Previous Content Next
Let's talk about non-role privilege Migration

Keeping application safe

Ralasafe's GUI is so easy and powerful that we must keep it safe in production environment. Ralasafe also carries out with some filters to save developers coding work.

URL privilege filter

If a url likes "/foo/bar.jsp" is requested, we can find out this url is being protected or not. So if it's being protected (we can call it's secret), in RBAC model there's must be a privilege describing this url. In other words, if a privilege links to a url, then this url should be protected.

When you create privileges in ralasafe, it is suggested you should input a URL. Ralasafe supports urls with parameters like "employMng?op=add".

You can config org.ralasafe.webFilter.UrlAclFilter into web.xml, ralasafe will check urls. If this url is secret, ralasafe will be these further steps:

  1. If the user is not logged in, go to login page;
  2. If the user does not have permission to access, go to deny page;
  3. If the user is granted permission, then the request will be approviedpermit, other filters will be evaluated.

See javadoc for details.

Login filter

org.ralasafe.webFilter.LoginFilter will whether check the user is logged in or not, if not goto login page. LoginFilter can also do username/password checking for you. You can config it into your web.xml.

See javadoc for details.

Keeping ralasafe safe!

In production environment, we should keep ralasafe safe. Only assigned users can request ralasafe GUI.

Ralasafe divides GUI into three privileges:

  1. If the login user contains "Policy Admin" privilege, he/her can design security policy, and manage privileges. Privilege panel, user category panel, business data panel, query panel and backup panel will be shown;
  2. If the login user contains "Assign Role To User" privilege, he/her can assign role to certain users;
  3. If the login user contains "Role Admin" privilege, he/her can manage roles.

If a user contains "Assign Role To User" privilege, so which users he/her can assign to? All of users or some users?

Ralasafe thinks of "Assign Role To User" as a query privilege. Assigning security policies to it, we can resolve question "which users he/her can assign to".

Take ralasafe demo as example, we want meet these requirements:

  1. Head office user Alexis Stark, can assign roles to anyone;
  2. Branch users like John Smith, can assign roles to branch users he belongs to and it's sub-branches users;
  3. Sub-branch users like Camylle Boyd, can only assign roles to sub-branch users he belongs to.

Following these steps, we can make it:

Step Screen show

1, make dir in {ralasafe-demo-webapp}/WEB-INF/classes/demo, make file DemoUser.java, code it;

Note:

  1. It must extend org.ralasafe.db.MapStorgeObject;
  2. Beside id field, it should contains fields which are set to show in user panel;
  3. And each field's set method should call super.put( "..", ...).
 
package demo;

import org.ralasafe.db.MapStorgeObject;

public class DemoUser extends MapStorgeObject {
	private Integer id;
	private String name;
	private String companyName;
	
	public Integer getId() {
		return id;
	}
	public void setId( Integer id ) {
		this.id=id;
		super.put( "id", id );
	}
	public String getName() {
		return name;
	}
	public void setName( String name ) {
		this.name=name;
		super.put( "name", name );
	}
	public String getCompanyName() {
		return companyName;
	}
	public void setCompanyName( String companyName ) {
		this.companyName=companyName;
		super.put( "companyName", companyName );
	}
}
2, compile it with ralasafe-{version-number}.jar in classpath; javac -classpath .;../lib/ralasafe-1.0-rc1-v20100717.jar demo/DemoUser.java
3, Design query "All users";
4, Design query "Users in the same branch or sub-branches" and query "Users in the same sub-branch"; (you can copy query "All users", and make small changes)  
5, Assign policies to privilege "Assign Role To User";
6, Assign role "Ralasafe Administrator" to Alexis Stark, John Smith and Camylle Boyd;
7, Enable ralasafe security, in web.xml->StartupServlet->secured. Change its value to true. Restart tomcat. 
<init-param>

    <param-name>secured</param-name>

    <param-value>true</param-value>

</init-param>
8, Login with demo login page, then turn to ralasafe gui page. Right image shows login by John Smith, then turn to ralasafe gui. This is the user list panel, there are 27 users he can manage.
Previous Content Next
Let's talk about non-role privilege Migration