AppFuseSecurityMethods2

This is version 5. It is not the current version, and thus it cannot be edited.
[Back to current version]   [Restore this version]

This tutorial adds object specific security into the mix. Another way to accomplish this would be to use an access control list, but that solution may be a bit heavy for many apps. So ACL's will be a tutorial but not included in the core of AppFuse. So without getting into ACL's we can still secure our objects by making sure the user who is authenticated can only retreive, edit or delete his User object.

Table of Contents

• [0] Prerequisites
• [1] Add UserManager.updateUser() method
• [2] Modify txProxyTemplate configuration
• [3] Create the OwnerVoter
• [4] Modify userManagerSecurity configuration
• [5] Test All

Prerequisites [#0]

Add UserManager.updateUser() method [#1]

We need to add or modify the following code to these classes: UserManagerTest.testSaveUser() change: Plugin insertion failed: Unsupported parameter 'userManager.saveUser'.

UserManager add:

UserManagerImpl add:

UserAction.save() change: Plugin insertion failed: Unsupported parameter 'mgr.saveUser'.

Modify txProxyTemplate configuration [#2]

    <bean id="txProxyTemplate" abstract="true"
        class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
        <property name="transactionManager"><ref bean="transactionManager"/></property>
        <property name="transactionAttributes">
            <props>
                <prop key="save*">PROPAGATION_REQUIRED</prop>
                <prop key="update*">PROPAGATION_REQUIRED</prop>
                <prop key="remove*">PROPAGATION_REQUIRED</prop>
                <prop key="*">PROPAGATION_REQUIRED,readOnly</prop>
            </props>
        </property>
    </bean>

Create the OwnerVoter [#3]

Modify userManagerSecurity configuration [#4]

The OwnerVoter only works on Method Invocation security, so we now need to have a seperate accessDecisionManager for userManagerSecurity bean from the one being used for URI security.

    <bean id="businessAccessDecisionManager" class="net.sf.acegisecurity.vote.AffirmativeBased">
        <property name="allowIfAllAbstainDecisions"><value>false</value></property>
        <property name="decisionVoters">
            <list>
                <ref local="roleVoter"/>
                <ref local="userOwnerVoter"/>
                <ref local="usernameStringOwnerVoter"/>
            </list>
        </property>
    </bean>

You will notice that businessAccessDecisionManager now has references to a couple of new beans based on OwnerVoter. The first one looks for methods that have an argument of type User and grants access when the authenticated user's username matches User.getUsername() on that object.

    <bean id="userOwnerVoter" class="org.appfuse.security.OwnerVoter">
        <property name="processConfigAttribute">
            <value>OWNER_USER_EQUALS</value></property>
        <property name="processDomainObjectClass">
            <value>org.appfuse.model.User</value></property>
        <property name="internalMethod">
            <value>getUsername</value></property>
    </bean>

The second bean is for methods that are passed a username String rather than the entire object. In this case the string is compared to the authenticated user's username

    <bean id="usernameStringOwnerVoter" class="org.appfuse.security.OwnerVoter">
        <property name="processConfigAttribute">
            <value>OWNER_STRING_EQUALS</value></property>
        <property name="processDomainObjectClass">
            <value>java.lang.String</value></property>
        <property name="internalMethod">
            <value>toString</value></property>
    </bean>

Next we need to update the userManagerSecurity defintion to utilize the OwnerVoter's we just defined.

   <bean id="userManagerSecurity" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">
      <property name="authenticationManager"><ref bean="authenticationManager"/></property>
      <property name="accessDecisionManager"><ref local="businessAccessDecisionManager"/></property>
      <property name="objectDefinitionSource">
         <value>
            org.appfuse.service.UserManager.getUser=admin,OWNER_STRING_EQUALS
            org.appfuse.service.UserManager.getUsers=admin
            org.appfuse.service.UserManager.removeUser=admin,OWNER_STRING_EQUALS
            org.appfuse.service.UserManager.updateUser=admin,OWNER_USER_EQUALS
         </value>
      </property>
   </bean>

Test All [#5]

OwnerVoter.java

12677 bytes