The Lazy Dev

Well in the ancient days of computer programming, developing an authentication and authorizazion system was all about giving permission to different kind of system user. In the end, there was the admin and then some other figure like some super user, simple user, whatever. A simple Account-Profile-Permission schema worked fine.

In our days, in a "social" kind of website, the authorization system is more complicated. We must take care of authorization that depend on a user specific permission of a resource that is not provided by the system but by another user. And often this authorization check is based on the relation between two accounts. So the model change. The framework that we developers can use use just do not have models and utilities for this stuff. They have models for the classical authorization system and lot of utility for cryptografy, realms for any kind of old style repository (LDAP, JDBC...) but nothing for example that is ready for modern web aplication: what about a Realm that works with Google or Yahoo account? Or with Twitter? What about user to user relationships?

So in developing a Web application that have some social aspect I had to face many challanges regarding dynamical permissions, both account to user reources and account to account. There are architecture and design problem, first of all. Then there is the integration with other framework you may already been using like Spring Security or Apache Shiro that provide some basic mechanism you do not want to rewrite). And the Web framework of course.

And this is just the Authorization part. Do not forget that also authentication is far more than just registering a username and a password. What about OpenID like login? And a Twitter based login? We need that. I do not like a site that does not allow me to log in with another of my existing mainstream account.

So here we go, I developed a lot of stuff: sometime was hardcore design (authorization system), sometime just dealing with some library (OpenID implementations, Spring Security, Wicket...) to make everything work.

I am almost at the end of the journey now and have a lot of feature in place. In this blog series I will talk about the most interesting and generic things I made. Hope co0uld be of interest for someone.

Looking forward Episode 02 :)