Re: [aspectj-dev] AOP and security

[Kev Jackson <kevin.jackson@xxxxxxxxxxxxx>]

Wow!!Chandu's mail wrote:

> Hi All,
>  
> I am very new to this group and signed in to learn about AOP. My 
> questions to all of you are:
>  
> 1. What is a security problem and how will AOP solve it?
>  


Within an application (take any 'enterprise application') there will 
probably be a need for Authentication (who are you?) and/or 
Authorization (are you allowed to do that?).  Traditional OOP tackles 
this by placing a call to the authentication/authorization code every 
time a user attempts to do something eg:

class {

   public secureMethod(int x, Object y, User z) throws 
NotAuthenticatedException {
      if (User.isAuthenticated()) { //<- security code
         //do stuff
         //business logic
         //
      } else {
         throw new NotAuthenticatedException();
      }
   }

}

As you can see the security code is interleaved within the business 
logic.  Imagine haveing 40+, 400+, 4000+ methods where you have to 
maintain essentially the same behaviour.  As the number of secure 
methods increases, so does the amount of duplicate code (bad) and the 
amount of maintenance.

AOP solves this:
class {

   public secureMethod(int x, Object y, User z) throws 
NotAuthenticatedException {
         //do stuff
         //business logic
   }
}


aspect {
   pointcut secureMethod(..) : call (com.company.secure.*+.*(..))

   before() : secureMethod() {
      if(User.isAuthenticated()) {

      }
   }
}

Here the aspect will insert the security code before every secureMethod 
without extra maintenance.  That's a big win.  Also the code is easier 
to read and more understandable as it is focused on the business logic, 
not business logic + security.

I've actually used AspectJ+JAAS+Servlets to achieve a single-sign-on 
with Kerebos, it's freakishly good.

> 2. Can we use AOP to detect the faults in source code?
>  

Yes, some of the first aspects in the dev/prog guide are to do with 
development

> 3. Is there a way to test the applications using AOP?
>  

Not sure what you mean, but I did read an article where the author used 
AOP to test a Struts webapp - looked a little wierd but it worked.

Kev