The final piece of the non-web tier security puzzle is security at the business object level, applied at or below the business tier. Security at this level is implemented using a technique known as ACL, or ACLs. Summing up the objective of ACLs in a single sentence—ACLs allow specification of a set of group permissions based on the unique combination of a group, business object, and logical operation.
For example, an ACL declaration for JBCP calendar might declare that a given user has to write access to his or her own event. This can be shown as follows:
|
Username |
Group |
Object |
Permissions |
|
mick |
|
event_01 |
read, write |
|
|
ROLE_USER |
event_123 |
read |
|
|
ANONYMOUS |
Any event |
none |
You can see that this ACL is eminently readable by a human—mick has read and write access to his own event (event_01); other...
