|
I have a complex website designed using Spring MVC and MyBatis. User Interface is very complex and we have lot of custom made widgets - calenders, lists, graphs etc. If we were to implement field level role-based security what are the options available both from front-end and back-end perspective? |
|||
|
|
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.
|
I'd probably end up writing custom mini-framework, leveraging annotations & JAAS + portal/web-wide post-processing filter, hiding inaccessible fields & restricting transmitted POST data. I already did something similar and it worked (still works) quite okay, however not in Java. Downside of this approach is certain level of magic, you should document these parts in detail, since it can cause serious confusion in future. This also probably highly depends on your skills. I'm not aware of any existing framework you could just include and make that problem magiacally disappear, sorry. I'd also start up building this custom solution around existing Java EE features: http://docs.oracle.com/javaee/5/tutorial/doc/bncav.html (Just in case you already havent heard about these yet) |
|||
|
|
