Monday, 24 September 2012

Dynamic role-based access control with Spring security

A basic principle of information security is to enforce access restriction at multiple layers.

If we consider a website that presents information from a database:
- The process that handles the request HTTP will not run as a user with admin rights
- The connection to the database will not involve a user with write access to the data

If the information is not intended to be freely available then access can be restricted to logged in users.  If there is more than one level of access restriction then the users can be assigned to roles and the information can be restricted with role-based access control (RBAC).

Role-based access control in a web-based application typically involves specifying URL patterns and roles which should have access to any URLs matching the patterns.  When a request arrives, if there are authentication credentials supplied which match with a specified role then the server will process it and produce a response.

Two common ways to define the pairing between URL patterns and roles are XML and annotations but sometimes making a code or configuration change on the server is too much hassle for the day to day administrators.

In the case of Spring Security, you can set up your own whitelisting by specifying your own AccessDecisionManager with a custom AccessDecisionVoter to allow a secondary check of permission.

Your own AccessDecisionMaker can lookup urls in a database, so there is no need to modify any code or configuration file within the deployed application.

Saturday, 22 September 2012

Apple making up for destructive updates

About a year ago I updated the OS on my iPad without paying enough attention to the ramifications, as a result I a significant amount of music that I had loaded on without syncing to a PC was lost along with several apps that I had downloaded from the AppStore.

This week I was surprised and delighted to find that upon upgrading iTunes on my PC to the latest version, I am now able to see my previous purchases and re-download them from the cloud.

In a few minutes time I hope to re-discover the timewasting delights of two of the Angry Birds series that I have somehow managed to live without for the last 12 months, along with some games that I had purchased but not tried out.

Now I just need to figure out a way of transferring the dozens of albums of music that I have on a PC on the other side of the planet...