只允许管理员用户进入playframework admin crud区域

Question

I am trying out authentication using playframework's secure module.I have two users -one an admin,the other with normal previleges.They are defined as

User(adminuser):
    email:   siteadmin@mysite.com
    password: secret
    isAdmin:  true
User(normaluser):
    email:   normaluser@gmail.com
    password: normalpass

I want only admin user to be able to login to the admin area and create entities using the crud interface.How should I go about this?

*       /admin          module:crud

brings up a login screen which adfter login from above two users ,take them to the admin area.How can I restrict entry to the admin area to only the admin user, and tell the normal user that he doesn't have enough rights to access the admin area?

Answer 1

I'm not yet familiar with the CRUD module, but in your controller you could use the annotation @Check("admin") . This will ensure that before every call on the annotated method the security module will call the static boolean check(String) method in your own Security implementation class. There you can simply check if the current user is admin and allow access or not. See example below.

public class MySecurity extends Secure.Security
{

.... other methods you should/could override ....

static boolean check(String profile)
{
   boolean result = false;
   if("admin".equalsIgnoreCase(profile))
   {
      User currentUser = User.find("byUsername", Security.connected()).first();
      result = currentUser.isAdmin;
   }

   return result;

}

Hope this helps. /Richard

Answer 2

Using CRUD, you can declare one controller per entity. Then you can add the annotations needed for security.

For example, for User entity you will have this controller:

@Check("admin")
@With(Security.class)
@For(models.User.class)
public class Users extends controllers.CRUD {
} 

In @With you have to point to the class extending Secure.Security. For example:

public class Security extends Secure.Security {

    static boolean authenticate(String username, String password) {
        return User.connect(email, password) != null;
    }

    static boolean check(String profile) {
        if("admin".equals(profile)) {
            return User.all().filter("email", connected()).get().isAdmin;
        }
        return false;
    }

    static void onDisconnected() {
        Application.index();
    }

    static void onAuthenticated() {
        Admin.index();
    }
}