JAAS dynamic role-based security with a custom Policy?

[ikarpov]

Hi,

I am working on a set of web applications that use JDO to authenticate the user against an Oracle database. We are thinking of implementing dynamic role-based security, by which I mean the following:

There are Users, Roles, and Rights. Each user has one or more Roles and each Role has zero or more Rights. Speaking in terms of JAAS, these are Subjects, Principals and Permissions respectively. Rights are static and designed into our application code. Users, Roles, Users->Role and Role->Right mappings are all dynamic, i.e. can be changed while the application is running.

I would love to see an application server that will let me do both authentication AND authorization for such a system with JAAS. I don't want to extend or import anything specific to the application server in my code. I can easily write a custom LoginModule to authenticate a subject, and I can implement a Policy that checks for the right permissions for our application.

My question is, can I use a custom java.security.Policy with JBoss? If not, how can I implement such a security model in a portable manner?

Thank you.

--Igor.

[wdrai]

This integration of JAAS authorization into J2EE is the goal of the JACC specification.
For example, you could have your web permissions managed by the JAAS Policy provider instead of being statically defined in web.xml.

I suppose it will be supported by jboss as it is required for J2EE 1.4 containers, but for the moment only the J2EE 1.4 RI (and perhaps the WebSphere early developer release) seems to support this.

[perwik]

Now, about two years later I found this thread and I'm wondering what this looks like today? I'd like to implement something that works almost exactly like what the original poster describes, but I've got a hard time finding info about how to do this, if it is possible with Jboss today.

"ikarpov" wrote:
Hi,
There are Users, Roles, and Rights. Each user has one or more Roles and each Role has zero or more Rights. Speaking in terms of JAAS, these are Subjects, Principals and Permissions respectively. Rights are static and designed into our application code. Users, Roles, Users->Role and Role->Right mappings are all dynamic, i.e. can be changed while the application is running.

[anil.saldhana]

Maybe information saved in ldap and a custom ldap jaas module.

[perwik]

Well, saving Users, Roles and Permissions in some sort of storage and then getting them out of there shouldn't be much of a problem. What I'm thinking about is how to say that a certain EJB method requires a certain Permission. There is @RolesAllowed but I haven't found anything like @RequiredPermission. If I make my own anotations for it, what would I need to hack to check against them?

[starksm64]

The jacc integration aspect. When I get around to updating the out of date jaas tutorial to cover ejb3 I will look at what is needed in more detail.