Field Level Security

[CrassMaster]

Hi All,

I am working on a web app that currently has page level security. You
have full access to edit the page otherwise you have read access.

There is a new requirement to make certain fields editable to certain
people, while the rest remains read only

my idea, is to create groups of users, with specific roles. These
roles would then have access to certain fields ( identified by an id )

so in my JSPs I would have if blocks surrounding the fields in
question. mayeb 10-20 a page.

I have a few questions?:
1. do you think it will be slow if this data is pulled back from a DB
2. is there a better way?

thanks in advance

 

[Ryan Stewart]

Hi All,

I am working on a web app that currently has page level security. You
have full access to edit the page otherwise you have read access.

There is a new requirement to make certain fields editable to certain
people, while the rest remains read only

my idea, is to create groups of users, with specific roles. These
roles would then have access to certain fields ( identified by an id )

so in my JSPs I would have if blocks surrounding the fields in
question. mayeb 10-20 a page.

I have a few questions?:
1. do you think it will be slow if this data is pulled back from a DB
2. is there a better way?

thanks in advance

1. What data? The user's permissions? It shouldn't be a big deal, because
you should only need to get it from the DB once. From then on it should be
in the session.

2. There's only a better way if you think of one. You've given very slim
detail about your environment. I'd guess you're just using JSPs with
embedded scriptlets. From that perspective, there are much better ways to
write a webapp. As for your field protection, an if is about the only way to
go, again unless you think of a better way to overcome your problem.