Re: Fwd: question about barracuda and security

Hi,

we did implement a more lightweight security protocol using Polymorphic 
events. Thus for every event that is dispatched, its superclass is 
created and dispatched before. In the corresponding eventhandler you can 
access the original event received and (user, event) then msaps into 
your security policy. Did I make myself clear here?

Diez

>> I am an enterprise application novice and my team and I are having the 
>> following design issues conceiving our J2EE financial application. We 
>> developed along with a partner a framework that hides the complexity 
>> of EJBs and rather focuses on the business. We divided our application 
>> into separate services (Audit service, notification service, enquiry 
>> service, currency service, fund service, security service and so 
>> on...) each service is accessed through a session facade. As a 
>> presentation layer we used the Baraccuda presentation framework and so 
>> far it seems to fit pretty well in the entire application. The issue 
>> we're having right now is security. We have implemented a security 
>> service that holds and manages all the users of the application and 
>> their profiles. We would like to know what is the best option to 
>> implement this feature. To be more precise, let's consider E-Trade 
>> website. Users, depending on their profiles, get different menus of 
>> command to execute. We would like! to do something similar. In our 
>> desing each command in any service takes a user reference as a 
>> parameter to check if this user is allowed to execute the given or 
>> not. In our solution we would like to avoid the situation where a user 
>> types the URL of a command (an event in Baraccuda) that s/he is not 
>> allowed to execute. I've had some servlet development in the past and 
>> I know that you can setup the container so that you can assing certain 
>> URLs with certain roles but obviously this is a more complicated 
>> situation.