ADF security in your project

ADF Security implementation can be viewed as an extension to the standard J2EE container security and is executed after the standard security constraints have been processed. It is integrated in ADF of jdeveloper 11g and is implemented dynamically. This gives us many advantages such as changes in roles are immediately active and you can have different permissions in one page. For example in the pagedef you can add rights to roles on specific attributes, pages and methods. In your applications, you can also use Expression Language (EL) to show or hide items on a page based on a user's permissions, which are defined in the run time policy store.

If you use adf security in your application and you also selected anonymous access in the adf wizard then you automatically are logged in as anonymous if this page does not have security and if you go to a page where there is no anonymous security defined then you get a login window or you can start the following url /project-context/adfAuthentication to get the login windows.

Here you define in the pagedef of the page that to see the page you have to have the view permission.

If you run the adf security wizard then the following files are created or changed

workspace_home/.adf/META-INF/adf-config.xml

element sec:JaasSecurityContext added

<br /><?xml version="1.0" encoding="windows-1252" ?><br /><adf-config xmlns="http://xmlns.oracle.com/adf/config"<br /> xmlns:sec="http://xmlns.oracle.com/adf/security/config"><br /> <sec:adf-config-child xmlns="http://xmlns.oracle.com/adf/security/config"><br /> <CredentialStoreContext credentialStoreClass="oracle.adf.share.security.providers.jazn.JAZNCredentialStore"<br /> credentialStoreDefaultUser="anonymous"<br /> credentialStoreLocation="./credential-jazn-data.xml"/><br /> <sec:JaasSecurityContext initialContextFactoryClass="oracle.adf.share.security.JAASInitialContextFactory"<br /> jaasProviderClass="oracle.adf.share.security.providers.jazn.JAZNSecurityContext"<br /> authorizationEnforce="true"<br /> authenticationRequire="true"/><br /> </sec:adf-config-child><br /></adf-config><br />

workspace_home/.adf/META-INF/credential-jazn-data.xml

anonymous login account

<br /><?xml version="1.0" encoding="UTF-8" standalone='yes'?><br /><jazn-data<br /> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"<br /> xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/jazn-data-10_0.xsd"<br /> schema-major-version="10"<br /> schema-minor-version="0"<br />><br /><!-- JAZN Realm Data --><br /><jazn-realm><br /> <realm><br /> <name>jazn.com</name><br /> <users><br /> <user><br /> <name>anonymous#scott</name><br /> <guid>BE3C4D009DFA11DCBF99798553FFE673</guid><br /> <credentials>{903}9UaHhfBMZ20NuY3e1s0Gpc9jSvCqSQtjhJcdQPDwZoz13Y/DbuqxieMIkpUqo0bT9zk1mvNPsVi1<br />PLd5s8wAqjLTBoF7DvPZTH17WaaMMll3Sst5GQuBcUGMi5+DRJx4cwDVElMfQTPaF7JNmFFjdc1U<br />lSNmCoRZRFXQGUfzbSJqhzkdJZBlvS6tiTeprmMLoW5PicrkSFt5UkPIimbHB7lDmNamwr74IE3L<br />/FtNdlroVMSJ3AowWGTxpZweECbzSCIZmJ8TQVIAV8c62mM2vlaA/4lKRnr8xuSxXIDClM32JF7B<br />LfqzSNPcWfuF8tUIcg7SC/jhd4POF+GNtinLTkLEQ+rovkHHQsoiMVOOHLfWkohdYbYUPtHNpmqS<br />gglDNDKxfXGYBjx8t263k21Yi4+viwSVGMct21nYjn/I7XzM8iBvqQ8v9gs6VcG+6hIyQUrFCy71<br />2mntyBByd0mdfIFv8eGMgGXP0C4PIHwgBNSsZVg8QGI1lUzE6LMSSkmF+xRLX+DZtq8Ys29Vt3D4<br />daVyIOfrfk1MyIJJifZAeA1gUnIi5Af9HPx9fg/Ba5HsPtE+6a6Hu04=</credentials><br /> </user><br /> </users><br /> <roles><br /> </roles><br /> </realm><br /></jazn-realm><br /><!-- JACC Repository Data --><br /><jacc-repository><br /></jacc-repository><br /><jazn-permission-classes><br /></jazn-permission-classes><br /></jazn-data>

