It's not a secret anymore!
The moose likes Java in General and the fly likes Security System Design Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login
JavaRanch » Java Forums » Java » Java in General
Bookmark "Security System Design" Watch "Security System Design" New topic

Security System Design

Raghvendra Sharma
Ranch Hand

Joined: Oct 09, 2000
Posts: 82
Hi friends,
Currently we are onto a project which has a security module.
Here we have to manage access to various resources relating to different users, roles, groups and of course the resouces (objects).
The groups can contain users as well as groups. And same for roles. The objects may grant access to roles and/or groups.
We are looking into a number of different ideas for implementation of the logic. One of them includes having tree structure.
I would appreciate if i could get some more valuable ideas.
thanks in advance,
Frank Carver

Joined: Jan 07, 1999
Posts: 6920
You've done a fine job of describing the data structure of your proposed system, but you haven't told us what operations you will need to do on it. Choosing a representation for data usually depends more on how you want to use the data than what it contains.
Do you need it to be set up for fast queries or fast updates? What sort of questions will the system routinely be asked? Will access to things typically be specified in terms of by a single role, several different roles, named group of roles, several named groups of roles, a single user, several named users, a named group of users, a mixture of users names and roles etc.?

Read about me at ~ Raspberry Alpha Omega ~ Frank's Punchbarrel Blog
Raghvendra Sharma
Ranch Hand

Joined: Oct 09, 2000
Posts: 82
Hi Frank,
Thanks for your response.
Let me try to explain some of the typical operations that we may need. The simplest one can be change in the user priveleges or change in the object access level. Other than that there can be requirements for restructuring of roles or groups ( as i mentioned that there could be a case where groups/roles are themselves composed of other groups/roles ).
The access level speficied could be either a group of groups and/or roles or users only. So we have to try to make it more and more generic.
Of course we want to make it optimized for faster queries, since the number of queries fired shall be much greater than the change in the access levels etc. But at the same time we can not allow to degrade the upgrade performence too much since the activity shall be there, if not very frequent. We actually need to view it in terms creation of user groups /users, which shall be quite frequent.
I agree. Here's the link:
subject: Security System Design
It's not a secret anymore!