The primary function of CBA is to protect URLs. That's important, because if you can't
get to something, you cannot abuse it, and CBA ensures that unauthorized users are blocked even before getting to the application itself.
However, sometimes you want finer-grained control. A variation of what you're asking about that I've been known to do is present pages where some users can view (auditors) and some users can update (editors).
There are generally 2 parts to this sort of control. One is presentation, If you simply switch the input controls to readonly mode, you can physically inhibit auditors from being able to submit updates. But to be truly secure, you also need a second part, since a hacker can simply alter the page to re-enable the controls.
For that you need code in the backing bean. The good news is that it's pretty simple to do. The bad news is that JSF doesn't help much. In order to check the user's security roles, you have to obtain the HttpServletRequest, and since JSF is externally independent of such things, that means that you have to get the FacesContext and chase through it to get the request object.
To do that requires some fairly gnarly code and it potentially injects framework dependencies into what should otherwise be a POJO. To get around this, I usually implement a "JSFUtils" class that I use when I need access to the Servlet infrastructure. Also for general JSF utilitity, such as stuffing user-generated error messages into the JSF messages obbject. I can then replace this object with a mock object for
testing purposes. So that leaves me with stuff like this:
)
