Previous	Content	Next
Design query			Assign security policy to decision privilege

Ralasafe protects application by controlling access from two directions:

1. Query information such as customers and bills from system;
2. Commit data to system such as updating a customer, deleting a bill.

We call the first category privilege, query privilege; the second category privilege, decision privilege.

Ralasafe's query privilege supports these features:

1. Return different collection according to the request user;
2. Support pagination;
3. Support customized where condition such as employees whose first name starts with 'S';
4. Support select total count;
5. Support read-only fields, query result will show which fields are read-only.

See javadoc for details:

1. org.ralasafe.Ralasafe query methods;
2. org.ralasafe.WebRalasafe query methods;
3. and org.ralasafe.entitle.QueryResult.

You can assign more than one policies to a query privilege. Each policy contains user category and query. When the request user matchs this user category, then this query will be executed and query result will be returned.

Ralasafe engine evaluates security policies from the beginning to the end. The steps are:

1. Evaluate whether the request user has been granted to execute this privilege or not. If not, an empty collection(not null) will be returned;
2. Evaluate the first security policy's user category;
   1. If matched, will be executed and query result returned;
   2. If not matched, policy's query will not be executed. The next policy will be evaluated;
3. Evaluate the next security policy's user category, if matched, query result will be returned; else evaluate next one;......
4. If the request user doesn't match any policy's user category, an empty collection (not null) will be returned.

In ralasafe demo, query employee privilege is assigned with these policies:

We put "Sub-branch User" as the starting policy, and "HQ Users" at the end for better efficiency. Because there are more sub-branch users than hq users, in most cases, if the first policy is matched, and there's no need to evaluate the second and third policy.

When designing work is finished, we can test(simulate) it online immediately. This is a sample of simulation screen:

It contains four parts:

1. Select user panel: click find button, select a user from pop-up user list window;
2. Test result panel: click the green run button, ralasafe engine will evaluate this privilege;
3. Query result panel: shows instances collection of your specified java class;
4. Policy and eval result panel: shows the evaluation result of each policy.

	Previous	Content	Next
Design query			Assign security policy to decision privilege