DA31 - Simplifying Permissions

by Nathanial Woolls

Note from RemObjects: although we believe the content of this article to be correct, we do not warrant that it is so. We thank Nathanial very much for producing this, which we are pleased to publish here.

A Technique for Automated Permissions in Data Abstract

One of the most important aspects of any remotely accessed service framework is security. This is no different with the RemObjects SDK and Data Abstract. Luckily, the RemObjects SDK and Data Abstract do most of the heavy lifting for us. By providing a session management framework in the RemObjects SDK and an easy-to-use validation system in Data Abstract, security is ready to go (with some work from the developer) out of the box. And, with the small amount of code discussed in this article, we can have nearly all of our authentication and permission needs taken care of for us with almost no additional coding (after a small amount of initial work).

While the concepts presented in this article are straight-forward, and the code written fairly brief, it is suggested that you have a basic understanding of how the RemObjects SDK’s session managers work. You can read about session managers in the RemObjects SDK here. Another suggested article goes into further depth on session managers and how to use them with Data Abstract, and can be found here.

The idea behind the technique presented in this article is to first extend the session object in the RemObjects SDK to natively hold a list of permissions. While we could probably use the Values property of the regular TROSession object to store this, it is easy to extend the session object to cleanly hold a separate list of values for permissions, and this will be our first step. Then, we will utilize a seldom advertised feature in Data Abstract called Custom Attributes to automate the pairing and checking of permissions when accessing datasets and commands in Data Abstract.

Session Management

To use our own session object, we will use a TROEventSessionManager.

It should be noted that this technique is also possible with the TROInMemorySessionManager, which only requires using OnCustomCreateSession. We examine TROEventSessionManager here for completeness, as extra code is necessary to use our own session object with this component. The events we are interested in are OnCustomCreateSession and OnFindSession.

If we look at these events, you'll notice that the Session parameter's are passed as var's and out's. This allows us to subclass TROSession, creating our own session object with a Permissions property. We can then use our session object within the RemObjects SDK’s session management framework.

We'll start by defining our session object:

unit uAuthSession;

interface

uses uROSessions, Classes;

type

  TAuthSession = class(TROSession)
  private
    FPermissions: TStrings;
  public
    constructor Create(const aSessionID : TGUID); override;
    destructor Destroy; override;
    property Permissions: TStrings read FPermissions;
  end;

implementation

uses SysUtils;

{ TAuthSession }

constructor TAuthSession.Create(const aSessionID: TGUID);
begin
  inherited;
  FPermissions := TStringList.Create;
end;

destructor TAuthSession.Destroy;
begin
  FreeAndNil(FPermissions);
  inherited;
end;

end.

procedure TSessionsController.SessionManagerCustomCreateSession(const
    aSessionID: TGUID; var Session: TROSession);
begin
  Session := TAuthSession.Create(aSessionID);
end;

procedure TSessionsController.SessionManagerFindSession(const aSessionID:
    TGUID; out aSession: TROSession);
var
  Session: TAuthSession;
begin
  aSession := nil;

  ... if code to find session here succeeds
  begin
    Session := TAuthSession.Create(aSessionID);
    aSession := Session;
	 ...
  end
end;

function TXXXXServices.Login(const Username, Password: string): Boolean;
var
  Session: TAuthSession;
begin
  Result := False;

  ...if login is successful
  begin
    Session := TAuthSession(Self.Session);
    Session.Permissions.Add(...);
    Session.Permissions.Add(...);
    Session.Permissions.Add(...);
  else
    DestroySession;
end;

procedure TXXXXServices.DataAbstractServiceValidateDatasetAccess(
             Sender: TObject; const aConnection: IDAConnection;
             const aDatasetName: string; const aParamNames: array of string;
             const aParamValues: array of Variant;
             aSchema: TDASchema; var Allowed: Boolean);

procedure TXXXXServices.DataAbstractServiceValidateDatasetAccess(Sender:
    TObject; const aConnection: IDAConnection; const aDatasetName: string;
    const aParamNames: array of string; const aParamValues: array of
    Variant; aSchema: TDASchema; var Allowed: Boolean);
var
  I: Integer;
  Session: TAuthSession;
  Dataset: TDADataset;
begin
  Session := TAuthSession(Self.Session);
  Dataset := MySchema.Datasets.DatasetByName(aDatasetName);
  for I := 0 to Dataset.CustomAttributes.Count - 1 do
  begin
    if Session.Permissions.IndexOf(Dataset.CustomAttributes[I]) = -1 then
    begin
      Allowed := False;
      Break;
    end;
  end;
end;