OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help



   RE: [xml-dev] SOAP-RPC and REST and security

[ Lists Home | Date Index | Thread Index ]

Thank you, Michael.   

The idea of implementing that at the 
data access layer is good.  My guess is that a 
goodly sized db (say, 4000+ fields and use of 
remote views) would present a challenge to the 
designer of the business rules.  Also, any 
parts of the products that use remote views 
directly across the product would never see the 
business rules.  Challenging.

Note: this isn't related to this thread, but 
field level security comes up a lot these days.


-----Original Message-----
From: Michael Brennan [mailto:Michael_Brennan@Allegis.com]

It does add some overhead, but it also pays off in terms of affording rich
functionality. Our software is explicitly designed to support a vendor's
extranet for partners. The models for what privileges vendors wish to accord
to specific partners can get fairly complex, and would be unmanageable IMO
with a straightforward ACL model. The sort of business functionality
requires the sort of flexibilty that our model affords. The field level
security is accomplished by integrating it with our data access layer and
keeping developers from hitting the database directly. So the overhead is
largely just a matter of interpreting and reformulating SQL DML statements
(based on customizable business rules) rather than just passing them blindly
on through to the database.


News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS