Oracle JHeadstart Developer's Guide - Downloads - Oracle

10.6.2. When Access Denied Go To Next Group
10.6.3. JHeadstart Authorization Proxy
• A SecurityAdminAppDef application definition file is generated that can be used
to generate pages to administer the permissions and grant permissions to roles.
Using a multi-select List of Values, you can easily search and assign multiple
permissions to a role. See section Generating Security Administration Pages for
more information.
• A SQL script named PermissionsData[ServiceName].sql is generated in the
/scripts directory. The script is automatically executed when service-level
checkbox Run Generate SQL scripts? is checked. The script inserts entries in
JHS_PERMISSIONS table for each group. Four permissions are inserted for each
group, an access permission named after the group, and three “operation”
permissions for creating, updating and deleting. See section Restricting Group
Operations based on Authorization Information for more information on using
these operation permissions. In the same script, all permissions are granted to
the Administrator role as specified in the Administrator Role property. This
means that you when you use the sample user SKING to log in, you should still
be able to access all groups. If you log in as AHUNOLD you will get an access
denied message since the USER role does not have any permissions granted. You
can use the security administration application to grant permission privileges to
the USER role, as shown in the screen shot below. After you granted permissions
for one or more groups, and you will log in as AHUNOLD you will see the
group tabs for which you granted access permission. Depending on the group
action permissions granted, the group pages will allow for insert, update and/or
delete.
Suppose you have combined several Application Definitions into a single application by
providing links to the starting points of each Application Definition. That starting point
would be the first top-level group of the Application Definition. Now suppose that the
logged-in user does not have access to the first group. In that case you would want the
link to navigate to the second group. And if the user doesn't have access to the first and
second group, the link should go to the third group, etc.
JHeadstart can generate such a navigation scenario if you check the service-level
property When Access Denied go to Next Group.
The guiding principle behind the security features of JHeadstart is that the way the
application accesses the security information is as independent as possible from the
chosen implementation (JAAS and/or custom security).
To accomplish this, the JHeadstart runtime includes a class called
JhsAuthorizationProxy. If you checked the Service-level property Use Role-based
Authorization? in the Application Definition, a managed bean is generated into
JhsCommon-beans.xml that automatically creates an instance of this class and puts it on
the session.
JHeadstart Developer’s Guide Application Security 10- 21