First we make a region with security info so we can see on every page what the security settings are. This region also contains a login and logout button.
I use a backing bean to do this. The login action is done redirecting to this url /adfAuthentication?succes_url=/faces/dept.jspx and the logout is done by this /adfAuthentication?logout=true&end_url=/faces/start.jspx
public class SecurityBean {
public SecurityBean() {
}
public String getSecurityEnabled() {
if (ADFContext.getCurrent().getSecurityContext().isAuthorizationEnabled()){
return "true";
}
return "false";
}
public String getIsAuthenticated() {
if (ADFContext.getCurrent().getSecurityContext().isAuthenticated()){
return "true";
}
return "false";
}
public boolean isAuthenticated() {
return ADFContext.getCurrent().getSecurityContext().isAuthenticated();
}
public String getCurrentUser() {
return ADFContext.getCurrent().getSecurityContext().getUserName();
}
public String doLogOut() throws IOException{
ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
HttpServletResponse response = (HttpServletResponse)ectx.getResponse();
String url = ectx.getRequestContextPath()+"/adfAuthentication?logout=true&end_url=/faces/start.jspx";
response.sendRedirect(url);
return null;
}
public String doLogIn() throws IOException{
ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
HttpServletResponse response = (HttpServletResponse)ectx.getResponse();
String url = ectx.getRequestContextPath()+"/adfAuthentication?succes_url=/faces/dept.jspx" ;
response.sendRedirect(url);
return null;
}
}
In this example I have two pages , the first page start.jspx doesn't have any security so adf security uses the anomynous account.
the second page have security on the page , you need to have the role users to see this page and the navigation buttons are enabled if the user belows to the oc4j-administrators role.
Now let see how we can add page security to a page. To view this page you need to have view right. We can do this by opening the pagedef.
the next step is to add the view rights to the roles users and oc4j-administrators. We now go the pagedef structure window and select the pagedef node and with the right button we open the authorization window.
These security entries are put in system-jazn-data.xml and jazn use the pagedef name as unique entry so make sure you don't have the same pagedef twice on the production server else both pages has the same security.
You can do this also for the binding actions like next, first etc. Now we make sure that you need to have oc4j-administrator role to press next etc.
and we ready to test it.
Here you have the example project and the system-jazn-data.xml which you have to put in the config dir of the embedded oc4j . this are the users oc4jadmin / welcome , test / test
Here you define in the pagedef of the page that to see the page you have to have the view permission.
The display of a ws call with his return message is better and this display can also be used to test other web services like you can in the 10.1.3 oc4j container
The url filter and filter tester are the same as forward rule. The tape path is the ws-i log file of the saved entries. The tape rule can correct the time and size of the entries in the ws-i log file so the returning message to the ws client is valid. Loop tape is necessary if you want to retry the ws client.
Let's look how we create the adf url datacontrols. For the coordinates I use a web service from 
I put the parameters of the geonames ws in the source attribute where the values of the parameters are changed to ##abc## in this case ?placename=##place##&postalcode=.....
Now we can make an url datacontrol on the csv file with the addresses. the file looks like this
You need to have a web server to put the csv on. You can use the embedded oc4j for this. 
Here we see two operations
Let's start databaseaction, in my example it updates the time variable to the current time
Now we are ready to deploy this to an adf library and to an oc4j container. 
The last step is to configure the login task flow call.
Here I discovered that is JAX-RPC Standard Implementation of j2me doesn't support date schema elements. So I had to change the date elements to string.
On the picture below you see the changes in the diagram. JDeveloper has created a wildcard control flow with control flow cases. Now it is possible to navigate between the pages. You can do it also without a wildcard control flow but then you have to specify for every view two control flow cases to the other views. 
JDeveloper generates also a bean configuration in adfc-config.xml so you can reference it in your jsf templates
