Oracle JHeadstart Developer's Guide - Downloads - Oracle

10.7. Restricting Group And Item Operations based on Authorization Information
In addition to restriction group access, you can also restrict the operations based on
authorization information. To do this for individual groups, use the
Insert/Update/Delete Allowed EL Expression properties on group level.
In the above example, both the HR_MANAGER and HR_ASSISTANT roles can access
the Employee group pages. The HR_MANAGER can insert, update and delete employee
information; the HR_ASSISTANT can only update existing employees.
10.7.1. Restricting Group Operations using Permissions
As explained in section Restricting Group Access using Permissions JHeadstart can
generate a SQL script that inserts operation permissions in the JHS_PERMISSIONS table
for each group. These operation permissions are named after the group, suffixed with
“.Create” “.Update” and “.Delete. For example, for the Jobs group the following
permissions are created:
• The “Jobs.Create” permission determines whether the “New Job” button is
rendered.
• The “Jobs.Update” permission determines how the items on the Edit Job page
will be rendered: as read only when the user does not have a role with this
permission, or as updateable when the user does have this permission.
• The “Jobs.Delete” permission determines whether the “Delete Job” button is
rendered
Now, you can use these permissions rather than role names to restrict the create, update
and delete operations. And you can configure this at service-level, which saves you the
work of entering the Insert Allowed, Update Allowed and Delete Allowed EL
expressions for each and every group. The same properties exist at service level, and you
can use the $GROUP_NAME$ token which will be replaced with the actual group name
when generating the pages for each group.
10 - 24 Application Security JHeadstart Developer’s Guide