Jarosław
Merlin does not provide support for principal based access control (at this time). What you could do is to associate a principal identity as a thread local variable and grab this inside you service implementation. The implementation would typically so a priv validation as part of the service method implementation. This eliminates the necessity to pass a specific argument to a service manager.
Howe that helps.
Stephen.
Jarosław Pałka wrote:
Hi!
I'm trying to solve common problem in my application which works under Merlin container. I need to check user rights to call lookup() on ServiceManager for particular component.First thing that came to my mind is to use decorated version of ServiceManager with small modification in its interface.
public interface SecureServiceManager{
boolean hasService(String key, Session session) throws SecurityException;
Object lookup(String key) throws ServiceException,SecurityException;
void release(Object object);
}
Is it possible ,using for example lifecycle extension, implement it this way or maybe you use another approach to this problem?
Jaroslaw Palka Software Architect MRT System Wodna 2b Krakow Poland
--------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
--
|------------------------------------------------| | Magic by Merlin | | Production by Avalon | | | | http://avalon.apache.org/merlin | | http://dpml.net/merlin/distributions/latest | |------------------------------------------------|
--------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
