? I've seen this done as name-value pairs before, but that seems fairly ugly. My only thought idea here is to implement Permission as a visitor (see example code below) but am concerned the interface could become unwieldy (as the #business objects increases).

public interface Permission {
  void checkPermission(Trade trade) throws SecurityPermission;
  void checkPermission(AnotherBusinessObject obj) throws SecurityPermission;
}

public class ExchangePermission implements Permission {
  private final Exchange exchange;

  public void checkPermission(Trade trade) {
    if (!exchange.equals(trade.getExchange())) {
      throw new SecurityException();
    }
  }
}

Any ideas / suggestions are more than welcome. Thanks in advance.

Answer 1

"Entitlements" is not the right term here - the established term is Capabilities, though "Permissions" is also widely used - and Java already has a Permission API that it uses to restrict code in a sandbox environment. See if you can use that instead of defining your own classes.

I'd say that some kind of callback design is going to be necessary, and the implies() method in the Java Permission API may also be useful.

Answer 2

Would be worth having a look at acegi which provides a great security framework and could save you a lot of work. And even if you don't use it thn it could at least give you some ideas on how you should implement it yourself.

Although Acegi is designed for use with Spring it is also possible to use it without Spring