[Springframework-developer] Security Interceptor on display components

[Stephane B. <sba...@ap...>]

I have been talking yesterday with a client that has a need for a strong 
display component security (viewable/editable depending on roles).

Of course these roles are mostly dynamic and there will be a need for 
some kind of 'delegation' or flexibility on object and attributes.

It is not doable to modelize the roles strictly based on the real-life 
roles or as a set of information (as they will complain that the role is 
too strict and this will lead to a security issue where the supervisor 
will need to give full access to subalterns).

They must be be fine-grained.

There are a couple of frameworks that deals with display policy for 
components based on taglibs, more or less they just rewrite all visual 
components and there is a display policy (that could look similar to the 
declarative approache on EJBs) that decide whether or not they SKIP_BODY.

Frameworks that seem to do that are:

SweetDev, http://www.ideotechnologies.com/
Framework based on Struts developped for BNP Paribas Securities.
 From what I can see, it seems to include typical Springesque approach 
on component configuration (yet another container)

I seem to remember it is $3000 per developper and I think same price per CPU

Improve Struts Layout:
http://struts.application-servers.com/
A display policy can be used on visual components.

If you know of any other please.. bring them to my attention :)

I strikes me that this kind of visual component policy could be an 
interesting application of a security interceptor.

Not displaying the visual component does not seem to be the solution to 
me. I think it is better not to display the 'value' of the component 
(typically by using '****' when it is not viewable and disabling the 
component if it is not editable).

Not displaying the component (or a row in a table) may ruin the layout 
and pause massive problems of design to me. (especially as you have to 
deal with the labels of the component)

That means basically that we could have an interceptor (or aspect ?)
simply modifying the visual components.

- We need to intercept expression evaluation (display)
- We need to intercept taglib evaluation (edit box must be enabled/disabled)

What do you people think about this ?

Cheers,

Stephane