Role-based Security

From DBSight Full-Text Search Engine/Platform Wiki

Table of contents

Role Based Access Control

Objective

  • If end users do not have access to some documents, those documents should not appear in the search list.
  • End users should not be allow to tweak the URL to get unauthorized access either.

Assumption

DBSight assumes every document has a field storing roles that have access to itself. The field should be indexed as "Keyword" or "Keywords".

This is the access control field.

How it works

Let's say the access control field name is "roles". DBSight knows the field name when you configure in page "Data Source"=>"Security" for the index.

DBSight will somehow get a user's role list, eg: "a,b,c". And automatically expend it into query "roles:a roles:b roles:c", and use it to put an additional filter onto the user's search query. It's done automatically, so the user can not get around it.

How DBSight get the role list?

J2EE allows you to create filters. You should use filters to set the role list and let DBSight pick it up.

Let say you modify web.xml file with this filter.

 <filter>
   <filter-name>SecurityFilter</filter-name>
   <filter-class>your.own.SecurityFilter</filter-class>
 </filter>

You can code this filter to set current user's role name or comma separated role names by request.setAttribute("role", "role_name1,role_name2,role_name3)".

Later when a user searches, DBSight will read the role list by request.getAttribute("role").

User Name Based Access Control

Assumption

Each document has a field storing the user name.

Use J2EE standard request.getUserPrincipal()

DBSight can get user name via request.getUserPrincipal(), and bind it to a filter query.

This is a standard J2EE call. Please check java docs for http servlet.