Access control

The application we’ve been building will inevitably need some administrative tools. Creation and deletion of users, for example, is generally something that we’d like to do during runtime. Let’s create a simple View for creating a new user:

Java

checks the Views for a specific annotation, javax.annotation.security.RolesAllowed. You can get access to it by adding the following dependency to your pom.xml:

XML

<dependency>
  <groupId>javax.annotation</groupId>
  <artifactId>javax.annotation-api</artifactId>
  <version>1.2-b01</version>
</dependency>

Java

@CDIView
@RolesAllowed({ "admin" })
public class CreateUserView extends CustomComponent implements View {

To add access control to our application we’ll need to have a concrete implementation of the AccessControl abstract class. Vaadin CDI comes bundled with a simple JAAS implementation, but configuring a JAAS security domain is outside the scope of this tutorial. Instead we’ll opt for a simpler implementation.

We’ll go ahead and alter our UserInfo class to include hold roles.

Let’s extend AccessControl and use our freshly modified UserInfo in it.

Java

package com.vaadin.cdi.tutorial;
import javax.enterprise.inject.Alternative;
import javax.inject.Inject;
import com.vaadin.cdi.access.AccessControl;
@Alternative
public class CustomAccessControl extends AccessControl {
  @Inject
  private UserInfo userInfo;
  @Override
  public boolean isUserSignedIn() {
    return userInfo.getUser() != null;
  }
  @Override
  public boolean isUserInRole(String role) {
    if (isUserSignedIn()) {
      for (String userRole : userInfo.getRoles()) {
        if (role.equals(userRole)) {
          return true;
        }
      }
    }
    return false;
  }
  @Override
  public String getPrincipalName() {
      return userInfo.getUser().getUsername();
    return null;
  }
}

Note the @Alternative annotation. The JAAS implementation is set as the default, and we can’t have multiple default implementations. We’ll have to add our custom implementation to the beans.xml:

XML

<beans>
  <alternatives>
    <class>com.vaadin.cdi.tutorial.UserGreetingImpl</class>
    <class>com.vaadin.cdi.tutorial.CustomAccessControl</class>
  </alternatives>
  <decorators>
    <class>com.vaadin.cdi.tutorial.NavigationLogDecorator</class>
  </decorators>
</beans>

Now let’s add a button to navigate to this view.

ChatView:

Java

Java

package com.vaadin.cdi.tutorial;
import javax.inject.Inject;
import com.vaadin.cdi.access.AccessControl;
import com.vaadin.navigator.View;
import com.vaadin.navigator.ViewChangeListener.ViewChangeEvent;
import com.vaadin.ui.Button;
import com.vaadin.ui.Button.ClickEvent;
import com.vaadin.ui.Button.ClickListener;
import com.vaadin.ui.CustomComponent;
import com.vaadin.ui.Label;
import com.vaadin.ui.VerticalLayout;
public class ErrorView extends CustomComponent implements View {
  @Inject
  private AccessControl accessControl;
  @Inject
  private javax.enterprise.event.Event<NavigationEvent> navigationEvent;
  @Override
  public void enter(ViewChangeEvent event) {
    VerticalLayout layout = new VerticalLayout();
    layout.setSizeFull();
    layout.setMargin(true);
    layout.setSpacing(true);
    layout.addComponent(new Label(
        "Unfortunately, the page you've requested does not exists."));
      layout.addComponent(createChatButton());
    } else {
      layout.addComponent(createLoginButton());
    }
    setCompositionRoot(layout);
  }
  private Button createLoginButton() {
    Button button = new Button("To login page");
    button.addClickListener(new ClickListener() {
      @Override
      public void buttonClick(ClickEvent event) {
        navigationEvent.fire(new NavigationEvent("login"));
      }
    });
    return button;
  }
  private Button createChatButton() {
    Button button = new Button("Back to the main page");
    button.addClickListener(new ClickListener() {
      @Override
      public void buttonClick(ClickEvent event) {
        navigationEvent.fire(new NavigationEvent("chat"));
      }
    });
    return button;
  }
}

To use this we’ll modify our NavigationService to add the error view to the Navigator.

NavigationServiceImpl:

Java

@Inject
private ErrorView errorView;
@PostConstruct
public void initialize() {
  if (ui.getNavigator() == null) {
    Navigator navigator = new Navigator(ui, ui);
    navigator.addProvider(viewProvider);
    navigator.setErrorView(errorView);
  }

We don’t really want the admin-only buttons to be visible to non-admin users. To programmatically hide them we can inject AccessControl to our view.

ChatView:

Java

Some further topics

Sometimes there’s a need for a more complex custom access control implementations. You may need to use something more than Java Strings to indicate user roles, you may want to alter access rights during runtime. For those purposes we could extend the CDIViewProvider (with either the @Specializes annotation or with a beans.xml entry) and override isUserHavingAccessToView(Bean<?> viewBean).