Setting Access Authorization to Screens¶

@RequestMapping()
public String index() {
    return "index.jsp";
}

Access to the screen is made possible by setting the Controller class.

However, without further processing, authorization process would be omitted when the @RequestMapping method is processed, and anybody can display the screen.

In the actual system operations, access authorization is set most of the times and display the screen for only the particular users and enforce access limitation.

In this chapter procedures for displaying the prepared screen only to the particular useres by utilizing the authorization function of intra-mart Accel Platform are described.

For the details about Controller class and @RequestMapping method, please refer to http://docs.spring.io/spring/docs/3.2.4.RELEASE/spring-framework-reference/html/mvc.html#mvc-controller

Authorization¶

Authorization Setting Method for accessing the screen¶

Remarks about Menu Setting and Authorization¶

In order to display the created @RequestMapping method on the menu, it is necessary to register it to me menu as a menu item.

For the details of menu registration, please refer to [Menu Setting] of Tenant Administrator Operations Guide.

In the authorization checking when the menu is displayed, only the URL of the menu item is used. Calling method or argument will not be used.

Therefore, only the “value” of @RequestMapping is used in the @RequestMapping method that corresponds to the URL of menu item. @RequestMapping method should be uniquely identified by the URL.

In the example below, menu setting which uses both URL and argument will be corrected, and uses only the URL.

• Before Correction

  Argument is used in the menu, and correlation is made by using “params” for the @RequestMapping method.

  Since only the URL is used for resolution when the menu is displayed, authorization checking will be made by the @Authz of view() rather than viewDog().

  |Menu Item Setting Contents

  URL	pets
  Argument	Key	kind
  	Value	dog

  Controller Class

  @RequestMapping(value = "pets", params = "kind=dog")
  @Authz(uri = "service://pets/dog")
  public String viewDog() {
      return "dog.jsp";
  }
  
  @RequestMapping(value = "pets")
  @Authz(uri = "service://pets")
  public String view() {
      return "pets.jsp";
  }
  

• After Correction

  Change is made so that the @RequestMapping method can be uniquely identified by the URL and value of @ReuqestMapping only.
  Menu Item Setting Contents

  URL	pets/dog
  Argument	None

  Controller Class

  // Correction is made to include it to value instead of using params. The value of "value" should be determined by just looking at value and with no duplication with other @ReuqestMapping.
  @RequestMapping(value = "pets/dog")
  @Authz(uri = "service://pets/dog")
  public String viewDog() {
      return "dog.jsp";
  }
  
  @RequestMapping(value = "pets")
  @Authz(uri = "service://pets")
  public String view() {
      return "pets.jsp";
  }