2

I'm designing a financial system that should grant access to data based on roles and privileges. For example, a manager can see the financial transaction of users under his domain but not information regarding other transaction. Although it's possible to implement ad-hoc I was wondering if there are patterns or guidelines for implementing such instrumentation.

4

The Proxy Pattern has a few uses, one is specifically designed for access control. The C2 Wiki also has a discussion of the Proxy Pattern and its variants and more specifically the Protection Proxy.

When the client makes a request, it is forwarded through the Proxy, which would contain your permission checks and access control. If the request is valid, the results would be returned from the RealSubject through the Proxy.

2

If you are designing a new system (as opposed to revamping a dinosaur) you may want to look into claims-based authentication systems. It's very versatile and is the next big movement in authentication. It's implementation is now spreading across many platforms and depending on what technologies you choose to work with, may even have support from the application, right through to the back-end.

EDIT: A little more info.

To my knowledge, Microsoft is the only family to integrate claims-based identity support directly into the .NET framework via Windows Identity Foundation (WIF). What I mean by its implementation spreading across platforms is that the Claims-Based Identity model as a design pattern is being implemented across platforms. AT this time it is mostly via open source projects or custom implementations but the pattern is even present in the OAuth2 protocol.

The idea behind claims-based identities is that is supports single sign-on design and does not force the implementation to rely on any one single user store. I think the idea matured originally from Java SAML design. The idea is that rather than the application relying on a user maintaining credentials strictly with the host app, it allows for credentials of users to be supplied from "trusted" sources. A claim is just that. It is a claim of something about the user from a trusted source. A claims aware identity can hold numerous claims, all of different nature and a claim can be anything deemed to be identifiable or an attribute describing the user (email, address, country, phone number, or many other possibilities). These claims are managed via a Security Token Service, which acts as the trusted source.

I am skipping over some points here for the sake of keeping it short and sweet but the reason I suggested the idea to you is that the pattern really can be applied to anything that can work with http requests, so it can be worked into any framework capable of http.

Below are 2 solid articles about claims based identity models. The first is a bit dated (2009 I believe) but it has a very gentle and easy to understand explanation to the concept. The second is the microsoft description of their implementation, the pattern its self, and discussions on how to use this cross-realm. (It's long... lol but it's well worth the read)

http://muhammad-ahsan.blogspot.ca/2009/03/claims-based-identity-model.html

http://msdn.microsoft.com/en-us/library/ff359108.aspx

Hope this helps and sparks some fresh ideas :)

  • Thanks for the answer. The application is written in Java, what frameworks support that claim-based authentication system? – user49204 Apr 16 '13 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.