Question

We are building a Java EE / JPA / CDI app with an Oracle Database. The data model (this we can’t change) implements security partly by using views and client_info…something like..

create view the_view
as select * 
from the_table
where organization_id = USERENV('CLIENT_INFO')

where userenv(‘CLIENT_INFO’) is basically set by calling

dbms_application_info.set_client_info(11);

Now, we have a series of Stateless Beans that basically inject Persistence Context and execute queries (both native queries and regular POJO) and we need a way to inject the client info (that we can get from the security context) into the PersistenceContext before making calls to the EntityManager

in a nutshell I need to be able to call this..

@PersistenceContext 
EntityManager em;

@Inject
UserInfo userInfo;

public TheView getTableData(long id) {
    // At this point security Information should be set.. 
    // Call the query
    return em.find(TheView.class, id);

}

without having to call a setClientInfo() manually..

One way of doing this would probably be using interceptors and annotate the method and make the call there (providing I can get hold of the PersistenceContext that the method will use.. ).. will this even work??

Any other way of doing this??

TIA!

Answer 1

The interceptor approach you are writing about sounds like an excellent fit.

I’m not 100% sure if I understood your requirements correctly, but it seems as if would be a good idea to decouple authorization logic from the actual business logic to be able to write something like this:

…

@IsEditor("someMoreData")
public X getData() {
 ...
}

IsEditor is an interceptor and will encapsulate the relevant DB lookup.

Seam Security as an independent CDI modules comes with a couple of concepts (& implementations), you should definitely check it out.