Group items tagged

it is supported

add the "Sprint" field to the Edit issue screen

Permission as a statement that defines an explicit behavior or action

lowest-level constructs in security polices

explicitly define only "what" the application can do

Impersonalization

authenticates “as a user” or access application imitating his identity - without knowing his password

Implementing RBAC, a practical approach

The NIST RBAC model addresses the limitations of RBAC for enterprise-wide deployments, which typically focuses on the increased complexity of managing sufficient roles and assigning adequate role membership within a heterogeneous IT infrastructure

Higher management needs to understand that RBAC implementation has a profound impact on the way some parts of the company operate

Permission Schemes

A permission scheme is a set of

Project permissions can be granted to:

Individual usersGroupsProject rolesIssue roles such as 'Reporter', 'Project Lead' and 'Current Assignee''Anyone' (e.g. to allow anonymous access)A (multi-)user picker custom field.A (multi-)group picker custom field. This can either be an actual group picker custom field, or a (multi-)select-list whose values are group names.

assign

Mapping enum to database column using JPA/Hibernate You can use any of the 3 approaches discussed above. Map the enum to an integer column. The persistence implementation should automatically convert enum to ordinal() and back for you. Map the enum to a String column. The persistence implementation should automatically convert the enum value to String value via the name() function. Map the enum using a business value. You should mark the enum field as @Transient, and create another String field which you can map to a String column in your database table. Here’s an example code snippet. view plaincopy to clipboardprint?@Entity  public class Product {   @Column   private String colorValue;     @Transient   public Color getColor() {    return Color.fromValue(colorValue);   }     public void setColor(Color color) {    this.colorValue = color.toValue();   }  }  

Approach 3: Using a user defined business value – Recommended approach! This approach involves assigning a an explicit user defined value to each enum constant and defining a toValue() and fromValue() methods on the enum to do the serialization and deserialization.

public enum Color {   RED("RED"), GREEN("GREEN"), BLUE("BLUE"), UNKNOWN("UNKNOWN");     private final String value;     Color(String value) {     this.value = value;   }     public static Color fromValue(String value) {     if (value != null) {       for (Color color : values()) {         if (color.value.equals(value)) {           return color;         }       }     }       // you may return a default value     return getDefault();     // or throw an exception     // throw new IllegalArgumentException("Invalid color: " + value);   }     public String toValue() {     return value;   }     public static Color getDefault() {     return UNKNOWN;   }  }  public enum Color { RED("RED"), GREEN("GREEN"), BLUE("BLUE"), UNKNOWN("UNKNOWN"); private final String value; Color(String value) { this.value = value; } public static Color fromValue(String value) { if (value != null) { for (Color color : values()) { if (color.value.equals(value)) { return color; } } } // you may return a default value return getDefault(); // or throw an exception // throw new IllegalArgumentException("Invalid color: " + value); } public String toValue() { return value; } public static Color getDefault() { return UNKNOWN; } } This approach is better than approach 1 and approach 2 above. It neither depends on the order in which the enum constants are declared nor on the constant names.

Java Authorization Guide with Apache Shiro

Levels of permission granularity

specify an actions (open, read, delete, etc)

previously known as the JSecurity project

The word Subject is a security term that basically means "the currently executing user"

Core Concepts: Subject, SecurityManager, and Realms

15.6. Authorization

Seam Security is built around the premise of users being granted roles and/or permissions, allowing them to perform operations that may not otherwise be permissible for users without the necessary security privileges

15.6.1. Core concepts

new ListCollectionView();

Troubleshooting The org.jboss.as.jpa logging can be enabled to get the following information: INFO - when persistence.xml has been parsed, starting of persistence unit service (per deployed persistence.xml), stopping of persistence unit service DEBUG - informs about entity managers being injected, creating/reusing transaction scoped entity manager for active transaction TRACE - shows how long each entity manager operation took in milliseconds, application searches for a persistence unit, parsing of persistence.xml

Container-managed Extended Persistence context

extended persistence context can