Re: Wildcards in role-name

From:

Mark Space <markspace@sbcglobal.net>

Newsgroups:

comp.lang.java.programmer

Date:

Wed, 27 Aug 2008 12:19:05 -0700

Message-ID:

<g949bj$mfm$1@registered.motzarella.org>

adamcrume@gmail.com wrote:

I work for a company with complex security needs. Rather than just
belonging to groups, users often have group membership based on
department. To accomplish this, we have group names that are
department ID + simple group name. For example, a user might be a
member of 01-viewlogs, 01-updatelogs, and 02-viewlogs. To be able to
check for group membership, I have to list every group in web.xml.
This is obviously a problem, because I'd have to have (number of
departments) * (number of simple groups) entries. In other words:

Why not just:

<departments>
  <id>01</id>
  <id>02</id>
  ...
</departments>
<roles>
  <role>viewlogs</role>
  <role>updatelogs</role>
  ...
</roles>

Then mung the IDs * names yourself? If you really need /all/ and all is
always ID * roles, it seems the best way.

You might want to look at not using these munged strings internally,
however, even if the external spec requires it. Munged strings are
almost always a rotten design pattern

<employ>
   <name>Bob Joe</name>
   <department-id>02</department-id>
   <security-roles>
     <role>viewlogs</role>
     <role>rotatelogs</role>
   </security-roles>
   ...

Makes it much easier to add departments or add roles. Or worse: remove
a department id. Ouch, I don't want to think about that with the string
version.