Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

I have a complex website designed using Spring MVC and MyBatis. User Interface is very complex and we have lot of custom made widgets - calenders, lists, graphs etc.

If we were to implement field level role-based security what are the options available both from front-end and back-end perspective?

share|improve this question

closed as not constructive by Jim G., Martijn Pieters, Walter, Glenn Nelson, gnat Jan 21 '13 at 6:13

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

I'd probably end up writing custom mini-framework, leveraging annotations & JAAS + portal/web-wide post-processing filter, hiding inaccessible fields & restricting transmitted POST data.

I already did something similar and it worked (still works) quite okay, however not in Java.

Downside of this approach is certain level of magic, you should document these parts in detail, since it can cause serious confusion in future.

This also probably highly depends on your skills. I'm not aware of any existing framework you could just include and make that problem magiacally disappear, sorry.

I'd also start up building this custom solution around existing Java EE features: http://docs.oracle.com/javaee/5/tutorial/doc/bncav.html

(Just in case you already havent heard about these yet)

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.