...

Authorization Manager Implementation

A new Java interface will be created, called AuthorizationManager. The existing Security abstract class will implement the AuthorizationManager interface. During the transition, Security will play a dual role - the legacy security implementation and the new implementation.

When the conversion to the new design is complete, the SecurityFactory and other classes will be updated to use the AuthorizationManager interface instead of the Security abstract class. Developers will be able to write their own AuthorizationManager implementations that are backed by third party authorization software (LDAP, Active Directory, etc).

AnotherThe approachexisting wouldsecurity beclasses towill refactorbe the existing security classes refactored so the Security abstract class is converted to an interface, and have the OFBizSecurity class will implement the interface. The Authorization Manager methods wouldwill be added to the Security interface, and the existing methods wouldwill be deprecated. This wouldwill make the conversion more backward-compatible with existing installations. \[I refactored the security classes on my local copy, and it works fine. I can commit those changes if there are no objections. \-Adrian\]

Access Control Scenarios

...