How to implement field level access control for REST service based on the caller?

Question

I have a requirement to restrict attributes in the REST response by the caller. Consider the response in JSON format.

Ex:For a given REST endpoint, the default response is like

 {
    "id" : "111"
    "name" : "John"
    "age" : "30"
 }

For the "caller 1" the response should be like

 {
    "id" : "111"
    "name" : "John"
    "age" : "null"
 }

For the "caller 2" the response should be like

{
    "id" : "111"
    "name" : "null"
    "age" : "30"
}

In above response JSONs, "null" means, such attributes are not exposed to such callers.

I am looking for a way to implement to control REST response by caller.

Answer 1

The implementation on the server side is heavily dependent on the underlying server technology stack (REST API, DB, User's Role layer, etc.). In some configurations, you defines the data authorization in the DB layer while in other on the REST layer. Implement field level authorization is a tricky one as not all frameworks provides this granularity.

One framework that do offer such granularity is Jello Framework (I am the author). One of Jello's key features is its inline Authorization Model where you can assign different access levels for data elements at any resolution (Namespaces, Entities, Fields, Actions) and specify who is authorized to access the data via the REST API.

For example - Let's say you want to expose the 'age' field only to the record owner and the site administrator. In Jello, it will look something like this:

public class Person extends JelloEntity {
   @Expose @KeyElement 
   Integer  id;

   @Expose 
   String name;

   @Expose({Role.OWNER, Role.ADMIN}) 
   Integer age;
}

Answer 2

I had similar requirement in the past where permissions were granular at field level.

I implemented Rest response writers for each entity. I pass list of fields of that entity for which the calling user has access. Using the list, in the response writer, I used to output only those fields for which the user has access.

I used to output map/list structure from the entity. Jackson then marshall the structure into JSON.