Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Your Suggestion Please

Posted on 2006-11-08
8
Medium Priority
?
181 Views
Last Modified: 2010-03-31
Hi,

I would like to control the security access based on user login. So if admin is logged in, they will see menu A, B and C. However, if normal user is logged in, they will only see menu A and B.

This would be a very dynamic menu management where there is another tool to add a new menu with a new URL and assign it to either role or to both roles.

Menu_ID    Menu_Name    Menu_URL    
1               A                   /whatever.do

Menu_Id    Role
1              admin

Now, after logged in, I have been able to control the display of the menu. Now I would like to know all of your opinions about how to handle the possibility that the normal user manually typed in the URL of the menu C which is only authorised to admin. I am actually using WebLogic but I think that the solution should be similar.

I have seen the request.isUserInRole(String role). However, can I assign this role in the runtime so after admin logged in, if I do request.isUserInRole("admin") will return true? And currently, the login is handled by LDAP (Active Directory).

Thanks
David
0
Comment
Question by:suprapto45
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 92

Expert Comment

by:objects
ID: 17904608
u should also be blocking access to url based on the users role using a servlet filter for example
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17904780
Thanks objects,

Can you give me more details? So I assume that the Filter will detect for *.do (Struts based) and check whether the URL is authorised to him or her right?

However, in DB, I may store only the URL such as /test/first.do. However, once it goes to first.do, the user may go to second.do and third.do. Does it mean that you want me to store all these *.do to DB?

Thanks and I will be back in 1 hour time

David
0
 
LVL 92

Assisted Solution

by:objects
objects earned 2000 total points
ID: 17904844
if u want to stop people accessing certain url's you'll need to specify them somewhere :)
url mappings may be able to be used for specify them.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 16

Author Comment

by:suprapto45
ID: 17910926
Hi objects,

Sorry for the late reply. However, my role is defined from the DB and not from the realm, can I still do the url mappings? If so, do you have any URL for me to refer to?

Thanks
David
0
 
LVL 92

Accepted Solution

by:
objects earned 2000 total points
ID: 17910938
sorry what i meant was you could use url patterns to specify your access control.
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17910958
mmmm...interesting.

Is this URL Pattern configured in web.xml? Do you have any URL for this?
0
 
LVL 92

Assisted Solution

by:objects
objects earned 2000 total points
ID: 17910972
no you'd need to implement it yourself.
Other alternative is to use an existing security framework (eg. acegi) instead of building it all yourself.
0
 
LVL 16

Author Comment

by:suprapto45
ID: 17910983
>>"no you'd need to implement it yourself."
I have expected this :)

Thanks objects.

David
0

Featured Post

Build and deliver software with DevOps

A digital transformation requires faster time to market, shorter software development lifecycles, and the ability to adapt rapidly to changing customer demands. DevOps provides the solution.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

After being asked a question last year, I went into one of my moods where I did some research and code just for the fun and learning of it all.  Subsequently, from this journey, I put together this article on "Range Searching Using Visual Basic.NET …
For beginner Java programmers or at least those new to the Eclipse IDE, the following tutorial will show some (four) ways in which you can import your Java projects to your Eclipse workbench. Introduction While learning Java can be done with…
This tutorial covers a practical example of lazy loading technique and early loading technique in a Singleton Design Pattern.
This tutorial explains how to use the VisualVM tool for the Java platform application. This video goes into detail on the Threads, Sampler, and Profiler tabs.
Suggested Courses

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question