The conceptual module of ACL
The final piece of the non-web tier security puzzle is security at the business object level, applied at or below the business tier. Security at this level is implemented using a technique known as ACL, or ACLs. Summing up the objective of ACLs in a single sentence—ACLs allow specification of a set of group permissions based on the unique combination of a group, business object, and logical operation.
For example, an ACL declaration for JBCP calendar might declare that a given user has to write access to his or her own event. This can be shown as follows:
Username | Group | Object | Permissions |
|
|
|
|
|
|
|
|
|
| Any event |
|
You can see that this ACL is eminently readable by a human—mick has read and write access to his own event (event_01); other registered users can read the events of mick, but anonymous users cannot. This type of rule matrix is, in a nutshell, what ACL attempts to synthesize about a secured system and its business...
