Code level security Control for Application Integration

[arthur_li]

I have been playing around Alfresco 1.0 about 3 weeks, it's pretty cool design! I am little bit concern about the code level security, and it’s crucial for application integration. The code level security can only apply to the proxyed services, and there is no way to prevent third parties which deployed in the same JVM from messing up by accessing or instantiation the target service, or bypass all the security check which applied by Spring Framework.

[davidc]

I think it depends on how the application is deployed.  The deployed environment should not allow arbitrary addition of code to the JVM.  Also, any public API's (i.e. remote) should be backed by the secure beans.

With source code available for all of the stack, then you're right, someone can build a tool that goes in at any level.

[hluu]

I was just wondering what security framework is used in Alfresco?  Is it Acegi Security framework?  If so, can you please describe your experience in using Acegi Security framework.

Thanks in advance,

Hien