public interface DeclarativeSecurity

Declarative Security

The Declarative Security system allows you to attach role based access control to DataSource operations and DataSource fields, as well as create a mix of authenticated and non authenticated operations for applications that support limited publicly accessible functionality.

See the QuickStart Guide for more in depth documentation on how declarative security works and how to use it in your application.

See Standalone DataSource Usage for information on how to use declarative security in a standalone application.

NOTE: Declarative security only works for DataSource operations (including DataSource DMI operations). If you want to limit access to an ordinary RPC-DMI method - so it can only be called by authenticated users, only users with a certain role, etc - you have two choices:

• Have your DMI method accept a parameter of type HttpServletRequest; that will cause Smart GWT to pass the current servlet request into your method, and you can directly call the getRemoteUser() and isUserInRole() methods to implement your own security
• Migrate your RPC-DMIs to DataSource DMI operations and get full declarative security support that way. Note that any plain RPC-DMI function can be reworked as a DataSource DMI operation; even if your RPC-DMI manifestly is not fetching a dataset or updating a record, you can use a custom operation

Requests that fail to pass Declarative Security checks will return response with special status set.