CODEWITHSUNDEEP
javaejbaclaccess-control
Nik Kashi
Nik Kashi

Reputation: 4606

Access Control List (ACL) for EJB

Is there any ACL solution for controlling Domain Object data access in JAAS controlled EJB ?

In Spring security ACL this aspect is implemented. An API needed for ACL the domain object with JavaEE, or an integration solution for Spring Security and JAAS.

Upvotes: 0

Views: 446

Answers (1)

David Brossard
David Brossard

Reputation: 13834

I am not sure access control lists would be enough. You need to look at a role-based system (RBAC) or an attribute-based access control system (ABAC).

You can then call out from the EJB: Can my user access this domain object?, get a Yes/No back and enforce it.

Here are your options - Spring Security implements RBAC. - XACML implements ABAC. There are several implementations of XACML available (both open-source and vendor such as the one I work for, Axiomatics.).

If you want background information on access control models, you can have a look at the following:

Upvotes: 1

Related Questions