To validate
the integration with OES we need a sample ADF Application that is rich enough to allow us to test securing
the various ADF elements. To achieve this we can add some items including bounded task flows to
the application developed in this tutorial. A sample JDeveloper 11.1.1.6 project is available here. It depends on
the Fusion Order Demo (FOD) database schema which is easily created using
the FOD build scripts.In
the deployment we have chosen to enable only ADF Authentication as we will delegate Authorization, mostly, to OES.
The welcome page of
the application with all
the links exposed looks as follows:
The Welcome, Browse Products, Browse Stock and System Administration links go to pages while
the Supplier Registration and Update Stock are bounded task flows.
The Login link goes to a basic login page and once logged in a link is presented that goes to a logout page. Only
the Browse Products and Browse Stock pages are really connected to
the database--the other pages and task flows do not really perform any operations on
the database.
Required Security Policies
We make use of a set of test users and roles as decscribed on
the welcome page of
the application. In order to exercise
the different authorization possibilities we would like to enforce
the following sample policies:
Anonymous users can see
the Login, Welcome and Supplier Registration links. They can also see
the Welcome page,
the Login page and follow
the Supplier Registration task flow. They can see
the icon adjacent to
the Login link indicating whether they have logged in or not.
Authenticated users can see
the Browse Product page.
Only staff granted
the right can see
the Browse Product page cost price value returned from
the database and then only if
the value is below a configurable limit.
Suppliers and staff can see
the Browse Stock links and pages. Customers cannot.
Suppliers can see
the Update Stock link but only those with
the update permission are allowed to follow
the task flow that it launches. We could hide
the link but leave it exposed here so we can easily demonstrate
the method call activity protecting
the task flow.
Only staff granted
the right can see
the System Administration link and
the System Administration page it accesses.
Implementing
the required policies
In order to secure
the application we will make use of
the following techniques:
EL Expressions and Java backing beans: JSF has
the notion of EL expressions to reference data from backing Java classes. We use these to control
the presentation of links on
the navigation page which respect
the security contraints. So a user will not see links that he is not allowed to click on into. These Java backing beans can call on to OES for an authorization decision. Important Note: naturally we would configure
the WLS domain where our ADF application is running as an OES WLS SM, which would allow us to efficiently query OES over
the PEP API. However versioning conflicts between OES 11.1.1.5 and ADF 11.1.1.6 mean that this is not possible. Nevertheless, we can make use of
the OES RESTful gateway technique from this posting in order to call into OES.
You can easily create and manage backing beans in Jdeveloper as follows:
Custom ADF Phase Listener: ADF extends
the JSF page lifecycle flow and allows one to hook into
the flow to intercept page rendering. We use this to put a check prior to rendering any protected pages, again calling on to OES via
the backing bean. Phase listeners are configured in
the adf-settings.xml file. See
the MyPageListener.java class in
the project. Here, for example, is
the code we use in
the listener to check for allowed access to
the sysadmin page, navigating back to
the welcome page if authorization is not granted:
if (page != null && (page.equals("/system.jspx") || page.equals("/system"))){ System.out.println("MyPageListener: Checking Authorization for /system"); if (getValue("#{oesBackingBean.UIAccessSysAdmin}").toString().equals("false") ){ System.out.println("MyPageListener: Forcing navigation away from system" + "to welcome"); NavigationHandler nh = fc.getApplication().getNavigationHandler(); nh.handleNavigation(fc, null, "welcome"); } else { System.out.println("MyPageListener: access allowed"); } }
Method call activity: our app makes use of bounded task flows to implement
the sequence of pages that update
the stock or allow suppliers to self register. ADF takes care of ensuring that a bounded task flow can be entered by only one page. So a way to protect all those pages is to make a call to OES in
the first activity and then either exit
the task flow or continue depending on
the authorization decision.
The method call returns a String which contains
the name of
the transition to effect. This is where we configure
the method call activity in JDeveloper:
We implement each of
the policies using
the above techniques as follows:
Policies 1 and 2: as these policies concern
the coarse grained notions of controlling access to
anonymous and authenticated users we can make use of
the container’s security constraints which can be defined in
the web.xml file.
The allPages constraint is added automatically when we configure Authentication for
the ADF application. We have added
the “anonymousss” constraint to allow access to
the the required pages, task flows and icons:
<security-constraint> <web-resource-collection> <web-resource-name>anonymousss</web-resource-name> <url-pattern>/faces/welcome</url-pattern> <url-pattern>/afr/*</url-pattern> <url-pattern>/adf/*</url-pattern> <url-pattern>/key.png</url-pattern> <url-pattern>/faces/supplier-reg-btf/*</url-pattern> <url-pattern>/faces/supplier_register_complete</url-pattern> </web-resource-collection> </security-constraint>
Policy 3: we can place an EL expression on
the element representing
the cost price on
the products.jspx page: #{oesBackingBean.dataAccessCostPrice}. This EL Expression references a method in a Java backing bean that will call on to OES for an authorization decision. In OES we model
the authorization requirement by requiring
the view permission on
the resource /MyADFApp/data/costprice and granting it only to
the staff application role. We recover any obligations to determine
the limit.
