A RBAC implementation based on struts framework

1 Introduction

role-based access Control (role-based access Control,rbac) is a mature security access control model, which flexibly solves the problem of privilege management, resource management and authority review, and is suitable for web-based information system. The RBAC model solves the problem of system user access control theoretically, but from the point of view of technology realization, different RBAC implementations have different influence on the development and operation efficiency of the system. Combining the good MVC design pattern of struts framework and the characteristics of RBAC's flexible privilege management, this paper puts forward a scheme of RBAC based on struts framework. The scheme realizes the RBAC model, and realizes the separation between the business layer and the logic layer, and has good application effect.

2 Basic principles of RBAC

The RBAC model introduces the concept of "role". A "role" is a collection of actions that a user or a group of users can perform in a system, a collection of users, and a collection of licenses. By assigning roles to users and assigning permissions to roles, users and permissions are indirectly linked through roles. The basic model of RBAC is shown in Figure 1.

　

Fig. 1 Basic model of RBAC

In Rbac, there is a many-to-many relationship between user and role, roles and permissions. A session is a user's mapping of more than one role, at which point the user right can be the set of permissions that activate the role. RBAC is divided into two parts in the process of resource authorization management, which realizes the logic separation between the user and the access rights by implementing the access rights and roles, and then implementing the roles and users.

3 Introduction to Struts

The traditional development mode with JSP page as the core is not suitable for application expansion and renewal because of the strong coupling of logic and business logic, which can not meet the need of further expansion of application scale. The MVC design pattern divides the application into three core parts: the model, the view, the controller, each dealing with their own transaction, and realizes the organic separation of the presentation logic and the business logic well. Struts is an implementation framework of MVC design pattern, which includes rich tag library and utility class which is independent of the framework, and has been used more and more in many large-scale systems in recent years, becoming one of the most popular frameworks in Web application development. The simple struts architecture is shown in Figure 2.

After the client makes a request through the browser, the request is actionservlet. Actionservlet finds a valid mapping in the Struts-config.xml configuration file, and then transfers the corresponding Actionmapping object to the action processor object for processing. The action Processor object accesses the data in Actionform, processes and responds to customer requests, and it invokes the background bean component, which encapsulates the specific business logic. The Action Processor object notifies the controller based on the processing result, and the controller handles the next step.

　

Figure 2 Struts Architecture