The Oracle
ADF Security feature provides a declarative and visual development environment
for building Oracle platform security services-based security into Oracle ADF
applications. Together, Oracle ADF Security and Oracle platform security
services enable developers to focus more onwhat needs to
be protected than on how it should
be protected.
This article introduces Oracle ADF Security and shows how
developers can use it to implement security within their enterprise Oracle ADF
applications.
Roles
Three key
concepts are critical in understanding Oracle ADF Security and Oracle platform
security services: user
identities, enterprise roles, and application roles.
User identities define users in an
enterprise. Users—such as company employees—usually have a single
username/password pair they use to authenticate themselves to applications
within an organization. A user identity defines only who the user is—it does
not define any access privileges.
To ease system deployment, administrators often organize users
into enterprise roles, which provide a way to manage groups of users who have
similar requirements when accessing enterprise resources. For example,
employees may all be grouped into an enterprise role called Employees to give
them access to all employee self-service applications within an enterprise.
From an administrative point of view, it is easier to add users to or remove them
from an enterprise role than to maintain individual user grants for an
application.
Application roles are specific to an application and are used to
grant privileges to users defined in enterprise roles. Application roles make
it possible for all users who belong to an enterprise role (such as Employees)
to have specific access privileges defined for various applications. For users
within an enterprise role to work within an application, application roles must
be granted to the enterprise role. Application roles can be granted directly to
users, but this practice is rare and is not considered good programming design.
Enabling Oracle ADF
Security
By digging deeper inside
the sample Oracle ADF application, you can see how the security rule
definitions described above are implemented for the three defined user
accounts.
The first step in securing an application is to
enable Oracle ADF Security. In the OramagAdfSecurity project, select Application -> Secure -> Configure
ADF Security to open the Oracle ADF Security wizard. This wizard is
re-entrant, so you can safely open it and browse security settings without
worrying about losing data.
The first dialog box in the configuration wizard
enables you to define the type of security you want. The ADF
Authentication and Authorization option, used in the sample
application, enables you to configure login information as well as access to
specific application features. Another option,ADF Authentication, is for
controlling only who can access the application (via a login dialog box when a
user requests access to the application). The Remove ADF Security
Configurationoption does not delete any existing policy definitions, but it
disables the enforcement of Oracle ADF Security. This option can be useful for
allowing application testing while temporarily disabling security.
In Conclusion
Oracle ADF Security simplifies a complex topic by abstracting JAAS
authorization and Java EE authentication. With Oracle ADF, you use visual
editors to protect the resources you care about the most and enforce security
configurations. You can also use security expression language or Java in
applications to verify user access rights. With all the simplicity added, the
most important thing to be aware of is that applying security to an application
is a journey and not a destination
