>>
>> This functionallity is not adequate in general. Checking the caller role or
>principal does
>> not allow for validation of a permission check that is a function of the object
>being
>> accessed. For example, a document repository can have a folder for architectural
>> blueprints that only users with the role Architect can write to. This permission is
>> attached to a specific path or object, not the bean class.
>
>How do you mean? The entity instance when called could do
>isCallerInRole("Architect")?
Right, but this only applies to certain instances if each folder was a bean, or
certain paths if there is one master doc repository bean. To take it a step further,
you may only be able to put a document in a folder if you are an Architect and
you are the owner/creator of the parent folder. In general security requirements
cannot be described only in terms of roles.
--
--------------------------------------------------------------
To subscribe: [EMAIL PROTECTED]
To unsubscribe: [EMAIL PROTECTED]
Problems?: [EMAIL PROTECTED]
