guide access control schema

Table of Contents

• Access Control Schema
  • Legacy Access Control Schema Documentation

Access Control Schema

With release 3.0.0 the access-control-schema.xml has been deprecated. You may still use it and find the documentation in this section. However, for new devonfw applications always start with the new approach described in access control config.

Legacy Access Control Schema Documentation

The file access-control-schema.xml is used to define the mapping from groups to permissions (see example from sample app). The general terms discussed above can be mapped to the implementation as follows:

Table 1. General security terms related to devon4j access control schema

Term	devon4j-security implementation	Comment
Permission	AccessControlPermission
Group	AccessControlGroup	When considering different levels of groups of different meanings, declare type attribute, e.g. as "group".
Role	AccessControlGroup	With type="role".
Access Control	AccessControl	Super type that represents a tree of AccessControlGroups and AccessControlPermissions. If a principal "has" a AccessControl he also "has" all AccessControls with according permissions in the spanned sub-tree.

Example access-control-schema.xml

<?xml version="1.0" encoding="UTF-8"?>
<access-control-schema>
  <group id="ReadMasterData" type="group">
    <permissions>
      <permission id="OfferManagement_GetOffer"/>
      <permission id="OfferManagement_GetProduct"/>
      <permission id="TableManagement_GetTable"/>
      <permission id="StaffManagement_GetStaffMember"/>
    </permissions>
  </group>

  <group id="Waiter" type="role">
    <inherits>
      <group-ref>Barkeeper</group-ref>
    </inherits>
    <permissions>
      <permission id="TableManagement_ChangeTable"/>
    </permissions>
  </group>
  ...
</access-control-schema>

This example access-control-schema.xml declares

• a group named ReadMasterData, which grants four different permissions, e.g., OfferManagement_GetOffer

• a group named Waiter, which

  • also grants all permissions from the group Barkeeper

  • in addition grants the permission TableManagement_ChangeTable

  • is marked to be a role for further application needs.

The devon4j-security module automatically validates the schema configuration and will throw an exception if invalid.

Unfortunately, Spring Security does not provide differentiated interfaces for authentication and authorization. Thus we have to provide an AuthenticationProvider, which is provided from Spring Security as an interface for authentication and authorization simultaneously. To integrate the devon4j-security provided access control schema, you can simply inherit your own implementation from the devon4j-security provided abstract class AbstractAccessControlBasedAuthenticationProvider and register your ApplicationAuthenticationProvider as an AuthenticationManager. Doing so, you also have to declare the two Beans AccessControlProvider and AccessControlSchemaProvider, which are precondition for the AbstractAccessControlBasedAuthenticationProvider.

As state of the art devon4j will focus on role-based authorization to cope with authorization for executing use case of an application. We will use the JSR250 annotations, mainly @RolesAllowed, for authorizing method calls against the permissions defined in the annotation body. This has to be done for each use-case method in logic layer. Here is an example:

public class OrdermanagementImpl extends AbstractComponentFacade implements Ordermanagement {

  @RolesAllowed(Roles.WAITER)
  public PaginatedListTo<OrderCto> findOrdersByPost(OrderSearchCriteriaTo criteria) {

    return findOrderCtos(criteria);
  }
}

Now this method can only be called if a user is logged-in that has the permission FIND_TABLE.