Question

I'm making a mock inventory program for an inventory database, and I want to implement a feature where if in a use case scenario, a warehouse receiver (who wouldn't have administrator login status in the company network I would hope) would attempt to delete a record of the database, he would have to enter OS level administrator authentication since deletion of records could wreak tax audit havoc. I want to make the deletion still accessible if the real person in the office next door could access the software if the receiver informs his supervisor that he's made a critical mistake in data entry such as UPC. The supervisor could then inform her network admin...

So with that said, I'm wondering how I call the operating system. Since I've never done this before the first thing that came to mind was something like

String adminPassword = JOptionPane.showInputDialog(
                       "Enter Network Administrator Password");

if(callSomeOSFeatureForAdminPasswordReturnsTrue(adminPassword)){ 
    record.delete();
}

Sorry if this is a dumb question but I've never done anything like this and it doesn't make sense from a security standpoint because then what's to prevent a rather dark-minded programmer from transmitting that String? That's kind of a tangent but basically I just would like to know what I should look up to make sure end user local network administrator level authentication is done on a database record deletion attempt. Every year warehouses have to audit everything in the inventory so if some receiver thought "delete" was supposed to be used every time you ran out of a product temporarily the audit would be a nightmare (Trust me, I've been through these in real life and they're like a tornado through the warehouse, and if more than only a tiny amount of things are unaccounted for, the supervisors are BEYOND mad.)

Was it helpful?

Solution

This is not something that will be built into Java - it runs in a virtual machine, (mostly) independent of the actual Operating System. You have to rely on calling some program on the machine that will answer a question like that. This is dependant on the actual OS that is running, so it will not be cross-platform. Also you should not be asking for a password and then sending it forward.

But you should not be doing this anyway - privileges in a database should be related to the database users - not to whether the user is an admin on his computer. So you should rethink the security there.

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top