Oracle JHeadstart Developer's Guide - Downloads - Oracle

10.8. Using Your Own Security Tables
You can use your own security tables rather than the JHeadstart tables, if you prefer so.
The JHeadstart runtime includes predefined “hooks” where you can plug in your own
security code to access your own security tables. The hooks to use depend on your
security settings, as described in the next sections
10.8.1. Changes when Using JAAS Custom Login Module
Using your own security tables instead of the JHeadstart tables and view is easiest when
using a JAAS custom login module: just change the options of the
element to reference your own table and column names. Consider creating a database
view like JHS_USER_ROLE_INFO if your security data model does not comply with the
prerequisites of your custom login module provider.
10.8.2. Changes when Using Custom Authentication
When you use custom authentication, the authenticateUser method of the nested
JhsModelService application module is called. To hook in your own authentication logic,
you should perform the following steps:
• Create your own application module that extends JhsModelService application
module.
• Add the view object needed to authenticate the user against your own table.
• In this application module, override method authenticateUser and perform
authentication using the view object created in the previous step
• Remove the JhsModelService as nested usage from your root application module
• Add your extended version of JhsModelService application module as nested
usage to your root application module, and make sure the instance name is set
to JhsModelService.
10.8.3. Changes when Using Custom Authorization and/or Permissions
The JHeadstart Authorization Proxy makes use of method
createUserContext(String username, String userDisplayName, boolean
addPermissionForJAASRoles)
on the nested JhsModelService application module. This method creates a user context
object that implements the JhsUser interface, and adds authorized custom roles and
permissions by calling method setRolesAndPermissions on the same
JhsModelService application module.
So, to use your own tables for role and permission information, it is sufficient to override
method setRolesAndPermissions. Override this method in your own application module
that extends JhsModelService, and replace the nested JhsModelService instance with
your subclass.
10 - 26 Application Security JHeadstart Developer’s Guide