Solved

Your Suggestion Please

Posted on 2006-11-08
8
177 Views
Last Modified: 2010-03-31
Hi,

I would like to control the security access based on user login. So if admin is logged in, they will see menu A, B and C. However, if normal user is logged in, they will only see menu A and B.

This would be a very dynamic menu management where there is another tool to add a new menu with a new URL and assign it to either role or to both roles.

Menu_ID    Menu_Name    Menu_URL    
1               A                   /whatever.do

Menu_Id    Role
1              admin

Now, after logged in, I have been able to control the display of the menu. Now I would like to know all of your opinions about how to handle the possibility that the normal user manually typed in the URL of the menu C which is only authorised to admin. I am actually using WebLogic but I think that the solution should be similar.

I have seen the request.isUserInRole(String role). However, can I assign this role in the runtime so after admin logged in, if I do request.isUserInRole("admin") will return true? And currently, the login is handled by LDAP (Active Directory).

Thanks
David
0
Comment
Question by:suprapto45
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 92

Expert Comment

by:objects
ID: 17904608
u should also be blocking access to url based on the users role using a servlet filter for example
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17904780
Thanks objects,

Can you give me more details? So I assume that the Filter will detect for *.do (Struts based) and check whether the URL is authorised to him or her right?

However, in DB, I may store only the URL such as /test/first.do. However, once it goes to first.do, the user may go to second.do and third.do. Does it mean that you want me to store all these *.do to DB?

Thanks and I will be back in 1 hour time

David
0
 
LVL 92

Assisted Solution

by:objects
objects earned 500 total points
ID: 17904844
if u want to stop people accessing certain url's you'll need to specify them somewhere :)
url mappings may be able to be used for specify them.
0
PeopleSoft Has Never Been Easier

PeopleSoft Adoption Made Smooth & Simple!

On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool.  Claim Your Free WalkMe Account Now

 
LVL 16

Author Comment

by:suprapto45
ID: 17910926
Hi objects,

Sorry for the late reply. However, my role is defined from the DB and not from the realm, can I still do the url mappings? If so, do you have any URL for me to refer to?

Thanks
David
0
 
LVL 92

Accepted Solution

by:
objects earned 500 total points
ID: 17910938
sorry what i meant was you could use url patterns to specify your access control.
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17910958
mmmm...interesting.

Is this URL Pattern configured in web.xml? Do you have any URL for this?
0
 
LVL 92

Assisted Solution

by:objects
objects earned 500 total points
ID: 17910972
no you'd need to implement it yourself.
Other alternative is to use an existing security framework (eg. acegi) instead of building it all yourself.
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17910983
>>"no you'd need to implement it yourself."
I have expected this :)

Thanks objects.

David
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
ejb wildfly example 2 113
java.sql.SQLException: Access denied for user 'root'@'localhost' (using password: NO) 1 93
java mysql insert application 14 68
Java List 4 76
Java had always been an easily readable and understandable language.  Some relatively recent changes in the language seem to be changing this pretty fast, and anyone that had not seen any Java code for the last 5 years will possibly have issues unde…
Introduction This article is the last of three articles that explain why and how the Experts Exchange QA Team does test automation for our web site. This article covers our test design approach and then goes through a simple test case example, how …
Viewers learn about the “for” loop and how it works in Java. By comparing it to the while loop learned before, viewers can make the transition easily. You will learn about the formatting of the for loop as we write a program that prints even numbers…
This tutorial covers a step-by-step guide to install VisualVM launcher in eclipse.
Suggested Courses

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question