1

Question

Given a User bean stored in database with a lots of fields which is exposed by a rest web app, I want to restrict R/W access to it and it's fields depending on the currently connected user.

Examples:

  • Anonymous user can't get anything
  • Current user can read and write all fields of it's own record except his nickname (no access at all), userNumber and registration date (read only)
  • Admin can read and write all fields of all records
  • authenticated users can read every user name and nickname (but their own) and are allowed to change the nickname (except their own)

What is the best way to do it ?

Extra context

I'm playing a little with JBoss's Forge 2 and I'm trying to build a web app with an OpenID authentication. I'll try to hook up OpenId to apache deltaspike as a security framework, but I can change this if you have a better solution

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.