MMBase
Homepage

Back to overview

Initial Goals (outdated)

Goal:
Create an authorization system that enables or disables a specific person to perform specific actions on a specific object in MMBase.

There are two questions that have to be answered:
1) who is authorizing?
2) how do we maintain the information needed for authorization?

1) Who is authorizing?
This description proposes a way to implement authorization. Please let me know what you think.

The authorization is done by a SecurityManager called MMBaseSecurityManager. This manager implements calls as:
checkWrite(Integer objectnr, User user);
checkRead(etc.)
checkDelete(etc.)
checkFullAccess(etc.)

The methods throw a security exception if the operation is not allowed (and they write the unauthorized actions to a logfile) if the action is permitted nothing happens.

Object such as MMObjectBuilder and MMObjectNode have to check the security manager before performing operations on specific objects.

2)How do we maintain the information needed for authorization?
This question is pretty hard to answer. Do we want to be very flexible and slow down the system, or do you want to restrict the authoriztion possibilities and make the authorization a bit faster? I choose for the first option.

For this model we need an extra object, and four extra relations:
objects: authorizationgroups.
relations: hasWritePermission, hasReadPermission, hasDeletePermission, and hasFullAccessPermission. (see figure at the bottom of this document).

In this way each object can be access by a person that has: write, read, delete, or fullaccess permission.

The person can have direct access to an object by following mentioned relations. or by following the authorizationgroup.

The authorizationgroup makes it possible to share the same permissions over multiple people. And the authorizationgroup itself is an object so projects can be clustered in that way that the big boss can access all authorization groups.