ADF security in your project

ADF Security implementation can be viewed as an extension to the standard J2EE container security and is executed after the standard security constraints have been processed. It is integrated in ADF of jdeveloper 11g and is implemented dynamically. This gives us many advantages such as changes in roles are immediately active and you can have different permissions in one page. For example in the pagedef you can add rights to roles on specific attributes, pages and methods. In your applications, you can also use Expression Language (EL) to show or hide items on a page based on a user's permissions, which are defined in the run time policy store.

If you use adf security in your application and you also selected anonymous access in the adf wizard then you automatically are logged in as anonymous if this page does not have security and if you go to a page where there is no anonymous security defined then you get a login window or you can start the following url /project-context/adfAuthentication to get the login windows.

Here you define in the pagedef of the page that to see the page you have to have the view permission.

If you run the adf security wizard then the following files are created or changed

workspace_home/.adf/META-INF/adf-config.xml

element sec:JaasSecurityContext added

<br /><?xml version="1.0" encoding="windows-1252" ?><br /><adf-config xmlns="http://xmlns.oracle.com/adf/config"<br /> xmlns:sec="http://xmlns.oracle.com/adf/security/config"><br /> <sec:adf-config-child xmlns="http://xmlns.oracle.com/adf/security/config"><br /> <CredentialStoreContext credentialStoreClass="oracle.adf.share.security.providers.jazn.JAZNCredentialStore"<br /> credentialStoreDefaultUser="anonymous"<br /> credentialStoreLocation="./credential-jazn-data.xml"/><br /> <sec:JaasSecurityContext initialContextFactoryClass="oracle.adf.share.security.JAASInitialContextFactory"<br /> jaasProviderClass="oracle.adf.share.security.providers.jazn.JAZNSecurityContext"<br /> authorizationEnforce="true"<br /> authenticationRequire="true"/><br /> </sec:adf-config-child><br /></adf-config><br />

workspace_home/.adf/META-INF/credential-jazn-data.xml

anonymous login account

<br /><?xml version="1.0" encoding="UTF-8" standalone='yes'?><br /><jazn-data<br /> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"<br /> xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/jazn-data-10_0.xsd"<br /> schema-major-version="10"<br /> schema-minor-version="0"<br />><br /><!-- JAZN Realm Data --><br /><jazn-realm><br /> <realm><br /> <name>jazn.com</name><br /> <users><br /> <user><br /> <name>anonymous#scott</name><br /> <guid>BE3C4D009DFA11DCBF99798553FFE673</guid><br /> <credentials>{903}9UaHhfBMZ20NuY3e1s0Gpc9jSvCqSQtjhJcdQPDwZoz13Y/DbuqxieMIkpUqo0bT9zk1mvNPsVi1<br />PLd5s8wAqjLTBoF7DvPZTH17WaaMMll3Sst5GQuBcUGMi5+DRJx4cwDVElMfQTPaF7JNmFFjdc1U<br />lSNmCoRZRFXQGUfzbSJqhzkdJZBlvS6tiTeprmMLoW5PicrkSFt5UkPIimbHB7lDmNamwr74IE3L<br />/FtNdlroVMSJ3AowWGTxpZweECbzSCIZmJ8TQVIAV8c62mM2vlaA/4lKRnr8xuSxXIDClM32JF7B<br />LfqzSNPcWfuF8tUIcg7SC/jhd4POF+GNtinLTkLEQ+rovkHHQsoiMVOOHLfWkohdYbYUPtHNpmqS<br />gglDNDKxfXGYBjx8t263k21Yi4+viwSVGMct21nYjn/I7XzM8iBvqQ8v9gs6VcG+6hIyQUrFCy71<br />2mntyBByd0mdfIFv8eGMgGXP0C4PIHwgBNSsZVg8QGI1lUzE6LMSSkmF+xRLX+DZtq8Ys29Vt3D4<br />daVyIOfrfk1MyIJJifZAeA1gUnIi5Af9HPx9fg/Ba5HsPtE+6a6Hu04=</credentials><br /> </user><br /> </users><br /> <roles><br /> </roles><br /> </realm><br /></jazn-realm><br /><!-- JACC Repository Data --><br /><jacc-repository><br /></jacc-repository><br /><jazn-permission-classes><br /></jazn-permission-classes><br /></jazn-data>

workspace_home\src\META-INF\orion-application.xml
workspace_home\src\META-INF\jps-config.xml
workspace_home\src\META-INF\jazn-data.xml

and of course the web.xml
<br /><?xml version = '1.0' encoding = 'windows-1252'?><br /><web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"><br /> <servlet><br /> <servlet-name>adfAuthentication</servlet-name><br /> <servlet-class>oracle.adf.share.security.authentication.AuthenticationServlet</servlet-class><br /> <init-param><br /> <param-name>success_url</param-name><br /> <param-value>dept.jspx</param-value><br /> </init-param><br /> <load-on-startup>1</load-on-startup><br /> </servlet><br /> <servlet-mapping><br /> <servlet-name>adfAuthentication</servlet-name><br /> <url-pattern>/adfAuthentication/*</url-pattern><br /> </servlet-mapping><br /> <session-config><br /> <session-timeout>35</session-timeout><br /> </session-config><br /> <security-constraint><br /> <web-resource-collection><br /> <web-resource-name>adfAuthentication</web-resource-name><br /> <url-pattern>/adfAuthentication</url-pattern><br /> </web-resource-collection><br /> <auth-constraint><br /> <role-name>valid-users</role-name><br /> </auth-constraint><br /> </security-constraint><br /> <login-config><br /> <auth-method>BASIC</auth-method><br /> <realm-name>jazn.com</realm-name><br /> </login-config><br /> <security-role><br /> <role-name>valid-users</role-name><br /> </security-role><br /></web-app><br />

If you start the adf security wizard yourself then select no identity store by step 4. Then you use the jazn of the embedded oc4j, the other options gives jazn errors


Make sure if you run on windows xp that you start jdeveloper in single user mode ( jdeveloper -singleuser) else the jazn editor in the embedded oc4j does nothing.

In the next adf security blog I will demostrate the different security options in a page.