To validate the integration with OES we need a sample
ADF Application that is rich enough
to allow us
to test securing the various
ADF elements.
To achieve this we can add some items including bounded task flows
to the application developed in this tutorial. A sample JDeveloper 11.1.1.6 project is available here. It depends on the Fusion Order Demo (FOD) database schema which is easily created using the FOD build scripts.In the deployment we have chosen
to enable only
ADF Authentication as we will delegate Authorization, mostly,
to OES.The welcome page of the application with all the links exposed looks as follows:
The Welcome, Browse Products, Browse Stock and System Administration links go
to pages while the Supplier Registration and Update Stock are bounded task flows. The Login link goes
to a basic login page and once logged in a link is presented that goes
to a logout page. Only the Browse Products and Browse Stock pages are really connected
to the database--the other pages and task flows do not really perform any operations on the database.
Required Security Policies
We make use of a set of test users and roles as decscribed on the welcome page of the application. In order
to exercise the different authorization possibilities we would like
to enforce the following sample policies:
Anonymous users can see the Login, Welcome and Supplier Registration links. They can also see the Welcome page, the Login page and follow the Supplier Registration task flow. They can see the icon adjacent
to the Login link indicating whether they have logged in or not.
Authenticated users can see the Browse Product page.
Only staff granted the right can see the Browse Product page cost price value returned from the database and then only if the value is below a configurable limit.
Suppliers and staff can see the Browse Stock links and pages. Customers cannot.
Suppliers can see the Update Stock link but only those with the update permission are allowed
to follow the task flow that it launches. We could hide the link but leave it exposed here so we can easily demonstrate the method call activity protecting the task flow.
Only staff granted the right can see the System Administration link and the System Administration page it accesses.
Implementing the required policies
In order
to secure the application we will make use of the following techniques:
EL Expressions and Java backing beans: JSF has the notion of EL expressions
to reference data from backing Java classes. We use these
to control the presentation of links on the navigation page which respect the security contraints. So a user will not see links that he is not allowed
to click on into. These Java backing beans can call on
to OES for an authorization decision. Important Note: naturally we would configure the WLS domain where our
ADF application is running as an OES WLS SM, which would allow us
to efficiently query OES over the PEP API. However versioning conflicts between OES 11.1.1.5 and
ADF 11.1.1.6 mean that this is not possible. Nevertheless, we can make use of the OES RESTful gateway technique from this posting in order
to call into OES.
You can easily create and manage backing beans in Jdeveloper as follows:
Custom
ADF Phase Listener:
ADF extends the JSF page lifecycle flow and allows one
to hook into the flow
to intercept page rendering. We use this
to put a check prior
to rendering any protected pages, again calling on
to OES via the backing bean. Phase listeners are configured in the adf-settings.xml file. See the MyPageListener.java class in the project. Here, for example, is the code we use in the listener
to check for allowed access
to the sysadmin page, navigating back
to the welcome page if authorization is not granted:
if (page != null && (page.equals("/system.jspx") || page.equals("/system"))){ System.out.println("MyPageListener: Checking Authorization for /system"); if (getValue("#{oesBackingBean.UIAccessSysAdmin}").toString().equals("false") ){ System.out.println("MyPageListener: Forcing navigation away from system" + "to welcome"); NavigationHandler nh = fc.getApplication().getNavigationHandler(); nh.handleNavigation(fc, null, "welcome"); } else { System.out.println("MyPageListener: access allowed"); } }
Method call activity: our app makes use of bounded task flows
to implement the sequence of pages that update the stock or allow suppliers
to self register.
ADF takes care of ensuring that a bounded task flow can be entered by only one page. So a way
to protect all those pages is
to make a call
to OES in the first activity and then either exit the task flow or continue depending on the authorization decision. The method call returns a String which contains the name of the transition
to effect. This is where we configure the method call activity in JDeveloper:
We implement each of the policies using the above techniques as follows:
Policies 1 and 2: as these policies concern the coarse grained notions of controlling access
to anonymous and authenticated users we can make use of the container’s security constraints which can be defined in the web.xml file. The allPages constraint is added automatically when we configure Authentication for the
ADF application. We have added the “anonymousss” constraint
to allow access
to the the required pages, task flows and icons:
<security-constraint> <web-resource-collection> <web-resource-name>anonymousss</web-resource-name> <url-pattern>/faces/welcome</url-pattern> <url-pattern>/afr/*</url-pattern> <url-pattern>/adf/*</url-pattern> <url-pattern>/key.png</url-pattern> <url-pattern>/faces/supplier-reg-btf/*</url-pattern> <url-pattern>/faces/supplier_register_complete</url-pattern> </web-resource-collection> </security-constraint>
Policy 3: we can place an EL expression on the element representing the cost price on the products.jspx page: #{oesBackingBean.dataAccessCostPrice}. This EL Expression references a method in a Java backing bean that will call on
to OES for an authorization decision. In OES we model the authorization requirement by requiring the view permission on the resource /MyADFApp/data/costprice and granting it only
to the staff application role. We recover any obligations
to determine the limit.
