displaying selective tabs in JSP based on access rights

[Shiny Suresh]

Hi,

I have a task. I have a few tabs in Jsp, while clicking on each, takes to different page. I need to display the tabs based on the rights that a logged in user's role has. For eg, if the user does not have the right to update, the update tab should not be displayed. I would appreciate if any one could give me an idea about how to do it.

Thanks,
Shiny.

[Bear Bibeault]

Conditionals in a JSP can be easily handle with the JSTL tags <c:if>, or <c:choose> with c:when> and <c:otherwise>.

Or, the controller can send a list of the tabs to be displayed to the page based upon the user rights.

[Shiny Suresh]

Thanks for the prompt response. I will try it.

[Shiny Suresh]

Hi,

I am supposed to be displaying based on the user's rights using Spring's <security:authorize> tag.

<security:authorize ifAllGranted="AUTHORITY_GENERAL_INQUIRY">
			<li><a id="tabSummary" href='#tab5'>Receivable</a></li>
			<%@include file="receivable-fragment.jspf"%>
			</security:authorize>

I have this right AUTHORITY_GENERAL_INQUIRY. But still the tab does not get displayed. I tried changing ifAllGranted to ifNotGranted, the tab displays.
How do I check what authorities the user has? We use ldap for authentication and authorization.

[Bill Gorder]

Well for starters the tag you are using are deprecated.

https://github.com/SpringSource/spring-security/blob/master/taglibs/src/main/resources/META-INF/security.tld

I would go ahead and start using access

<sec:authorize access="hasRole('AUTHORITY_GENERAL_INQUIRY')">

You can check the stuff you are asking about server side, maybe in your controller.

Collection<GrantedAuthority> authorities =  SecurityContextHolder.getContext().getAuthentication().getAuthorities();

[Shiny Suresh]

Hi,

Thanks for your response. I did a workaround, by using <c:if > and checking the permissions. Probably <security:authorize> didn't work for me because it is deprecated, like you said.
Appreciate your help.

Thanks,
Shiny.