Using PolicyConfiguration in an application

[ebu]

Hi.
There is a need to implement database-driven security layer with minimal possible coding. The administrator should have ability to manage roles, users, privileges and so on via web services interface. Investigating this problem i came to the solution of using PolicyConfiguration to set all necessary permissions in PolicyContext which makes all work done. It looks like

PolicyConfigurationFactory pcFactory = PolicyConfigurationFactory.getPolicyConfigurationFactory();
 PolicyConfiguration pc = pcFactory.getPolicyConfiguration("my.jar", true); //TODO

 pc.addToRole("admin", new EJBMethodPermission("MyFacade", "MyEndpoint", MyFacade.class.getMethod("testAuth", new Class[] {})));

In the real app operation name ("testAuth") and role name ("admin") will be read from the DB.

The only doubt i have is how legal is using PolicyConfiguration in the application since javadoc states that "The methods of this interface are used by containers"?


thanx, eugen.

[starksm64]

The only real restriction would be when running with a security manager, since you need permissions that are not typically assigned to an application. If it works, it works, but you should be proposing a mechanism that allows the extended permissions to be read in from a deployment descriptor so that its something the jboss security layer is supporting to avoid this from not working in the future.

[ebu]

Ok, thanx, but could you please point me to some info about extended permission? Google failed to find anything meaningful about this term but single line in the JBoss RoadMap.


wbr, eugen.

[starksm64]

No info exists. You need to make it up.