RE: Access Control List pattern?

We have overriden a standard controlhandler which also checks wether or not
a user i allowed to 'execute' an event. Every event has it's list of allowed
roles mapped in an xml file. Our apps use that control event to implement
the code.
 
We're using WebLogic with a custom security realm. M$ Active Directory is
used for authentication and our securityrealm maps the user with the
J2EERole.
 
The business logic EJB's (SSB & CMP) are also protected with the same J2EE
roles. We check the security twice, once on web level and once on business
level (not every client is a webclient, can be another process).
 
Tomcat also suipport the Servlet api req.isUserInRole(role), but I have no
idea that you can implement a custom security provider.
 
This is a sample of the base control event.
 
public final void handleControlEvent(ControlEventContext context) throws
EventException, ServletException, IOException {
      ActivityInterface api = null;
      try {
         WorkFlowContext wfc = new BarracudaWorkFlowContext(context);
         Activity a = (Activity)context.getEvent();   
         api =
getActivityInterfaceFactory(context).createInterfaceForActivity(a);
         api.bind(wfc);         
         ActivityDescriptor ad=
api.getWorkFlowManager().getActivityXmlParser(a.getAppContext(),
wfc).getActivityDescriptor(a);
         if(!ad.isAccessibleForCurrentUser(context.getRequest())) {
            throw new GeneralFailureException("User " + api.getUserName() +
" is not authorized for the activity " + ad.getActivityName() + ".");
         }
         doControlPreCondition(api);
         doHandleControlEvent(api);
         doControlPostCondition(api);
      } catch (ClientSideRedirectException re) {
         throw re;
      } catch (Exception e) {
         // Display standard error page by putting a SystemErrorEvent on the
queue
         log.error(e.getClass().getName() + ":" + e.getMessage(), e);
         throw new InterruptDispatchException(
            "handleControlEvent " + this.getClass().getName(),
            new SystemErrorEvent(context.getEvent(), e),
            e);
      }
   }
 
Regards,
Merg

-----Original Message-----
From: Barr Bill P [mailto:[email protected]]
Sent: Monday, 19 May 2003 18:53
To: '[email protected]'
Subject: [Barracuda] Access Control List pattern?



Is there a general use pattern and implementation for user authorization
everyone uses with Barracuda? The example HR application in the Barracuda
vs. Struts paper is close to what I would like to do.

I was hoping to be able to use an LDAP server to store my ACLs, but I can
only use it for authentication purposes. This leaves me to implement my own
access control list in the database which will determine which users have
access to which applications and how much of each application they can use.

I have a couple of ideas for implementing and checking for groups/roles and
finer-grained priviledges, but I would like to read some of the group
wisdom. Any anecdotes, opinions, don't-do-this's and war stories would be
appreciated.

Thanks, in advance! 

Bill