Question

Are there any classes (free, open source or commercial) that perform access control similar to what Java’s AccessController does? I want to create a dynamic set of policies that can be changed at runtime.

But, I want to avoid having to code

if Allowed( ... ) then

all over the place. I know that I probably need to adjust my program class hierarchy, but I prefer that instead of manually adding guards all over the place.

If there are is no ready-to-use code, what would be a sensible approach? RTTI?

Edit: Here’s an example from the Security Annotations and Authorization in GlassFish and the Java EE 5 SDK article. Since somebody mentioned annotations in a comment, I think this would be ideal:

@Stateless
@RolesAllowed("javaee")
public class HelloEJB implements Hello {
    @PermitAll
    public String hello(String msg) {
        return "Hello, " + msg;
    }

    public String bye(String msg) {
        return "Bye, " + msg;
    }
}

From the article:

In this example, the hello() method is accessible by everyone, and the bye() method is accessible by users of role javaee.

Edit:
Well, it appears that the general consensus is that this can’t be done in Delphi. Others think it is a bad approach.

Me, I still think this would be great. My experience with Annotations in Java (as a code monkey way down in the totem pole) is positive. You add a new method, you add some form of annotation (not exactly the same as Java Security Annotations) and you are done. An administrator can later go to the admin panel and add grant access to this new handler to a group or individual users. It just works.

These are my current alternatives:

1. The TMS Security System – this appears like a complete solution, with several tools. Worth looking into. I’m accepting this as an answer even if I’m probably not going for it.
2. This is something that looks promising: Delphi virtual method interception. It only works on virtual methods, but I don’t think that’s too difficult to comply. This and annotations could make an interesting system (it appears that this was originally designed for DataSnap authentication)
3. Having only one ActionManager in your application, and make sure that all actions can be only initiated from there. This way you can use the action manager OnExecute method; I pretend to use the TAction.Name property as the permission name (“handler”), reading a list of allowed actions from a table. I can use the action list from the action manager to display the whole list in the admin UI.

Answer 1

There is no such framework for Delphi yet, nor a concept like EJBs that would fit with it. DELPHI does support class annotations, and a framework like this could be designed, perhaps in conjunction with TAction, to provide security on an action level, but I doubt that this could be extended to blocking specific method calls. Delphi code does not ever ask permission to invoke a virtual method. Anything that injected itself into EVERY virtual method call in Delphi, adding a checkPermission call behind the scenes would (in my opinion) be evil. It would be Slow, and worse than writing such checks in by hand.

However, the same techniques that are used to Mock delphi classes could perhaps be used to create some auto-security wrapper object in the future.

I am guessing that the if the Java library in question used Aspects (essentially “injection” implemented via a technique like code-hooking) then it would not require “CheckAllowed” calls everywhere. If you didn’t mind changing all your method invocations to implementing an interface, and then providing a wrapper that did the method invocations, and used some kind of auto-generated mock-security-wrapper around it, you could avoid calls to CheckAllowed.

So a guarded No, with a “limited framework possible in future” clause.