Radsburg Inc. Employee Database Project: JAAS and Java Security

This project requires the design and implementation of an employee database processing system for Radsburg Inc. The system must authenticate employees and allow them to query or modify data based on their access rights, defined by a set of rules regarding data modification and access. The application utilizes a text file as the employee database, allowing for the creation of login accounts with encrypted passwords, and implements a user interface for account management, login, and data queries and modifications. Crucially, the project demands the use of Java's Authentication and Authorization Service (JAAS) to manage authentication and authorization, and the Java Security Manager to restrict file access, ensuring the application only accesses required files. The system must handle various user roles (CEO, VP, Manager, Associate, Junior Associate) and their respective access privileges, including querying personal data, querying subordinate's data, and modifying salary and position based on the user's role.

Goal: Design and implement an employee database processing system. The project will give you experience in
setting up security policies, invoking the Java Security Manager and using Java’s Authentication and Authorization
Service (JAAS) architecture.
Description: Radsburg Inc., a company based in the New River Valley, wants us to develop a software application
that will allow employees to check their personal data or (with some constraints) data of other employees.
For each employee Radsburg maintains the following personal data (in your code, use an appropriate type for each
of these data items):
(1) Name
(2) Id (a 4 digit decimal Id)
(3) Position (CEO, VP, Manager, Associate or Junior Associate)
(4) Name of the supervisor
a. If employee is a junior associate, supervisor field is the
name of an associate
b. If employee is an associate, supervisor field is the name of
a manager
c. If employee is a manager, supervisor field is the name of a
VP
d. If employee is a VP, supervisor is the name of the CEO
e. If employee is a CEO, supervisor field is blank.
(5) Salary
The software application authenticates an employee and then allows the employee to query or modify the data
based on the employee’s access rights. The following rules define an employee’s access right as well as constraints
on the software application:
(1) No employee can modify id, name or supervisor’s name on their own personal record.
(2) Any employee can query his or her own personal data.
(3) A supervisor can query data or change salary and position name of any of the employees who works for
her/him.
(4) A CEO can query data about any employee in the company or change their salary/position.
(5) We will just assume that the CEO’s data cannot be modified.
(6) The software application should not have access to write any file besides those required by your design
(think Java Security Manager).
Requirements
(1) Employee information database: The program refers to an employee database which is simply a text file.
Each line of the text file contains a comma delimited information about one user. You may assume that
there may be multiple users with the same first name, but have different id #s. Here’s the format of each
line of input:
First Name, Id, Position, Name of supervisor (Id of supervisor), Salary

a. Sample format (note that for the President, the Name of supervisor (Id of
supervisor) is an empty field:
Mary, 4000, President,, $1
Mary, 4014, VP, Mary (4000), $1000000
Bob, 4012, Manager, Mary (4014), $500000
Alice, 4039, Associate, Bob (4012), $100000
Tim, 4044, Associate, Bob (4012), $30000
Create different input test files to test your program.
b. Your application can store the above data in any way you choose fit (according to your design).
E.g., data about employees can be stored in one or more files. Using a database for this project is
not required or expected. I recommend using a simple flat file structure. Data must not be hard
coded into the Java program or simply stored in the program.
(2) Accept input through a user interface of your choice (can be command line or Java Swing based (GUI) –
no extra credit for GUI interface, also no extra credit for a pretty interface. Sorry!). The interface must
offer the following options for a user:
a. Create a login account, if the user hasn’t already created one.
i. User must be able to enter the following information:
Name of the user, id, desired username and desired password
ii. If the user name and id don’t match any existing employee from the employee database
(described in (1) above), throw an error message stating that the “No record exists for
this employee”.
iii. If the user name already exists prompt user to enter a different username
iv. If an account for the user (with that id) already exists inform the user that the account
exists and prompt the user if they want to overwrite the existing account.
v. Once an account is created, the id of the user, the desired username and the desired
password must be stored in a text file. Passwords must be encrypted before storing
them on the disk. Do not hardcode usernames/passwords into your program. See
guideline/tip (3) for information on how to encrypt the password.
b. Change password: User enters, username and old password before he/she is permitted to
change to a new password. The user must enter the new password twice for error check.
c. Login user: User provides username and password for logging in. Once logged in, a Subject object
with the username as the principal must be created. Your code must use the JAAS architecture
to authenticate users.
d. Query personal information: Users should be able to execute the following queries once they
are authenticated
i. Show personal data for self (all users).
ii. Show personal data for all employees who report to this user (if the user is a manager, a
VP or the President).
iii. Change salary information for an employee (if user is a manager, VP or President and
the employee works for her).
iv. Change job title for an employee (same condition as (iii) above).

(3) Use JAAS to ensure that no file other than the ones required by your design can be read or written by your
application.