Authorization

Authorization comes after authentication and usually means Who can access what? Mentawai comes with a simple yet powerful approach to user authorization. In Mentawai you have Groups and each group can have one or more Permissions. Examples are:

Administrators: read, delete, write, create, adduser, deluser
Managers: read, delete, write, create
Users: read

A authenticated Mentawai user can belong to one or more groups, and that's indicated by the BaseLoginAction.setUserGroups() method.

Let's start by showing how you can set up groups and permissions for your web application inside your ApplicationManager.

When you are authenticating the user, you can say to what group he belongs to:

Then all you have to do is use the org.mentawai.filter.AuthorizationFilter to authorize access to your actions or the mentawai tags <mtw:requiresAuthorization /> and <mtw:hasAuthorization>. Examples:

But what happen if the user is not authorized and tries to access a page that requires authorization? He will be redirected to a denied page (Ex: denied.html). You can configure that page with a global consequence. Check the example below that also includes the org.mentawai.filter.AuthorizationFilter configuration:

public void loadActions() {
        
        filter(new AuthenticationFilter()); // global filter...
        on(LOGIN, redir("/login.jsp")); // global consequence...
        on(ACCESSDENIED, redir("/denied.jsp")); // global consequence...
        
        // more actions here...
        
        action("/DeleteRecord", DeleteRecordAction.class)
            .on(SUCCESS, redir("/deleted.jsp"))
            .filter(new AuthorizationFilter(new Permission("delete")));

// Java Style
        
        addGlobalFilter(new AuthenticationFilter());
        addGlobalConsequence(AuthenticationFilter.LOGIN, new Redirect("/login.jsp"));
        addGlobalConsequence(AuthorizationFilter.ACCESSDENIED, new Redirect("/denied.jsp"));
        
        // more actions here...		
        
        ac = new ActionConfig("/DeleteRecord", DeleteRecordAction.class);
        ac.addConsequence(DeleteRecordAction.SUCCESS, new Redirect("/deleted.jsp"));
        ac.addFilter(new AuthorizationFilter(new Permission("delete")));
        addActionConfig(ac);
    
    }

You may click here to download an Authorization example.