Hi everyone,

I'm looking into joining JAAS security and Hibernate and I was really excited to find the "Hibernate declarative security" (12.3) section, based on the event system.

However it appears that this security is easy to bypass, as soon as you are able to do a StatelessSession (see 13.3 of doc) or DML-style operations (13.4).

Is there something I missed about the event system, or is the scope of "JAAS security" events limited?

Would you advise me to implement JAAS directly at the JDBC level or is ther some secret Hibernate weapon for that ?

Thank you very much for your help, and congratulations for this great software!

--Eric