JAAS is a secure role based access control?

[wizumwalt]

Hi all,

I'm getting ready to do an application that requires a user with a certain role (admin, visitor, consultant, etc...) to login w/ name and password, and once logged in, will have different permissions and views within the web app depending upon the category (or role) that user is in.

I've not done JAAS but am wondering if this is what I should be looking at?

Any suggestiosn, comments, advice much appreciated.

[jaikiran]

Have a look at Section 8.2 at:

http://docs.jboss.org/jbossas/jboss4guide/r2/html/ch8.chapter.html

[wizumwalt]

Thanks, but that didn't help much as I've not worked security before and have more basic questions. I don't really understand JAAS yet and ... let me post my question like this.

I will have thousands of users, each having a specific role of which there are about 4-8 different user roles such as admin, consultant, sales, user, etc? and they need to login into the system with a user and passwd and depending on the type of role they play, they are only shown certain web pages.

I am using Jboss and Spring MVC and don't know what technology to use such as JAAS (or Jboss JAAS), TAI, or Acegi (or Spring Acegi).

Can anyone suggestion as to what would fullfill my needs here or even if I'm looking in the right area here?

[icecuber]

"wizumwalt" wrote:
Thanks, but that didn't help much as I've not worked security before and have more basic questions. I don't really understand JAAS yet and ... let me post my question like this.

I will have thousands of users, each having a specific role of which there are about 4-8 different user roles such as admin, consultant, sales, user, etc? and they need to login into the system with a user and passwd and depending on the type of role they play, they are only shown certain web pages.

I am using Jboss and Spring MVC and don't know what technology to use such as JAAS (or Jboss JAAS), TAI, or Acegi (or Spring Acegi).

Can anyone suggestion as to what would fullfill my needs here or even if I'm looking in the right area here?

I'm in the same situation... or even worse!! i'd like to put my access control list on a db because i'd like to search through it... for example.... the current user what special offer can access???

hi to all