Design and Implementation of a Flexible Function Access Control Tool for Web Applications

Abstract

This paper presents a flexible and practical tool, F-menugen, which supports\r\nfunction access control on the presentation tier by restricting user menus to functions\r\nthat a user’s access privileges permit. The menu structure and rules governing the\r\nfunctions accessible to a user are specified declaratively in an XML configuration\r\nfile; the rules are based on user profiles, application-specific requirements, and certain\r\ncontextual information. After user login, the tool will generate a tailored function\r\nmenu according to the user’s access privileges. Future changes of access control\r\nrules can also be effectively realized by modifying the configuration file without actual\r\ncoding.