Re: [Springframework-developer] Re: Security Interceptor on display components

[Andy D. <an...@ma...>]

Our current plan is to adapt something we already have in place for our 
service interfaces.  Basically, we have an aspect for our services that 
allows you to declaratively define the roles allowed to access properties on 
data objects (this is done on a Java class + property name basis).  So, for 
example, I may say that only the hr_management role can access the "salary" 
property of the "com.mypackage.Employee" class.  All objects returned from a 
service method are filtered based on these declarative access rules.  For 
protected properties, the property setter method is used to change the value 
of the property to a "secured" value (also defined in the configuration).  
Thus, no secure values ever leave a service.  This is important for remote 
service invocation, as it is not enough to simply deny access to a property 
via an aspect - you must also be sure that the value of the property is not 
transmitted over the wire.  There is also a service available to get a 
"security map" for a particular data object class (basically a Map that uses 
the property name as key and the allowed access for the current user as 
value).  We are thinking of integrating this security map into the UI in some 
sleek automatic fashion.. but if someone out there has an already cooked up 
solution, we would be open to changing our plans. :-)

  - Andy

PS the challenge for us when we implemented this type of security was when the 
client sends those modified data objects back to the service (to an 'update' 
method, for example).  You really wouldn't want Hibernate to persist the 
modified property values back to the DB.

On Thursday 08 July 2004 09:47 am, Stephane Bailliez wrote:
> - it means that we must have an object filter that replaces for example
> the sensitive value returned via get methods with a "***"....
> ...
> Stephane
>
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by Black Hat Briefings & Training.
> Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
> digital self defense, top technical experts, no vendor pitches,
> unmatched networking opportunities. Visit www.blackhat.com
> _______________________________________________
> Springframework-developer mailing list
> Spr...@li...
> https://lists.sourceforge.net/lists/listinfo/springframework-developer