Oracle JHeadstart Developer's Guide - Downloads - Oracle

This JhsAuthorizationProxy instance will be invoked each and every time the
application needs authorization information. So whether JAAS is used and/or custom
authorization mechanism, whether permission-based authorization is enabled, and
whether the information is needed in the View or in the Controller layer, this
‘authorization proxy’ is the single point that all authorization questions are being routed
through. The Authorization Proxy will determine whether standard JAAS and/or a
custom security implementation is used, and will forward the ‘authorization question’
accordingly.
Reference: See the Javadoc of JhsAuthorizationProxy.
10.6.3.1. Accessing the Authorization Proxy in the View layer
For implementing security features in the View layer, for instance hiding tabs and
buttons or making fields read-only based on authorization information, it would be very
convenient if the Authorization Proxy could be accessed through EL expressions. For
that reason, the JhsAuthorizationProxy implements the Map interface. We can use the
managed bean "jhsUserRoles" that was mentioned in the previous section. For instance,
to hide a menu item if the current user does not belong to the ‘ADMIN’ or
‘HR_MANAGER’ roles, JHeadstart uses the following syntax:
Note that you can use a comma-separated list of role and/or permission names. The
Authentication Proxy will process them left-to-right until it finds a role or permission
granted to the current user, and returns true in that case. If the user belongs to none of
the roles, it will return false.
10.6.3.2. Accessing the Authentication Proxy in the Controller layer
As mentioned before, JHeadstart also performs a roles check in the JSF PageLifecycle.
This is to prevent "URL-Hacking": the tab or button to go to a certain page might be
hidden, but if the user knows the URL, he should still be denied access.
This is implemented by the method checkRoles() in JhsPageLifecycle, which is
called from the prepareModel() phase.
This method knows which roles to check for which page, because JHeadstart generated a
"roles" parameter into the Page Definition of the page.
10 - 22 Application Security JHeadstart Developer’s Guide