Policy 4: is implemented by putting an EL expression on
the Browse Stock link #{oesBackingBean.UIAccessBrowseStock} which checks for
the view permission on
the /MyADFApp/ui/stock resource.
The stock.jspx page is protected by checking for
the same permission in a custom phase listener—if
the required permission is not satisfied then we force navigation back to
the welcome page.
Policy 5:
the Update Stock link is protected with
the same EL expression as
the Browse Link: #{oesBackingBean.UIAccessBrowseStock}. However
the Update Stock link launches a bounded task flow and to protect it
the first activity in
the flow is a method call activity which will execute an EL expression #{oesBackingBean.isUIAccessSupplierUpdateTransition} to check for
the update permission on
the /MyADFApp/ui/stock resource and either transition to
the next step in
the flow or terminate
the flow with an authorization error.
Policy 6:
the System Administration link is protected with an EL Expression #{oesBackingBean.UIAccessSysAdmin} that checks for view access on
the /MyADF/ui/sysadmin resource.
The system page is protected in
the same way at
the stock page—the custom phase listener checks for
the same permission that protects
the link and if not satisfied we navigate back to
the welcome page.
Testing
the Application
To test
the application:
deploy
the OES11g Admin to a WLS domain
deploy
the OES gateway in a another domain configured to be a WLS SM. You must ensure that
the jps-config.xml file therein is configured to allow access to
the identity store, otherwise
the gateway will not b eable to resolve
the principals for
the requested users. To do this ensure that
the following elements appear in
the jps-config.xml file:
<serviceProvider type="IDENTITY_STORE" name="idstore.ldap.provider" class="oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider"> <description>LDAP-based IdentityStore Provider</description> </serviceProvider>
<serviceInstance name="idstore.ldap" provider="idstore.ldap.provider"> <property name="idstore.config.provider" value="oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider"/> <property name="CONNECTION_POOL_CLASS" value="oracle.security.idm.providers.stdldap.JNDIPool"/></serviceInstance>
<serviceInstanceRef ref="idstore.ldap"/>
download
the sample application and change
the URL to
the gateway in
the MyADFApp OESBackingBean code to point to
the OES
Gateway and deploy
the application to an 11.1.1.6 WLS domain that has been extended with
the ADF JRF files. You will need to configure
the FOD database connection to point your database which contains
the FOD schema.
populate
the OES Admin and OES Gateway WLS LDAP stores with
the sample set of users and groups. If you have configured
the WLS domains to point to
the same LDAP then it would only have to be done once. To help with this there is a directory called ldap_scripts in
the sample project with ldif files for
the test users and groups.
start
the OES Admin console and configure
the required OES authorization policies for
the MyADFApp application and push them to
the WLS SM containing
the OES Gateway.
Login to
the MyADFApp as each of
the users described on
the login page to test that
the security policy is correct.
You will see informative logging from
the OES Gateway and
the ADF application to their respective WLS consoles.
Congratulations, you may now login to
the OES Admin console and change policies that will control
the behaviour of your ADF application--change
the limit value in
the obligation for
the cost price for example, or define Role Mapping policies to determine staff access to
the system administration page based on user profile attributes.
ADF Development Notes
Some notes on ADF development which are probably typical gotchas:
May need this on WLS startup in order to allow us to overwrite credentials for
the database,
the signal here is that there is an error trying to access
the data base: -Djps.app.credential.overwrite.allowed=true
Best to call Bounded Task flows via a CommandLink (as opposed to a go link) as you cannot seem to start them again from a go link, even having completed
the task flow correctly with a return activity.
Once a bounded task flow (BTF) is initated it must complete correctly via a return activity—attempting to click on any other link whilst in
the context of a BTF has no effect. See here for example:
When using
the ADF Authentication only security approach it seems to be awkward to allow
anonymous access to
the welcome and registration pages. We can achieve
anonymous access using
the web.xml security constraint shown above (where no auth-constraint is specified) however it is not clear what needs to be listed in there….for example
the /afr/* and /adf/* are in there by trial and error as sometimes
the welcome page will not render if we omit those items. I was not able to use
the default allPages constraint with for example
the anonymous-role or
the everyone WLS group in order to be able to allow
anonymous access to pages.
The ADF security best practice advises placing all pages under
the public_html/WEB-INF folder as then ADF will not allow any direct access to
the .jspx pages but will only allow acces via a link of
the form /faces/welcome rather than /faces/welcome.jspx. This seems like a very good practice to follow as having multiple entry points to data is a source of confusion in a web application (particulary from a security point of view).
In Authentication+Authorization mode only pages with a Page definition file are protected. In order to add an emty one right click on
the page and choose Go to Page Definition. This will create an empty page definition and now
the page will require explicit permission to be seen.
It is advisable to give a unique context root via
the weblogic.xml for
the application, as otherwise
the application will clash with any other application with
the same context root and it will not deploy