workspace_home\src\META-INF\orion-application.xml
workspace_home\src\META-INF\jps-config.xml
workspace_home\src\META-INF\jazn-data.xml

and of course the web.xml
<br /><?xml version = '1.0' encoding = 'windows-1252'?><br /><web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"><br /> <servlet><br /> <servlet-name>adfAuthentication</servlet-name><br /> <servlet-class>oracle.adf.share.security.authentication.AuthenticationServlet</servlet-class><br /> <init-param><br /> <param-name>success_url</param-name><br /> <param-value>dept.jspx</param-value><br /> </init-param><br /> <load-on-startup>1</load-on-startup><br /> </servlet><br /> <servlet-mapping><br /> <servlet-name>adfAuthentication</servlet-name><br /> <url-pattern>/adfAuthentication/*</url-pattern><br /> </servlet-mapping><br /> <session-config><br /> <session-timeout>35</session-timeout><br /> </session-config><br /> <security-constraint><br /> <web-resource-collection><br /> <web-resource-name>adfAuthentication</web-resource-name><br /> <url-pattern>/adfAuthentication</url-pattern><br /> </web-resource-collection><br /> <auth-constraint><br /> <role-name>valid-users</role-name><br /> </auth-constraint><br /> </security-constraint><br /> <login-config><br /> <auth-method>BASIC</auth-method><br /> <realm-name>jazn.com</realm-name><br /> </login-config><br /> <security-role><br /> <role-name>valid-users</role-name><br /> </security-role><br /></web-app><br />

If you start the adf security wizard yourself then select no identity store by step 4. Then you use the jazn of the embedded oc4j, the other options gives jazn errors


Make sure if you run on windows xp that you start jdeveloper in single user mode ( jdeveloper -singleuser) else the jazn editor in the embedded oc4j does nothing.

In the next adf security blog I will demostrate the different security options in a page.

JDeveloper 11g single user mode

I discovered that the jazn configuration (Identity Store) in 11g tp2 of the embedded oc4j didn't work, so I googled a bit and saw the solution of Steve Muench. It seems that jdeveloper 11g is started by default in multiuser mode. That's why it creates a jdeveloper directory with the embedded oc4j in your user folder. The jazn error is caused by a space in the folder name of the user. On windows xp you have your user data in this folder C:\Documents and Settings\ebi15170. You can solve this by starting jdeveloper with the -singleuser option or set the JDEV_USER_DIR environment variable to a folder name with no spaces.

Steve Muench hold a jdeveloper 11g page with more tip so check this out.

http analyzer to test and monitor ws

The http analyzer is not new in jdeveloper but in 11g Oracle added some new features. You can define now rules in the http analyzer. With these rules you can emulate ws and change your environment. The following rules are supported Tape, URL Substitution, Pass Through and Forward, I will explain these rules later in this blog. You can save and load the web services requests and responses in a ws-i log file, test a web service in the http analyzer in the same way as in the oc4j server and it supports https.

The display of a ws call with his return message is better and this display can also be used to test other web services like you can in the 10.1.3 oc4j container

The http analyzer support rules ,this means that one of the rules has to fire else the calling ws client gets a error. You can put in many rules and the http analyzer tests the rules from the first to the last. If the rulefilter matches then the analyzer does the action and waits for the next ws request

The first rule is forward. Forward does the same as in 10.1.3 , it passes the message on to the real web service.

In the url filter you can set the incoming url of the web service and in the target url you can set the real url of the web service. Filter tester is to test the url filter with the calling url. This can be handy because in the url filter you can define wildcards.
With the tape rule you can test the ws client without the need of the webservice. first you have to save the entries in a ws-i log file then you can use this file to respond to the ws client calls.

The url filter and filter tester are the same as forward rule. The tape path is the ws-i log file of the saved entries. The tape rule can correct the time and size of the entries in the ws-i log file so the returning message to the ws client is valid. Loop tape is necessary if you want to retry the ws client.

The last two rules are url substitution pass through rule. The first you can use if you want to change the url or parts of this url because you deployed it to an oc4j container in stead of the embedded oc4j of jdeveloper.

the pass through rule does nothing if it matches the url filter.

Conclusion, you can use the analyzer perfectly for your test environment because with the tape rule you don't need all the web services to test your ws client and if there is a change in your ws environment you can use the other rules to fix it or let is pass.