Copy Page

You are not logged in. Any changes you make will be marked as anonymous. You may want to Log In if you already have an account. You can also Sign Up for a new account.

<p>The <strong>RoleBasedAccessProtocol</strong> aspect has two abstract pointcuts that needs to be defined in the aspect XML definition:</p>

<ul>
	<li><code>authenticationPoints</code> - picks out all points in the code where you want authentication to take place</li>
	<li><code>authorizationPoints</code> - picks out all points in the code where you want authorization to take place</li>
</ul>

<p>Example on how to define the security aspect (f.e. authenticate on facade methods and authorize on service methods):</p>

<table class="wysiwyg-macro" data-macro-name="code" data-macro-default-parameter="xml" style="background-image: url(/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGU6eG1sfQ&amp;locale=en_GB&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>
&lt;aspect class="security.RoleBasedAccessProtocol" 
        container="org.codehaus.aware.container.SpringAspectContainer">
    &lt;pointcut name="authenticationPoints" 
              expression="execution(* *..facade.*.*(..))"/>
    &lt;pointcut name="authorizationPoints" 
              expression="execution(* *..service.*.*(..))"/>
&lt;/aspect>
</pre></td></tr></table>

<p>AspectWerkz supports passing in parameters to aspects but since the definition of roles and permissions is hierachical it is hard to handle with key:value pairs only. Therefore this is a great showcase for the <a class="confluence-link" href="/display/AWARE/SpringAspectContainer" data-linked-resource-id="3419" data-linked-resource-type="page" data-linked-resource-default-alias="SpringAspectContainer" data-base-url="http://docs.codehaus.org">SpringAspectContainer</a> in which we can define the security permissions using Spring. </p>

<p>Simply add something like this to your <code>aware-config.xml</code> and put it on the classpath:</p>

<table class="wysiwyg-macro" data-macro-name="code" data-macro-default-parameter="xml" style="background-image: url(/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGU6eG1sfQ&amp;locale=en_GB&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>
&lt;bean id="org.codehaus.aware.security.RoleBasedAccessProtocol"
    class="org.codehaus.aware.security.RoleBasedAccessProtocol"
    singleton="false"
    init-method="intialize">

&lt;property name="type">
        &lt;value>JAAS&lt;/value>
    &lt;/property>

&lt;property name="roles">
        &lt;list>
            &lt;value>admin&lt;/value>
            &lt;value>jboner&lt;/value>
        &lt;/list>
    &lt;/property>

&lt;property name="permissions">
        &lt;list>
            &lt;bean class="org.codehaus.aware.security.Permission">
                &lt;property name="role">
                    &lt;value>jboner&lt;/value>
                &lt;/property>
                &lt;property name="className">
                    &lt;value>org.codehaus.aware.security.SecurityHandlingTest&lt;/value>
                &lt;/property>
                &lt;property name="methodName">
                    &lt;value>authorizeMe1&lt;/value>
                &lt;/property>
            &lt;/bean>

&lt;bean class="org.codehaus.aware.security.Permission">
                &lt;property name="role">
                    &lt;value>jboner&lt;/value>
                &lt;/property>
                &lt;property name="className">
                    &lt;value>org.codehaus.aware.security.SecurityHandlingTest&lt;/value>
                &lt;/property>
                &lt;property name="methodName">
                    &lt;value>authorizeMe2&lt;/value>
                &lt;/property>
            &lt;/bean>
        &lt;/list>
    &lt;/property>

&lt;/bean>
</pre></td></tr></table>

<p>In the first section:</p>

<table class="wysiwyg-macro" data-macro-name="code" data-macro-default-parameter="xml" style="background-image: url(/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGU6eG1sfQ&amp;locale=en_GB&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>
&lt;bean id="org.codehaus.aware.security.RoleBasedAccessProtocol"
    class="org.codehaus.aware.security.RoleBasedAccessProtocol"
    singleton="false"
    init-method="intialize">
</pre></td></tr></table>

<p>we are telling mapping the security aspect class to a name (in this case it is the same), then we tell Spring to use the prototype pattern and not instantiate the aspect as a singleton, finally the method that we should use to initialize the aspect.</p>

<p>In the next section:</p>

<p>we tell the aspect to use the JAAS security scheme. </p>

<p>Then we define the roles that we want to use:</p>

<table class="wysiwyg-macro" data-macro-name="code" data-macro-default-parameter="xml" style="background-image: url(/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGU6eG1sfQ&amp;locale=en_GB&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>
&lt;property name="roles">
    &lt;list>
        &lt;value>admin&lt;/value>
        &lt;value>jboner&lt;/value>
    &lt;/list>
&lt;/property>
</pre></td></tr></table>

<p>And finally we define the permissions. This is similar to how it is done in EJB: We define one permission by specifying which method in which class we want authorization to take place, then we bind this to a role (one of the roles<br />
previously define):</p>
<table class="wysiwyg-macro" data-macro-name="code" data-macro-default-parameter="xml" style="background-image: url(/plugins/servlet/confluence/placeholder/macro-heading?definition=e2NvZGU6eG1sfQ&amp;locale=en_GB&amp;version=2); background-repeat: no-repeat;" data-macro-body-type="PLAIN_TEXT"><tr><td class="wysiwyg-macro-body"><pre>
&lt;property name="permissions">
    &lt;list>
        &lt;bean class="org.codehaus.aware.security.Permission">
            &lt;property name="role">
                &lt;value>jboner&lt;/value>
            &lt;/property>
            &lt;property name="className">
                &lt;value>foo.bar.Baz&lt;/value>
            &lt;/property>
            &lt;property name="methodName">
                &lt;value>authorizeMe1&lt;/value>
            &lt;/property>
        &lt;/bean>

&lt;bean class="org.codehaus.aware.security.Permission">
            &lt;property name="role">
                &lt;value>jboner&lt;/value>
            &lt;/property>
            &lt;property name="className">
                &lt;value>foo.bar.Baz&lt;/value>
            &lt;/property>
            &lt;property name="methodName">
                &lt;value>authorizeMe2&lt;/value>
            &lt;/property>
        &lt;/bean>
    &lt;/list>
&lt;/property>
</pre></td></tr></table>