Hi!
Scott M Stark wrote:
> >> This functionallity is not adequate in general. Checking the caller role or
>principal does
> >> not allow for validation of a permission check that is a function of the object
>being
> >> accessed. For example, a document repository can have a folder for architectural
> >> blueprints that only users with the role Architect can write to. This permission
>is
> >> attached to a specific path or object, not the bean class.
> >
> >How do you mean? The entity instance when called could do
> >isCallerInRole("Architect")?
>
> Right, but this only applies to certain instances if each folder was a bean, or
> certain paths if there is one master doc repository bean. To take it a step further,
> you may only be able to put a document in a folder if you are an Architect and
> you are the owner/creator of the parent folder. In general security requirements
> cannot be described only in terms of roles.
Hmm... I still don't see the problem. AFAICT you can use isCallerInRole
to do precisely what you outline above. What am I missing?
/Rickard
--
Rickard �berg
Email: [EMAIL PROTECTED]
--
--------------------------------------------------------------
To subscribe: [EMAIL PROTECTED]
To unsubscribe: [EMAIL PROTECTED]
Problems?: [EMAIL PROTECTED]
