Command + Command Handler and J2EE declarative security

shl · **Posted:** Fri Jul 16, 2004 3:29 am

In chapter 8 of "Hibernate In Action" I see recommendations to use Command design pattern.

I like this approach, because ... (read the book:), but how to use EJB container declarative security with this design. If you have only one Session Facade Bean to handle all commands how to limit some roles to handle some commands? Is there some solution?

--
Thanks,
Leonid

gavin · **Posted:** Fri Jul 16, 2004 3:42 am

Not really, unfortunately :-(

Wait for EJB3....

shl · **Posted:** Fri Jul 16, 2004 3:46 am

Thanks, will be wating...

gavin · **Posted:** Fri Jul 16, 2004 11:44 am

Well, if you are on JBoss or WebLogic, there are interceptors today, they are just not standardized...

max · **Posted:** Fri Jul 16, 2004 12:16 pm

..are anyone using J2EE's very unnecessary complex, rigid and static security model for anything usefull these days ?

Not a prank, but a real question!

baliukas · **Posted:** Sun Jul 18, 2004 12:52 pm

Interceptor stuff is very trivial and there is no problems to use it in on server or on client side http://voruta.sourceforge.net/xref/samples/ejb/

It looks like command design patern, but command is a java method information. You do not need more than one session bean in any application, this design was recommented by Microsoft and I have used it for DCOM in the past.

shl · **Posted:** Mon Jul 19, 2004 2:44 am

max wrote:

..are anyone using J2EE's very unnecessary complex, rigid and static security model for anything usefull these days ?

Not a prank, but a real question!

Yes I used J2EE "static" security in my previous project, it is very usefull when you don't need or have no time to implement your own "dynamic" security, but the number of session facade beans were growing with the number of roles (AdminFacadeBean, ManagerFacadeBean, ....). But if you use DAO and some kind of common middleware controllers used by your session facade beans everything is not so bad :).

--
Leonid

baliukas · **Posted:** Mon Jul 19, 2004 4:31 am

"AdminFacadeBean, ManagerFacadeBean" stuff is more "static" than declarative security. As I understand "dynamic" means "depends on method paramater value".

This declarative stuff is very trivial to imolement and to customize in interceptor or in decorator.

shl · **Posted:** Mon Jul 19, 2004 4:53 am

baliukas wrote:

"AdminFacadeBean, ManagerFacadeBean" stuff is more "static" than declarative security. As I understand "dynamic" means "depends on method paramater value".

This declarative stuff is very trivial to imolement and to customize in interceptor or in decorator.

I said if you don't need "dynamic" security or you don't have time to implement it, J2EE declarative security is the best solution. When I say "dynamic security", I mean dynamic roles, roles that could be added or deleted without editing J2EE descriptors.

--
Leonid