Restricting Access by Role

You can use role-based customizations to control access to many user interface components, including menus, Java Server Pages, and web flows. This example shows how to control access to existing UI components; the same techniques work with your custom components.

In this example, suppose end users haven’t had training in creating reports with the Ad Hoc Editor, and you want to hide it from users, but make it accessible to administrators. To hide access to the Ad Hoc Editor, you need to customize the UI in three ways:

The following sections show how to perform each of these actions.

Restricting a Menu Item by Role

...
<context name="main_create_mutton" test="isProVersion">
  <condition test="!banUserRole">
    <condition test="!isMainFeaturesDisabled">
      <selectAction labelKey="NAV_005_CREATE">
        <condition test="isAvailableProFeature" testArgs="AHD">
          <condition test="checkAuthenticationRoles" testArgs="ROLE_ADMINISTRATOR">
          <option labelKey="NAV_051_ADHOC_REPORT"
          action="primaryNavModule.navigationOption"
          actionArgs="designer"/>
          </condition>
        </condition>
 ...
      </selectAction>
    </condition>
  </condition>
</context>

...
<!-- The Manage menu is displayed only to administrators -->
<context name="main_manage_mutton"
         test="checkAuthenticationRoles" testArgs="ROLE_ADMINISTRATOR">
  <selectAction labelKey="menu.administration">
  </selectAction>
</context>
...

Restricting a Section of a JSP File by Role

You can use Spring Security’s authorization tags to set up access control on JSP pages. See the example below for how this tag is used. As described in the Spring documentation, the authz:authorize tag supports the following attributes:

The attributes take roles as values. To list multiple roles in an attribute, separate the roles using a comma.

To use the authorization tags in a JSP file:

<%@ taglib uri="http://www.springframework.org/security/tags" prefix="authz"%>

...
<%@ taglib prefix="t" uri="http://tiles.apache.org/tags-tiles" %>
<%@ taglib prefix="authz" uri="http://www.springframework.org/security/tags"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jstl/core_rt" %>
<%@ taglib uri="/spring" prefix="spring"%>
...

<authz:authorize access="hasRole('ROLE_ADMINISTRATOR')">
	<a id="createReports" class="button action jumbo up"><span
	  class="wrap"><spring:message code="home.create" javaScriptEscape="true"/>
	  </span><span class="icon"></span></a>
</authz:authorize>


...

See the Spring Security Reference Documentation for more information.

Controlling Access to Web Flows

JasperReports Server uses Spring Web Flow to define and control its UI flow. A Spring flow is a sequence of related pages for which you define states and transitions in relation to your own business logic. In addition to controlling users’ access to items on the menus, you can control their access to functionality by setting permissions on web flows.

In this example, suppose you want to ensure users cannot access the Ad Hoc Editor through its URI. To do this, restrict the Ad Hoc web flow to administrative users:

http://localhost:8080/jasperserver-pro/flow.html?_flowId=adhocFlow

This tells you that the URI for the Ad Hoc Editor flow is adhocFlow.

This bean sets the permissions for flows. It contains a number of flows set to ROLE_ADMINISTRATOR. Note that adhocFlow does not appear explicitly. However, there is an entry *=ROLE_USER,ROLE_ADMINISTRATOR. This setting determines access for all flows that are not specifically mentioned.

<bean id="flowVoter" 
  class="com.jaspersoft.jasperserver.api.security.FlowRoleAccessVoter">
  <property name="flowAccessAttribute" value="FLOW_ACCESS"/>
  <property name="flowDefinitionSource">
     <value>
      repoAdminFlow=ROLE_ADMINISTRATOR
      ...
      searchFlow=ROLE_USER,ROLE_ADMINISTRATOR
      *=ROLE_USER,ROLE_ADMINISTRATOR
	  <!--custom flow permissions -->
         adhocFlow=ROLE_ADMINISTRATOR
    </value>
  </property>
</bean>

Controlling Access to the Scheduler and Dashboards UI

Restricting the Scheduler or Dashboards UI to an administrator requires editing a different file.

To restrict Scheduler or Dashboards to administrative users:

The entries for the intercept-URL patterns /scheduler/main.html and /dashboard/viewer.html determine the access for Scheduler and Dashboards.

<bean id="filterInvocationInterceptor"
  class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
  <property name="securityMetadataSource">
    <security:filter-security-metadata-source lowercase-comparisons="true" 
     path-type="ant" request-matcher="ant">
      ...
      <!--scheduler-->
      <security:intercept-url pattern="/scheduler/main.html"access="ROLE_USER,ROLE_ADMINISTRATOR" />
      ...
      <!--dashboard-->
      <security:intercept-url pattern="/dashboard/viewer.html" access="ROLE_USER,ROLE_ADMINISTRATOR" />
    </security:filter-security-metadata-source>
  </property>
</bean>

Loading Your Changes