Feb 23rd, 2006, 02:33 AM
Design problem: instance-based ACL for the following architecture
The application I'm working on must implement some kind of instance-based security. There are several 'approaches' for doing this, but I would like to have some feedback from those who have experience with this.
Let me start my sketching the scenario:
there are several domain objects (hibernate) which are linked to a role table, that role table is actually an n-n with a facility table. (ps the facility table is essential is the whole application so I can't get rid of that one).
So for example:
- objectX belongs to facilityA and facilityB, so there are 2 rows in the role table which represent the links between the facilities above and objectX.
- People belong to facilityA may only see the domain object which are linked through the role table to that facility.
So ... what option da I have?
- Making custom queries which add some extra statements to the where clause. But this has effect on all my domain object in such a scenario, and there are too many possible queries for which those extra statements need to be added ... so I'm afraid that this will have a bad impact on maintenance. If not regarding maintenance ... how what appraoch can be used ... some kind of interception?
- Retrieving all my domain objects and filtering them in the business layer (manual). Perhaps some kind of interception can be used here?
- Last one are the Acegi ACL's ... I started reading the docs but I'm not sure that this technology can be used for my situation. I've seen that extra tables and so are needed .... So can ACL be used here? Is it possible to use ACL for checking the dmaon objects authorization using the role table (see above)?
Mar 6th, 2006, 07:53 AM
Yes, the last approach you mentioned will work fine. You just need to provide your own implementation of BasicAclDao, which is recommended in any event. The implementation will talk to your custom tables to reflect ACL information.