Oracle JHeadstart Developer's Guide - Downloads - Oracle

10.6. Restricting Access to Groups based on Authorization Information
When you have checked the service-level checkbox Use Role-based Authorization and
you selected an Authorization Type, you can restrict access to the pages generated for
each group by specifying roles or permissions. This can be done using the group level
property Authorized Roles/Permissions where you can specify a comma-separated list
of roles and/or permissions. If the user is granted at least one of the roles or permissions,
he is authorized to access the page.
If this property is not set, the pages generated for this group are public, and do not
require a specific user role or permission.
If you protect group pages using this property, JHeadstart will implement this restriction
in both the View and Controller layer:
10.6.1. Restricting Group Access using Permissions
• View layer (JSF pages): Hide tabs and navigation buttons that go to a page of
that group if the currently logged-in user is not authorized. See section
JHeadstart Authorization Proxy for more information on how this is
implemented.
• Controller Layer: If the user tries to directly access an unauthorized page by
“hacking” the browser URL, he should still be denied access. JHeadstart
performs this check for you. See section JHeadstart Authorization Proxy for
more information on how this is implemented.
The above example used role names to restrict access to a particular group. As explained
in section Hardcoding Roles or Permissions in Application Code you might prefer to
authorize using permission names. To do so, you check the service-level checkbox
Authorize Using Group Permissions.
Note that this property can be used regardless of the values set for Authentication Type
and Authorization Type.
When you generate your application with this setting, the following happens
• All groups are protected using the group name as permission name. This means
that you do not have to specify the Authorized Role/Permissions property for
each and every group. You can still specify this property at the group level, to
override the default group name permission.
10 - 20 Application Security JHeadstart Developer’s Guide