Securing liferay portlets with spring security

3
votes

I am currently working with a liferay portlets. Spring security is used on the Rendering layer( in jsp pages). However, it is not safe, because my dispatch controllers and services do not have any security/authorization checks.

In my application, Spring-MVC controller receives the request, and passes to the Service Layer. Service Layer builds the result and passes it to the JSP pages. In jsp pages we have the security authorization using spring-security taglibs.

I want to know the following:

  1. Best practises regarding implementing authorization for portlets.
  2. Which is better choice to implement security either on Dispatch layer or Service layer?
  3. How to implement security for dispatch layer or service layer?

Please consider that I have security in my application on use-case bases.

Thank you!

1
spring-mvcspring-securityliferayportlet

1 Answers

1
votes

My favorite answer matches here: "it depends".

Here's what it depends on:

Liferay defaults to the *LocalService being without any permission checks - e.g. if you have access to the API, you get to do whatever you want. The remote services however are supposed to check permissions before they delegate the actual execution of a service to the local services.

If you want to use Liferay's permissionChecker (which is readily available and runtime-configurable), you should do this in the non-local service methods. I tend to recommend this, as you'll be able to tap into Liferay's permissioning system - and you already have the user identity, roles, memberships etc. managed by Liferay anyway. Create a custom role, grant custom permissions and you have everything configurable at runtime.

Secondly, while you definitely want to check the permissions in the backend services, you'll probably want to do it again on the UI layer: If a user is not allowed to manipulate some object, you don't want to display the button that suggests they can change it, only to get a "permission denied" reply.

That being said, I've never tied spring security (especially the taglibs) to Liferay's permission system.