Skip to main content

Extending Authorization Capabilities of Object Relational/Graph Mappers by Request Manipulation

  • Conference paper
  • First Online:
Database and Expert Systems Applications (DEXA 2022)


Enforcing authorization for web applications must be done on the server side. Thus, either the backend or the persistent storage are suitable layers. From a developer’s point of view, we want to use a framework to automate creating persistent storage models and to map the entities between storage and backend. However, not all such frameworks offer sufficient authorization support. From a scientist’s perspective, we want to generally combine the filtering capabilities of the persistent storage with the advantages of using a mapper framework. Therefore, we propose to intercept the communication between the backend and the mapper framework and thus provide a central point of authorization. This offers the advantage that developers are unlikely to inadvertently introduce security vulnerabilities. The request is modified by adding a filter to return only authorized entities. Filtering directly in the storage saves performance and bandwidth besides reducing development and maintenance effort.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
USD 89.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 119.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions


  1. 1.

  2. 2.

  3. 3.

  4. 4.

  5. 5.

  6. 6.


  1. Bogaerts, J., Decat, M., Lagaisse, B., Joosen, W.: Entity-based access control: supporting more expressive access control policies. In: Proceedings of the 31st Annual Computer Security Applications Conference, pp. 291–300 (2015)

    Google Scholar 

  2. Dikanski, A., Steinegger, R., Abeck, S.: Identification and implementation of authentication and authorization patterns in the spring security framework. In: The Sixth International Conference on Emerging Security Information, Systems and Technologies (SECURWARE 2012), pp. 14–30 (2012)

    Google Scholar 

  3. Jarman, J., McCart, J.A., Berndt, D., Ligatti, J.: A dynamic query-rewriting mechanism for role-based access control in databases. In: AMCIS 2008 Proceedings (2008)

    Google Scholar 

  4. Kanza, Y., Mendelzon, A.O., Miller, R.J., Zhang, Z.: Authorization-transparent access control for XML under the non-truman model. In: Ioannidis, Y., et al. (eds.) EDBT 2006. LNCS, vol. 3896, pp. 222–239. Springer, Heidelberg (2006).

    Chapter  Google Scholar 

  5. Kiczales, G., Hilsdale, E., Hugunin, J., Kersten, M., Palm, J., Griswold, W.G.: An overview of AspectJ. In: Knudsen, J.L. (ed.) ECOOP 2001. LNCS, vol. 2072, pp. 327–354. Springer, Heidelberg (2001).

    Chapter  Google Scholar 

  6. Kiczales, G., et al.: Aspect-oriented programming. In: Akşit, M., Matsuoka, S. (eds.) ECOOP 1997. LNCS, vol. 1241, pp. 220–242. Springer, Heidelberg (1997).

    Chapter  Google Scholar 

  7. Leão, F., Azevedo, L.G., Baião, F., Cappelli, C.: Enforcing authorization rules in information systems. In: IADIS International Conference Applied Computing (2011)

    Google Scholar 

  8. Lecomte, F.: strategy-spring-security-acl (2016).

  9. Mohamed, A., Auer, D., Hofer, D., Küng, J.: Authorization strategies and classification of access control models. In: Dang, T.K., Küng, J., Chung, T.M., Takizawa, M. (eds.) FDSE 2021. LNCS, vol. 13076, pp. 155–174. Springer, Cham (2021).

    Chapter  Google Scholar 

  10. Mohamed, A., Auer, D., Hofer, D., Küng, J.: Extended authorization policy for graph-structured data. SN Comput. Sci. 2(5), 1–18 (2021)

    Article  Google Scholar 

  11. Moser, O., Rosenberg, F., Dustdar, S.: Non-intrusive monitoring and service adaptation for WS-BPEL. In: Proceedings of the 17th International Conference on World Wide Web, WWW 2008, pp. 815–824. Association for Computing Machinery, New York (2008).

  12. Motro, A.: An access authorization model for relational databases based on algebraic manipulation of view definitions. In: Proceedings of Fifth International Conference on Data Engineering, pp. 339–340. IEEE Computer Society (1989)

    Google Scholar 

  13. Neo4j Inc: Tutorial - OGM Library (2021). Accessed 21 Dec 2021

  14. Neo4j Inc: Fine-grained access control (2022). Accessed 19 Jan 2022

  15. Razina, E., Janzen, D.S.: Effects of dependency injection on maintainability. In: Proceedings of the 11th IASTED International Conference on Software Engineering and Applications, Cambridge, MA, p. 7 (2007)

    Google Scholar 

  16. Rizvi, S., Mendelzon, A., Sudarshan, S., Roy, P.: Extending query rewriting techniques for fine-grained access control. In: Proceedings of the 2004 ACM SIGMOD International Conference on Management of Data, SIGMOD 2004, pp. 551–562. Association for Computing Machinery, New York (2004).

  17. Rosenthal, A., Sciore, E.: View security as the basis for data warehouse security. In: DMDW, p. 8 (2000)

    Google Scholar 

  18. Rosenthal, A., Sciore, E.: Administering permissions for distributed data: factoring and automated inference. In: Olivier, M.S., Spooner, D.L. (eds.) Database and Application Security XV. ITIFIP, vol. 87, pp. 91–104. Springer, Boston, MA (2002).

    Chapter  MATH  Google Scholar 

  19. The Linux Foundation: Linux incident (2021). Accessed 21 Dec 2021

  20. Volz, R., Oberle, D., Staab, S., Motik, B.: Kaon server-a semantic web management system. In: WWW (Alternate Paper Tracks). Citeseer (2003)

    Google Scholar 

  21. Wieringa, R.J.: Design Science Methodology for Information Systems and Software Engineering. Springer, Heidelberg (2014).

    Book  Google Scholar 

Download references


The research reported in this paper has been partly supported by the LIT Secure and Correct Systems Lab funded by the State of Upper Austria. This work has been supported by the COMET-K2 Center of the Linz Center of Mechatronics (LCM) funded by the Austrian federal government and the federal state of Upper Austria.

Author information

Authors and Affiliations


Corresponding author

Correspondence to Daniel Hofer .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2022 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Hofer, D., Nadschläger, S., Mohamed, A., Küng, J. (2022). Extending Authorization Capabilities of Object Relational/Graph Mappers by Request Manipulation. In: Strauss, C., Cuzzocrea, A., Kotsis, G., Tjoa, A.M., Khalil, I. (eds) Database and Expert Systems Applications. DEXA 2022. Lecture Notes in Computer Science, vol 13427. Springer, Cham.

Download citation

  • DOI:

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-12425-9

  • Online ISBN: 978-3-031-12426-6

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics