AppFuseSecurityMethods2

In Part I of this tutorial we got basic Method Invocation security working. But there still remains some holes in the security of our User object at the service level. For example if someone could get the controller to run UserManager.saveUser() on someone other than themselves, there is nothing at the service level to stop them.

This tutorial adds object specific security into the mix. Another way to accomplish this would be to use an access control list, but that solution may be a bit heavy for many apps. So ACL's will be a tutorial but not included in the core of AppFuse. So without getting into ACL's we can still secure our objects by making sure the user who is authenticated can only retreive, edit or delete his User object.

Table of Contents

• [0] Prerequisites
• [1] Add UserManager.updateUser() method
• [2] Modify txProxyTemplate configuration
• [3] Create the OwnerVoter
• [4] Modify userManagerSecurity configuration
• [5] Test All

Prerequisites [#0]

Add UserManager.updateUser() method [#1]

We need to add or modify the following code to these classes: UserManagerTest.testSaveUser() change:

        userManager.saveUser(user);

        userManager.updateUser(user);

UserManager add:

    public void updateUser(User user) throws UserExistsException;

UserManagerImpl add:

    public void updateUser(User user) throws UserExistsException {
        saveUser(user);
    }

UserAction.save() change:

        mgr.saveUser(user);

        mgr.updateUser(user);

Modify txProxyTemplate configuration [#2]

    <bean id="txProxyTemplate" abstract="true"
        class="org.springframework.transaction.interceptor.TransactionProxyFactoryBean">
        <property name="transactionManager"><ref bean="transactionManager"/></property>
        <property name="transactionAttributes">
            <props>
                <prop key="save*">PROPAGATION_REQUIRED</prop>
                <prop key="update*">PROPAGATION_REQUIRED</prop>
                <prop key="remove*">PROPAGATION_REQUIRED</prop>
                <prop key="*">PROPAGATION_REQUIRED,readOnly</prop>
            </props>
        </property>
    </bean>

Create the OwnerVoter [#3]

Modify userManagerSecurity configuration [#4]

The OwnerVoter only works on Method Invocation security, so we now need to have a seperate accessDecisionManager for userManagerSecurity bean from the one being used for URI security.

    <bean id="businessAccessDecisionManager" class="net.sf.acegisecurity.vote.AffirmativeBased">
        <property name="allowIfAllAbstainDecisions"><value>false</value></property>
        <property name="decisionVoters">
            <list>
                <ref local="roleVoter"/>
                <ref local="userOwnerVoter"/>
                <ref local="usernameStringOwnerVoter"/>
            </list>
        </property>
    </bean>

You will notice that businessAccessDecisionManager now has references to a couple of new beans based on OwnerVoter. The first one looks for methods that have an argument of type User and grants access when the authenticated user's username matches User.getUsername() on that object.

    <bean id="userOwnerVoter" class="org.appfuse.security.OwnerVoter">
        <property name="processConfigAttribute">
            <value>OWNER_USER_EQUALS</value></property>
        <property name="processDomainObjectClass">
            <value>org.appfuse.model.User</value></property>
        <property name="internalMethod">
            <value>getUsername</value></property>
    </bean>

The second bean is for methods that are passed a username String rather than the entire object. In this case the string is compared to the authenticated user's username

    <bean id="usernameStringOwnerVoter" class="org.appfuse.security.OwnerVoter">
        <property name="processConfigAttribute">
            <value>OWNER_STRING_EQUALS</value></property>
        <property name="processDomainObjectClass">
            <value>java.lang.String</value></property>
        <property name="internalMethod">
            <value>toString</value></property>
    </bean>

Next we need to update the userManagerSecurity defintion to utilize the OwnerVoter's we just defined.

   <bean id="userManagerSecurity" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor">
      <property name="authenticationManager"><ref bean="authenticationManager"/></property>
      <property name="accessDecisionManager"><ref local="businessAccessDecisionManager"/></property>
      <property name="objectDefinitionSource">
         <value>
            org.appfuse.service.UserManager.getUser=admin,OWNER_STRING_EQUALS
            org.appfuse.service.UserManager.getUsers=admin
            org.appfuse.service.UserManager.removeUser=admin,OWNER_STRING_EQUALS
            org.appfuse.service.UserManager.updateUser=admin,OWNER_USER_EQUALS
         </value>
      </property>
   </bean>

Test All [#5]

OwnerVoter.java

12677 bytes