Access Control Philosophy
Traditional web applications weave access control into the application logic: application logic determines which user accesses the application, and decides which functions and data objects are available to that user. Other than having a database password for the entire application (rather than each individual user), there is no access control policy in the data layer. Because InfoGrid applications are JEE web applications, this traditional approach is naturally one of the access control strategies available to InfoGrid applications.
In addition, InfoGrid applications can define access control policies on the data (i.e. MeshObject) layer. This works as follows:
- Application logic determines which user currently accesses the application, using mechanisms such as cookies, OpenID, username/password and the like. Application logic represents the user as a MeshObject and associates it with the processing thread.
- When this processing thread performs an operation on a MeshObject (e.g. reads / write a Property, traverses a Relationship, blesses or unblesses a MeshObject or Relationship etc.), the MeshObject has the ability to determine whether this particular user is allowed to perform this operation or not. If not, it throws an exception.
- The same applies when the processing thread performs the creation of a MeshObject or the lookup of a MeshObject.
The access control policy is typically defined by way of an AccessManager object associated with the MeshBase. Application developers can define their own AccessManagers. InfoGrid provides a particularly interesting implementation of AccessManager called AclBasedAccessManager that enables application developers to represent their access control policy by means of instantiating a security Model called AclBasedSecurity.