Pull Users and roles from a different service

It's quite easy to replace where the security service pulls its data, with your custom provider.
This is the core security configuration file
It merely describes the two important section:

1. The TokenHandler service, responsible for generating and validating the security token.
2. The security provider,

   <bean id="securityProvider" class="org.intalio.tempo.security.simple.SimpleSecurityProvider" init-method="init">
    <property name="configFile">
      <value>${org.intalio.tempo.configDirectory}/security.xml</value>
    </property>
   </bean>
   

The simple security provider has an LDAP equivalent called the LDAP security provider both implementing the Security Provider Interface

Security Provider has a number of key classes and interfaces associated to it:

1. A list of realms.
2. RBACProvider with all the related RBAC classes and services.
   1. RBACQuery, the query services for reviewing RBAC element sets, properties and relations.
   2. RBACAdmin, Administrative services for the creation and maintaince of RBAC element sets and relations.
   3. RBACRuntime, Runtime services for making access control decisions. This interface attempts to comply with the NIST RBAC Proposed voluntary consensus standard DRAFT.
3. AuthenticationProvider giving access to the authentication interfaces
   1. AuthenticationQuery, Administrative review services for performing queries on users of the authentication system.
   2. AuthenticationRuntime, responsible for authenticating users.
   3. AuthenticationAdmin, for creating and maintening credentials.

By default, tempo uses the SimpleSecurityProvider which pulls its data form the SimpleDatabase object, which pulls its configuration from the security.xml configuration file, where the users and the roles are defined.

The easiest way to load users and roles form a different source is to extend the SimpleDatabase to load data from our custom resource, and then make the minimal changes required in SimpleSecurityProvider, notably the database configuration file checks.
One could of course, re-implements all the interfaces described above to get a complete integration with an external service storage for users and roles.