Aspect-Oriented Modeling of Access Control in Web Applications Gefei Zhang Joint work with Hubert Baumeister, Nora Koch and Alexander Knapp UML-BASED WEB ENGINEERING Ludwig-Maximilians-Universität München, Germany WAOM 2005, Chicago

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago2 Motivation & Goal Access control in Web applications: In current Web engineering methods: entangled with navigation design redundant modeling We propose: viewing access control as a cross-cutting concern using aspects for better modularization Extension of UML-based Web Engineering (UWE) 1 by aspect-oriented modeling of access control 1 UML’00, IWWOST’01-03, ICWE’03, UML’04

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago3 Content UWE overview Example of modeling access control Aspect orientation Conclusions and future work

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago4 UWE Approach: Overview Common language for data interchange is a conservative extension of the UML metamodel UWE metamodel An approach for the development of Web applications Based on UML and the Unified Process Supports requirement elicitation, content, navigation, business process, and presentation modeling

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago5 UWE Metamodel: Navigation * Class (Foundation Core) NavigationNode Association (Foundation Core) Link +source + outLinks { derived } + inLinks +target 1 1 * Structure Behavior NavigationNode StateMachine context 0..1 behavior * Default State Machine inv: self.oclAsType(ModelElement).behavior.size() = 1 {derived}

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago6 Example: Online Library Indexes & Menu: public Journals, Books and Papers: for registered users only

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago7 Example: Access Control (Naïve)

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago8 Modularization with Aspects: Syntax Pointcut Advice

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago9 Modularization with Aspects: Weaving State Machine of Aspect State Machine of Classes Resulting State Machine

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago10 Modularization with Aspects: Metamodel Aspect StateMachine context 0..1 behavior {derived} inv: self.oclAsType(ModelElement).behavior.size() = 1 * Structure Behavior

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago11 Aspects of Aspects Pointcut State Machine of AccessControl State Machine of Limit

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago12 Conclusions modularized modeling using aspect-oriented state machines weaving result: substates metamodel extension Future Work formal semantics tool support aspect-oriented UML (AO class diagrams for modeling user adaptivity summitted to ICWE’05) Summary

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago13 Thanks for your attention!! Questions & Answers We appreciate your feedback...

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago14 Example: Access Control (Book)

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago15 Example: Access Control (Paper)

G. Zhang et al., Workshop Aspect-Oriented AOSD’05, March 05, Chicago16 UWE Metamodel: The Big Picture UML 1.5 UWE Model Management Behavioral Elements Foundation Behavioral ElementsModel Management Core Context User Environment PresentationNavigation Conceptual Adaptation Process