However, Z
´
as’ aim is not to replace JAAS, since Z
´
as
can be used together with JAAS-based authorization
and, in a future version, Z
´
as may even leverage JAAS
authorization services.
Even though Z
´
as is still in its infancy, we plan to
revise and improve it regularly. Some possible next
steps to the improvement of Z
´
as are described next.
4.1 Further Work
In the near future we intend to improve Z
´
as, especially
taking into account the insight gained by its use in a
large scale Java-based Web application.
10
Nevertheless, some points requiring further re-
search have already been identified. Should the ba-
sic concepts of authorization be extended such that
each domain object is considered a principal, with its
own set of permissions and its own set of trust rela-
tionships with other objects? What is the connection
between trust and the composition, aggregation, and
association relations? Should a distinction be some-
how drawn between query and modifier methods, in
the same way we need to distinguish sets and gets in
the case of attributes? How do contracts relate to au-
thorization and access control? What does this tell
us regarding the relation between the runtime permis-
sion requirements of a method and the method it over-
rides? What if other crosscutting concerns of the ap-
plication are implemented using aspects? How do we
deal with potential conflicts that may arise (including
the possibility of overriding authorization controls)?
Nakajima and Tamai (?) proposed an analysis tech-
nique to assess the coherence between authorization
policies and application code. The proposal, however,
assumes the authorization policies are static. How
could their analysis technique be applied in the case
of dynamic policies, as allowed by Z
´
as?
ACKNOWLEDGEMENTS
Special thanks to Professor Dulce Domingos for her
important suggestions and for trying to make sure we
would not miss the most important authorization ref-
erences.
REFERENCES
AspectJ Team ([April 16th, 2006]). The AspectJ project at
Eclipse.org. http://www.eclipse.org/aspectj/.
Clifton, C. and Leavens, G. T. (2002). Spectators and as-
sistants: Enabling modular aspect-oriented reasoning.
10
Namely F
´
enixEDU
R
. See http://
fenix-ashes.ist.utl.pt/FrontPage/.
Technical Report 02-10, Iowa State University, De-
partment of Computer Science.
Cot
´
e, M. ([April 16th, 2006]). JAAS book: Java authenti-
cation and authorization. Originally written for publi-
cation by Manning, http://www.jaasbook.com/.
Ferraiolo, D. F., Kuhn, D. R., Chandramouli, R., and
Barkley, J. ([8th March, 2006]). Role Based Access
Control (RBAC). http://csrc.nist.gov/rbac/.
Filman, R. E. and Friedman, D. P. (2005). Aspect-
oriented programming is quantification and oblivi-
ousness. In Aspect-Oriented Software Development,
chapter 2, pages 21–35. Addison-Wesley, Boston,
Massachusetts.
Laddad, R. (2003). AspectJ in Action. Manning, Green-
wich, Connecticut.
Lai, C., Gong, L., Koved, L., Nadalin, A., and Schemers,
R. (1999). User authentication and authorization in
the Java
TM
platfom. In Proceedings of the 15th Annual
Computer Security Applications Conference, Phoenix,
Arizona.
Oaks, S. (2005). Java Security. O’Reilly, 2nd edition.
Recebli, E. A. (2005). Pure aspects. Master’s thesis, Uni-
versity of Oxford, Computing Laboratory.
Samar, V. and Lai, C. (1996). Making login services in-
dependent of authentication technologies. In Pro-
ceedings of the SunSoft Developer’s Conference.
http://java.sun.com/security/jaas/doc/pam.html.
Sandhu, R., Coyne, E. J., Feinstein, H. L., and Youman,
C. E. (1996). Role-based access control models. IEEE
Computer, 29(2):38–47.
Sun Microsystems, Inc. ([April 16th, 2006]). Java
technology: Security and the Java platform.
http://java.sun.com/security/.
Yoder, J. and Barcalow, J. (1997). Architectural patterns for
enabling application security. In PLoP’97, Proceed-
ings of the 4th Conference on Patterns Language of
Programming.
Zenida, P., Menezes de Sequeira, M., Henriques, D.,
and Serr
˜
ao, C. (2006). Z
´
as - Aspect-Oriented
Authorization Services (first take). Technical Re-
port CI-2006-01, CI, ISCTE, Lisboa, Portugal.
http://ci.iscte.pt/publicacoes/relatorios
tecnicos/CI-
2006-01.pdf.
ZÁS - ASPECT-ORIENTED AUTHORIZATION SERVICES
53