RE: URL pattern /admin/*

> I think the majority of webapps have an admin part and a public part.
> How do you separate these parts?

I'd agree with this. I can't speak for how everyone does it, but I can
describe how we do it. Basically, all the security is implemented in the
application - we are not relying on the webapp or the OS to do any
authentication. Consequently, we control everything via event
hierarchy...our event hierarchy might look something like this:

HttpRequestEvent
    PublicEvent
        GetLogin
        DoLogin
        GetEmailPassword
        DoEmailPassword
        ...
    AuthEvent
        NormalEvent
            ...
        AdminEvent
            ...

All "Admin" events would extend from AdminEvent, and we could secure them by
writing one handler to make sure that the person really is an admin.

Now, there are some limitations to this, and we don't define our event
hierarchy quite like I've given above - basically, we distinguish between
public and authenticated (ie. valid, logged in user) events in the
event-hierarchy.xml file; we find that in our apps "admin" funtionality cuts
cross-sectionally across the main event hierarchy, so we end up securing
individual events handlers like this:

    class GetCommissioningHandler extends AppEventListener {
        public void handleSQLControlEvent(ControlEventContext context)
throws EventException, ServletException, IOException, SQLException,
ValidationException {
            //first and foremost, make sure the user has admin privileges
            //(if not, redirect them)
            UserMap um = AppUtil.getCurrentUser();
            if (!um.isAdmin()) throw new InterruptDispatchException(new
RenderNotAuthorized());

            //redirect to the RenderCommissionResults handler
            context.getQueue().addEvent(new RenderCommissioning());
        }
    }

Now, this works well, but it can still use improvement - I'd like to get to
where we can say events in the hierarchy "implement" certain behaviour, like
Admin functionality, etc. The point however, is that we are implementing
security in the app, rather than letting the OS or the Webapp do it for us.
And if we do this, then there's really no need to set up separate
ApplicationGateways or separate paths...

That help?

Christian
----------------------------------------------
Christian Cryder [[email protected]]
Internet Architect, ATMReports.com
Barracuda - http://barracuda.enhydra.org
----------------------------------------------
"Coffee? I could quit anytime, just not today"

> -----Original Message-----
> From: [email protected]
> [mailto:[email protected]]On Behalf Of Andras Balogh
> Sent: Wednesday, January 15, 2003 8:50 AM
> To: [email protected]
> Subject: Re: [Barracuda] URL pattern /admin/*
>
>
>
> ----- Original Message -----
> From: "Christian Cryder" <[email protected]>
> To: <[email protected]>
> Sent: Wednesday, January 15, 2003 17:33
> Subject: RE: [Barracuda] URL pattern /admin/*
>
>
> > Hi Andras,
> >
> > Well, the way things are currently implemented, anything that ends with
> > *.event gets routed to ApplicationGateway (which youy are seeing), and
> > ApplicationGateway then tries to determine the event name. It does this
> > first by looking at the servlet path info, and if that is null, then it
> uses
> > the actual URI name. In this case, the path is coming back as
> 'admin', and
> > so Barracuda thinks that is the event name you are after (which
> it isn't).
> >
> > Before I venture a guess at possible solutions, can you give us soime
> > insight into what you are trying to accomplish here? Why do you want to
> use
> > the /admin path to precede the actual event? Why not just use the event
> > name? Or perhaps something like
> > http://myhost/mywebapp/GetLogin.event?Admin=true
> >
> > Help us understand what you're after here...
> >
> > Thanks,
> > Christian
> > ----------------------------------------------
> > Christian Cryder [[email protected]]
> > Internet Architect, ATMReports.com
> > Barracuda - http://barracuda.enhydra.org
> > ----------------------------------------------
> > "Coffee? I could quit anytime, just not today"
> >
>
>     Hi,
>
> Thank you for answering.
> So here is what i am trying to do, i have a webapp that has an admin part
> and a public part. I want to separate these 2 parts as much as
> possible so i
> have
> different event.xml files, different application gateways etc.
> Now one choice would be i guess to name the public events and admin events
> differently like *.event and *.aevent   but i don't like this solution.
> I need the admin events accessed only with path /admin/ to can
> apply further
> security constraints to a certain path (in my case /admin/) if it will be
> necessary.
>
> I think the majority of webapps have an admin part and a public part.
> How do you separate these parts?
>
> Thanks,
> Andras.
>
>
>
>
>
>
>
> _______________________________________________
> Barracuda mailing list
> [email protected]
> http://barracudamvc.org/lists/listinfo/barracuda