Mailing-List: contact commits-help@roller.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@roller.apache.org
Message-ID: <1425943191.1227903979294.JavaMail.jira@brutus>
Date: Fri, 28 Nov 2008 12:26:19 -0800 (PST)
From: "David Johnson (JIRA)" <jira@apache.org>
To: commits@roller.apache.org
Subject: [jira] Updated: (ROL-1680) Security proposal
In-Reply-To: 
 <87075238.1203410348148.JavaMail.j2ee@atlassian01.managed.contegix.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit


     [ https://issues.apache.org/roller/browse/ROL-1680?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

David Johnson updated ROL-1680:
-------------------------------

    Issue Type: Improvement  (was: Bug)

> Security proposal
> -----------------
>
>                 Key: ROL-1680
>                 URL: https://issues.apache.org/roller/browse/ROL-1680
>             Project: Roller
>          Issue Type: Improvement
>          Components: Authentication, Roles and Access Controls
>    Affects Versions: 4.1
>            Reporter: David Jencks
>            Assignee: Roller Unassigned
>         Attachments: ROLLER-1680-1.patch
>
>
> Goals here are:
> 1. Separate access control decisions from user/permission administration.
> 1.a. separate permissions from any particular permission storage model
> 1.b. use a jacc-like interface for access control decisions, involving submitting a test permission to a security service.
> 2. Hide the authentication decisions and how the current user is tracked from the business logic. 
> See discussion thread on the dev list.

-- 
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.