I have a website that has certain menu items that need to be hidden from end users.
The web site has PHP in the front-end and Java and Spring in the back-end, deployed on a Linux OS in a VM infrastructure, although the full technology stack isn't fully understood as it's a legacy system and not fully documented.
I need to secure the site and functions based on access controls - users mapped to groups and groups having access to different menu items (functions). I also have to provide an interface for admins to change the functions-to-group mapping. I also require fine control over the level of different read/write method access.
I understand I need ACL. What is best practice design for such a requirement?
Options and questions:
- DB - negative issues would be: old style and creating my own identity management function with all its drawbacks and complexities.
- LDAP - negative issues: again my own identity management system, but probably simpler than DB, but I'm not sure how function level mapping to groups works. Do LDAP providers provide mapping of groups to particular functions (i.e. given a menu item "accounts" - I only want Finance to be able to see accounts menu)
- OpenAM and similar solutions externalizing Identity Management – can that work? I've been reading about this – authentication I understand but authorization to fine grain level I don’t. It seems like you need an LDAP product configured as a data source, so what does OpenAM provide over option 2 above because it would be the same? With OpenAM it looks like I configure an identity service but I get to secure at container level – so webserver and app server but it gives its own login page. I assume it's possible to configure that to access stylesheets so that it integrates with the current login page – but has anyone done that on any of these type of products to be sure it's possible? Also, does this my ACL requirements? Is this the best design and how much more complicated is it to setup compared to LDAP and app configurations?
- Is the LDAP solution best advised?
- Do you have any suggestions on open source products for Apache LDAP? Are any good/easily managed? Any interfaces possible for manipulation of functions to groups? - Does LDAP allow mapping to a fine grain level of functions/ methods to groups or is that something that is done in application? This part in particular is confusing. If anyone can offer a good resource on this, that would be good.