ASA Programming Guide
  Using Java in the Database
    Special features of Java classes in the database

Implementing your own security manager

There are several steps to implementing your own security manager.

To provide your own security manager

1. Implement a class that extends java.lang.SecurityManager.

   The SecurityManager class has a number of methods to check whether a particular action is allowed. If the action is permitted, the method returns silently. If the method returns a value a SecurityException is thrown.

   You must override methods that govern actions you wish to permit with methods that return silently. You can do this by implementing a public void method.

2. Assign appropriate users to your security manager.

   You use the add_user_security_manager, update_user_security_manager, and delete_user_security_manager system stored procedures to assign security managers to a user. For example, to assign the MySecurityManager class as the security manager for a user, you would execute the following command:

   call dbo.add_user_security_manager(
     user_name, 'MySecurityManager', NULL )

Example 

The following class allows reading from files but disallows writing:

public class MySecurityManager extends SecurityManager
{ public void checkRead(FileDescriptor) {}
  public void checkRead(String) {}
  public void checkRead(String, Object) {}
}

The SecurityManager.checkWrite methods are not overridden, and prevent write operations on files. The checkRead methods return silently, permitting the action.