JAAS authorization in simple architecture

[Renat Zubairov]

Dear All,
I have a question concerning authorization strategies for Web tier. My assumptions:
1. Web tier is implemented using JSP or Velocity templates
2. Model is stored in the DB using ORM tool (Hibernate)
3. Model is directly accessable by the web tier, i.e. controller (Strust) get the model from the ORM and put in in the request context where it's accessed (readed) by JSP or Velocity templates.

I'm trying to implement security using JAAS and my security implementation is based on following assumptions:
1. No hardcoded policies - every access to the data (read or write) should be checked by the JAAS
2. I can't put JAAS permissions checks in the model because it's being readed and changed by ORM tool (for example during load of data from the database Hibernate creates an instance and then calls setter methods to fill object with data) therefore I need to put security checks (runAsPrivileged) to all controller (in MVC sence) classes which is not possible because I'm using Velocity which is reflection based;

So, I can't employ JAAS in my case
What is my mistake?

[Ryan Fernandes]

Hi Renat,
Please look at jGuard; and post your findings.
We're studying the framework too.

Cheers,
Ryan

[Charles GAY]

hi,
you should have a look at http://sourceforge.net/projects/jguard
my project (jGUard) resolve your problem (enable JAAS use for j2ee).
sincerly yours,
charles(diabolo512)

[Renat Zubairov]

Hello Ryan,

I've looked on it. It's quite ok, but it didn't solve my problem (as far as I figure out). BTW I'm need instance based authorization;
My problem is that I can't put a permission checking code in the model classes because those classes are modified not only by the clients (via controllers) but also by the ORM tool during load from the DB.
Example I have a model class:

public class User {
  private String name;
  private String password;
 
  public User { // Do nothing here }
  public String getName() { return name;}
  public String getPassword() { return password; }
  public void setName(String value) { name = value; }
  public void setPassword(String value) { password = value; }
}

If I put a permission checks in it it would looks like

public class User {
  private String name;
  private String password;
 
  public User { JAASUtil.checkCreation(this); }
  public String getName() {
    JAASUtil.checkReadAcces(this); 
    return name;
  }
 
  public void setName(String value) { 
    JAASUtil.checkWriteAccess(this);
    name = value; 
  }
  .... etc.
}

Then I've got an exception because my ORM tool (Hibernate) trying to instantiate and set a values from database. But Hibernate is not authorized (and it shouldnt I guess).

I've found one (bad) solution - put checks in the controller classes but this is really bad solution.
Another solution is AOP (AspectJ) i.e.
do checks in

 cflow(UserFlow) && (!cflow(HibernateFlow)) 

But you know, it's not standart solution.