SoftwareEngineering

org.granite.gravity.tomcat.GravityTomcatServlet

/gravityamf/*

6.3.1. Supported Application Servers

GraniteDS provides a generic servlet implementation that can work in any compliant servlet container

blocking IO and thus will provide relatively limited scalability

GraniteDS thus provides implementations of non blocking messaging for the most popular application servers.

asynchronous non blocking servlets

JBoss 5+org.granite.gravity.jbossweb.GravityJBossWebServletOnly with APR/NIO enabled (APR highly recommended)

GlassFish 3.xorg.granite.gravity.async.GravityAsyncServletUsing Servlet 3.0

Tomcat 7.x / Jetty 8.xorg.granite.gravity.async.GravityAsyncServletUsing Servlet 3.0

 enabled="{identity.hasRole('admin')}"

button labeled Delete will be enabled only if the user has the role admin

15.6.1.1. What is a role? A role is a group, or type, of user that may have been granted certain privileges for performing one or more specific actions within an application

used to create logical groups of users for the convenient assignment of specific application privileges

15.6.1.2. What is a permission? A permission is a privilege (sometimes once-off) for performing a single, specific action. It is entirely possible to build an application using nothing but permissions, however roles offer a higher level of convenience when granting privileges to groups of users

consisting of three "aspects";

An empty @Restrict implies a permission check of componentName:methodName

implied permission required to call the delete() method is account:delete

equivalent of this would be to write @Restrict("#{s:hasPermission('account','delete')}")

@Restrict annotation may reference any objects that exist within a Seam context. This is extremely useful when performing permission checks for a specific object instance.

selectedAccount

selectedAccount

 Identity.instance().checkRestriction

If the expression specified doesn't evaluate to true, either if the user is not logged in, a NotLoggedInException exception is thrown or if the user is logged in, an AuthorizationException exception is thrown.

Subject

'Subject' can mean a human being, but also a 3rd party process, daemon account, or anything similar. It simply means 'the thing that is currently interacting with the software'

Subject currentUser = SecurityUtils.getSubject();

SecurityManager

SecurityManager manages security operations for all users

Realms

Realm acts as the ‘bridge’ or ‘connector’ between Shiro and your application’s security data. That is, when it comes time to actually interact with security-related data like user accounts to perform authentication (login) and authorization (access control), Shiro looks up many of these things from one or more Realms configured for an application.

Realm is essentially a security-specific DAO

Shiro provides out-of-the-box Realms to connect to a number of security data sources (aka directories) such as LDAP, relational databases (JDBC), text configuration sources like INI and properties files, and more

Authorization

A permission is a raw statement of functionality, for example ‘open a door’, ‘create a blog entry’, ‘delete the ‘jsmith’ user’, etc. By having permissions reflect your application’s raw functionality, you only need to change permission checks when you change your application’s functionality. In turn, you can assign permissions to roles or to users as necessary at runtime.

“Run As” support for assuming the identity of another Subject

Both Acegi as well as SAF use AspectJ and Spring AOP for Policy Enforcement

JBoss Seam follows a different process when implementing Policy Decision functionality and sets access rules with the help of JBoss Rules [13] the JBoss rules engine

access decision to the domain objects in an application can be based on any number of complex rules

@Restrict annotations

07.2007

<url>http://repository.jboss.org/nexus/content/groups/public</url>