Secure Factory Design Pattern

Overview

Imagine you’re managing the “Developer University” Portal. This portal controls digital and physical access to different parts of the university.

Based on a person’s role, they should have different levels of access:

1. Developer University Dean: Full Campus access
2. Professor: All Departments but not admin office( paid pennies)
3. Student: Only department labs and lecture halls
4. General Public: Admission Office & Amphitheater only

You want one place in your code where this trust-level-based logic is handled. That’s where the Secure Factory Pattern comes in.

Why use secure factory in the first place?

Without a secure factory, you might do this all over your code:

if (user.role == "Dean") {
  // Full access
} else if (user.role == "Student") {
  // Limited access
}

That gets messy, scattered, and error-prone. With a Secure Factory, this trust-based decision logic is handled in one spot, and your main application just gets the right access object to use.

Components of Secure Factory Design Pattern

1. SecurityCredentials class: Image it like a ID card on a person which says who they are(role) and their right to access(clearance level) within campus.

public class SecurityCredentials {
    private final String role;
    private final int clearanceLevel;

    public SecurityCredentials(String role, int clearanceLevel) {
        this.role = role;
        this.clearanceLevel = clearanceLevel;
    }

    public String getRole() { return role; }
    public int getClearanceLevel() { return clearanceLevel; }
}

• The role here can be Dean, Professor , Student , GeneralPublic
• The ClearanceLevel can be an integer value between 1 to 10 .

Note: Clearance value adds flexibility for Scaling. For instance, GuestProfessor, OtherCampusStudent

2. CampusAccess Interface: This is the product interface for all access types. This allows polymorphism(no need to check the user’s role again after you get the object).

public interface CampusAccess {
    void enterCampus();
}

3. Trust Level Implmentation

These are implementations of the CampusAccess interface

a. DeanAccess (Full Trust)

public class DeanAccess implements CampusAccess {
    @Override
    public void enterCampus() {
        System.out.println("Welcome Dean! Full access granted to entire campus.");
    }
}

b. ProfessorAccess (High Trust)

public class ProfessorAccess implements CampusAccess {
    @Override
    public void enterCampus() {
        System.out.println("Hello Professor! Access to all departments granted, admin offices restricted.");
    }
}

c. StudentAccess (Medium Trust)

public class StudentAccess implements CampusAccess {
    @Override
    public void enterCampus() {
        System.out.println("Hi Student! You can access department labs and classrooms only.");
    }
}

d. PublicAccess (Low Trust)

public class PublicAccess implements CampusAccess {
    @Override
    public void enterCampus() {
        System.out.println("Greetings Visitor! You can enter the Admissions Office and Amphitheater.");
    }
}

4. AbstractSecureFactory

This sets the blueprint and allows easy runtime swapping of factories if needed.

public abstract class AbstractSecureFactory {
    private static AbstractSecureFactory instance;

    public static AbstractSecureFactory getInstance() {
        return instance;
    }

    public static void setInstance(AbstractSecureFactory factory) {
        instance = factory;
    }

    public abstract CampusAccess getAccessObject(SecurityCredentials creds);
}

5. ConcreteSecureFactory

This is the extension of AbstractSecureFactory that involves the Campus Decision Logic.

public class CampusSecureFactory extends AbstractSecureFactory {

    @Override
    public CampusAccess getAccessObject(SecurityCredentials creds) {
        String role = creds.getRole().toLowerCase();
        int level = creds.getClearanceLevel();

        switch (role) {
            case "dean":
                return new DeanAccess();
            case "professor":
                return new ProfessorAccess();
            case "student":
                return new StudentAccess();
            default:
                return new PublicAccess();
        }
    }
}

Note: This logic could later be driven by external config (e.g., YAML, DB), enabling even greater flexibility.

Demo

Let us now run the Secure Factory Design pattern and provide Campus access

public class CampusAccessDemo {
    public static void main(String[] args) {
        AbstractSecureFactory.setInstance(new CampusSecureFactory());
        AbstractSecureFactory factory = AbstractSecureFactory.getInstance();

        SecurityCredentials dean = new SecurityCredentials("Dean", 10);
        SecurityCredentials prof = new SecurityCredentials("Professor", 7);
        SecurityCredentials student = new SecurityCredentials("Student", 4);
        SecurityCredentials visitor = new SecurityCredentials("GeneralPublic", 1);

        CampusAccess a1 = factory.getAccessObject(dean);
        CampusAccess a2 = factory.getAccessObject(prof);
        CampusAccess a3 = factory.getAccessObject(student);
        CampusAccess a4 = factory.getAccessObject(visitor);

        a1.enterCampus(); System.out.println("---");
        a2.enterCampus(); System.out.println("---");
        a3.enterCampus(); System.out.println("---");
        a4.enterCampus();
    }
}

Output

Welcome Dean! Full access granted to entire campus.
---
Hello Professor! Access to all departments granted, admin offices restricted.
---
Hi Student! You can access department labs and classrooms only.
---
Greetings Visitor! You can enter the Admissions Office and Amphitheater.

References

Dougherty, C., Sayre, K., Seacord, R. C., Svoboda, D., & Togashi, K. (2009). Secure design patterns. Software Engineering Institute.