Policy 4: is implemented by putting an EL expression on the Browse Stock link #{oesBackingBean.UIAccessBrowseStock} which checks for the view permission on the /MyADFApp/ui/stock resource. The stock.jspx page is protected by checking for the same permission in a custom phase listener—if the required permission is not satisfied then we force navigation back
to the welcome page.
Policy 5: the Update Stock link is protected with the same EL expression as the Browse Link: #{oesBackingBean.UIAccessBrowseStock}. However the Update Stock link launches a bounded task flow and
to protect it the first activity in the flow is a method call activity which will execute an EL expression #{oesBackingBean.isUIAccessSupplierUpdateTransition}
to check for the update permission on the /MyADFApp/ui/stock resource and either transition
to the next step in the flow or terminate the flow with an authorization error.
Policy 6: the System Administration link is protected with an EL Expression #{oesBackingBean.UIAccessSysAdmin} that checks for view access on the /MyADF/ui/sysadmin resource. The system page is protected in the same way at the stock page—the custom phase listener checks for the same permission that protects the link and if not satisfied we navigate back
to the welcome page.
Testing the Application
To test the application:
deploy the OES11g Admin
to a WLS domain
deploy the OES gateway in a another domain configured
to be a WLS SM. You must ensure that the jps-config.xml file therein is configured
to allow access
to the identity store, otherwise the gateway will not b eable
to resolve the principals for the requested users.
To do this ensure that the following elements appear in the jps-config.xml file:
<serviceProvider type="IDENTITY_STORE" name="idstore.ldap.provider" class="oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider"> <description>LDAP-based IdentityStore Provider</description> </serviceProvider>
<serviceInstance name="idstore.ldap" provider="idstore.ldap.provider"> <property name="idstore.config.provider" value="oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider"/> <property name="CONNECTION_POOL_CLASS" value="oracle.security.idm.providers.stdldap.JNDIPool"/></serviceInstance>
<serviceInstanceRef ref="idstore.ldap"/>
download the sample application and change the URL
to the gateway in the MyADFApp OESBackingBean code
to point
to the OES
Gateway and deploy the application
to an 11.1.1.6 WLS domain that has been extended with the
ADF JRF files. You will need
to configure the FOD database connection
to point your database which contains the FOD schema.
populate the OES Admin and OES Gateway WLS LDAP stores with the sample set of users and groups. If you have configured the WLS domains
to point
to the same LDAP then it would only have
to be done once.
To help with this there is a directory called ldap_scripts in the sample project with ldif files for the test users and groups.
start the OES Admin console and configure the required OES authorization policies for the MyADFApp application and push them
to the WLS SM containing the OES Gateway.
Login
to the MyADFApp as each of the users described on the login page
to test that the security policy is correct.
You will see informative logging from the OES Gateway and the
ADF application
to their respective WLS consoles.
Congratulations, you may now login
to the OES Admin console and change policies that will control the behaviour of your
ADF application--change the limit value in the obligation for the cost price for example, or define Role Mapping policies
to determine staff access
to the system administration page based on user profile attributes.
ADF Development Notes
Some notes on
ADF development which are probably typical gotchas:
May need this on WLS startup in order
to allow us
to overwrite credentials for the database, the signal here is that there is an error trying
to access the data base: -Djps.app.credential.overwrite.allowed=true
Best
to call Bounded Task flows via a CommandLink (as opposed
to a go link) as you cannot seem
to start them again from a go link, even having completed the task flow correctly with a return activity.
Once a bounded task flow (BTF) is initated it must complete correctly via a return activity—attempting
to click on any other link whilst in the context of a BTF has no effect. See here for example:
When using the
ADF Authentication only security approach it seems
to be awkward
to allow anonymous access
to the welcome and registration pages. We can achieve anonymous access using the web.xml security constraint shown above (where no auth-constraint is specified) however it is not clear what needs
to be listed in there….for example the /afr/* and /adf/* are in there by trial and error as sometimes the welcome page will not render if we omit those items. I was not able
to use the default allPages constraint with for example the anonymous-role or the everyone WLS group in order
to be able
to allow anonymous access
to pages.
The
ADF security best practice advises placing all pages under the public_html/WEB-INF folder as then
ADF will not allow any direct access
to the .jspx pages but will only allow acces via a link of the form /faces/welcome rather than /faces/welcome.jspx. This seems like a very good practice
to follow as having multiple entry points
to data is a source of confusion in a web application (particulary from a security point of view).
In Authentication+Authorization mode only pages with a Page definition file are protected. In order
to add an emty one right click on the page and choose Go
to Page Definition. This will create an empty page definition and now the page will require explicit permission
to be seen.
It is advisable
to give a unique context root via the weblogic.xml for the application, as otherwise the application will clash with any other application with the same context root and it will not deploy
