Question

Can spring Acegi security be used for a social networking application where users can set their security preferences to share their data only with their friends?

The common scenario of the Acegi tutorials is where you want to authorize actions per user role, but what about authorizing users to view specific data, say, only their friends’?

Is it possible to use Acegi for that? How?

Answer 1

Short answer: yes.

Note that Acegi is now part of Spring, and is now known as Spring Security.

As to how to it, that’s a much more complicated question, and likely has as many right answers as those willing to try. Your final solution will depend on the needs of the app your developing, the environment your in, and the organization you are designing for. I’ll assume that you want everyone (or most) to see the basic information, and that the sensitive information only appears on the page if the requester is a friend.

I believe the most basic means of all will involve using the SecurityContext within your servlet/controllers/resources (far too many ways to design a web app to make assumptions here), and page templates (jsf, jsp, etc…, etc..), to get get access to the currently authenticated user, and include only the information that user is allowed to access.