14.01.2013 Views

Oracle JHeadstart Developer's Guide - Downloads - Oracle

Oracle JHeadstart Developer's Guide - Downloads - Oracle

Oracle JHeadstart Developer's Guide - Downloads - Oracle

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

10.1.6. ADF BC Security<br />

• Regenerate your application again using <strong>JHeadstart</strong>. This will move back the<br />

<strong>JHeadstart</strong>-generated element to the web.xml, which was<br />

overridden when finishing the ADF Security wizard.<br />

When using ADF Business Components, you can define Read-Only, Update, and<br />

Update-While-New permissions on an entity object, or on individual attributes of an<br />

entity object.<br />

Similar permissions can be set on the page definitions using ADF Model Security, if used<br />

both, the most restrictive permission wins. Using ADF BC Security is more efficient in<br />

configuring. Authorization rules are defined once at the entity object level and are<br />

automatically carried forward to all view objects based on these entity objects, and to all<br />

page definitions that contain iterator and value bindings based on these view objects.<br />

ADF BC Security relies on JAAS. If you want to use it, you need to configure JAAS-based<br />

security with <strong>JHeadstart</strong>.<br />

10.1.7. ADF Model Security vs. ADF BC Security<br />

ADF Developer’s <strong>Guide</strong>, Configuring the ADF Business Components<br />

Application to Use Container-Manage Security.<br />

http://download-uk.oracle.com/docs/html/B25947_01/adding_security004.htm<br />

The added value of ADF Model Security on top of ADF BC security is the possibility to<br />

declaratively secure action/method bindings. This comes at the price of much more<br />

overhead in configuring the authorization rules. You cannot use ADF Model Security to<br />

only secure action/method bindings, once enabled you need to specify authorization<br />

rules for all bindings.<br />

So, as an alternative, you might choose to programmatically add a security check in Java<br />

at the start of the methods underlying the action/method bindings.<br />

If your application accesses multiple business service technologies, not just ADF<br />

Business Components, ADF Model Security becomes a more attractive option, in<br />

particular when those other technologies do not have the built-in authorization support<br />

provided by ADF BC.<br />

<strong>JHeadstart</strong> Developer’s <strong>Guide</strong> Application Security 10- 7

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!