Solved

Your Suggestion Please

Posted on 2006-11-08
8
179 Views
Last Modified: 2010-03-31
Hi,

I would like to control the security access based on user login. So if admin is logged in, they will see menu A, B and C. However, if normal user is logged in, they will only see menu A and B.

This would be a very dynamic menu management where there is another tool to add a new menu with a new URL and assign it to either role or to both roles.

Menu_ID    Menu_Name    Menu_URL    
1               A                   /whatever.do

Menu_Id    Role
1              admin

Now, after logged in, I have been able to control the display of the menu. Now I would like to know all of your opinions about how to handle the possibility that the normal user manually typed in the URL of the menu C which is only authorised to admin. I am actually using WebLogic but I think that the solution should be similar.

I have seen the request.isUserInRole(String role). However, can I assign this role in the runtime so after admin logged in, if I do request.isUserInRole("admin") will return true? And currently, the login is handled by LDAP (Active Directory).

Thanks
David
0
Comment
Question by:suprapto45
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 92

Expert Comment

by:objects
ID: 17904608
u should also be blocking access to url based on the users role using a servlet filter for example
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17904780
Thanks objects,

Can you give me more details? So I assume that the Filter will detect for *.do (Struts based) and check whether the URL is authorised to him or her right?

However, in DB, I may store only the URL such as /test/first.do. However, once it goes to first.do, the user may go to second.do and third.do. Does it mean that you want me to store all these *.do to DB?

Thanks and I will be back in 1 hour time

David
0
 
LVL 92

Assisted Solution

by:objects
objects earned 500 total points
ID: 17904844
if u want to stop people accessing certain url's you'll need to specify them somewhere :)
url mappings may be able to be used for specify them.
0
Optimize your web performance

What's in the eBook?
- Full list of reasons for poor performance
- Ultimate measures to speed things up
- Primary web monitoring types
- KPIs you should be monitoring in order to increase your ROI

 
LVL 16

Author Comment

by:suprapto45
ID: 17910926
Hi objects,

Sorry for the late reply. However, my role is defined from the DB and not from the realm, can I still do the url mappings? If so, do you have any URL for me to refer to?

Thanks
David
0
 
LVL 92

Accepted Solution

by:
objects earned 500 total points
ID: 17910938
sorry what i meant was you could use url patterns to specify your access control.
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17910958
mmmm...interesting.

Is this URL Pattern configured in web.xml? Do you have any URL for this?
0
 
LVL 92

Assisted Solution

by:objects
objects earned 500 total points
ID: 17910972
no you'd need to implement it yourself.
Other alternative is to use an existing security framework (eg. acegi) instead of building it all yourself.
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17910983
>>"no you'd need to implement it yourself."
I have expected this :)

Thanks objects.

David
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you developing a Java application and want to create Excel Spreadsheets? You have come to the right place, this article will describe how you can create Excel Spreadsheets from a Java Application. For the purposes of this article, I will be u…
In this post we will learn how to connect and configure Android Device (Smartphone etc.) with Android Studio. After that we will run a simple Hello World Program.
This tutorial covers a practical example of lazy loading technique and early loading technique in a Singleton Design Pattern.
This tutorial will introduce the viewer to VisualVM for the Java platform application. This video explains an example program and covers the Overview, Monitor, and Heap Dump tabs.

630 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question