Merging Security Constraints in Java Servlets

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for managing security constraints in Java EE web applications, such as merging security annotations, often fail to maintain the correct order of precedence and do not provide a complete list of security roles at deployment time, leading to incorrect data merging and inadequate user-role mapping.

Innovation Solution

A method that generates a list of role names by merging static security constraints during deployment and then retrieves security constraints from multiple sources at runtime, ensuring a proper order of precedence by combining dynamic and static annotations with deployment descriptor constraints, allowing accurate user-role mapping and access control.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If security constraints are merged once at application deployment, then deployment process is simple, but data may not be merged correctly because the origin of a particular property is not known with certainty

Engineering Contradiction:

Improvedeployment process simplicityVSAvoiddata merging accuracy

Core Design Contradiction:

Ease of manufactureVSManufacturing precision

Solution Approach 1:

The patent segments the merging process into two distinct phases: deployment-time merging of static security constraints, and runtime merging of dynamic security annotations. This segmentation allows each phase to handle only the appropriate type of constraints, ensuring data accuracy while maintaining deployment simplicity.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent performs preliminary action by merging static security constraints during deployment to create a baseline security configuration. This preliminary merging establishes the foundation before runtime, when dynamic annotations are then merged on top, ensuring proper precedence and origin tracking.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If security constraints are merged once at runtime, then complete list of security roles is available, but entity deploying the application is not able to map a user to a certain security role at deployment time

Engineering Contradiction:

Improvesecurity role availabilityVSAvoiduser-role mapping capability

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent maintains continuity of useful action by keeping security constraints from both deployment and runtime available in a merged state. This continuous availability ensures that user-role mapping can occur at deployment while complete security role information remains accessible throughout the application lifecycle.

Inventive Principle:

Principle #20Continuity of useful action

3Device complexity

If metadata is not provided for XML security constraints and annotations, then configuration is simpler, but there is no way to determine where a particular property originates if a merge occurs

Engineering Contradiction:

Improveconfiguration complexityVSAvoidproperty origin information

Core Design Contradiction:

Device complexityVSLoss of information

Solution Approach 1:

The patent introduces an intermediary mechanism that tracks the origin of each security constraint property during the merging process. This intermediary layer maintains metadata about where each property came from (XML deployment descriptor or annotation) without requiring complex configuration from the developer, thus preserving information while keeping configuration simple.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8645679B2System and method for merging security constraints when using security annotations

Publication Date: 2014.02.04 WORKDAY INC

AI summary

A method is described for merging security constraints associated with an application when using security annotations. The application comprises one or more servlets, such as a Java servlet. During application deployment, a list of role names is generated by merging static security constraints, for example, identified in a deployment descriptor, and in a static security annotation that defines a list containing the names of authorized roles for a servlet. Later, during application runtime in an application server, security constraints are retrieved from a plurality of sources, including both dynamic and static security annotations. Using the list of role names and the security constraints retrieved, a set of merged security constraints having a defined and proper order of precedence is generated. In particular, preferably one or more dynamic security annotations are first merged with one or more static security annotations to generate a set of runtime constraints. The security constraints from the deployment descriptor are then merged with the set of runtime constraints and the list of roles to generate the set of merged security constraints. These merged security constraints are then applied to process a request being handled by the application server.