ADF Login problem

Question

Hi,
I have implemented ADF Security along with a login bean and a home managed bean according to Frank Nimphius's article in the Oracle Magazine.
Problems:
1. In design view the login link is visible, but not in the browser (Firefox vers. 19).
2. Only the logout link is visible
3. When trying to logout the current page only refreshes
Login bean
package demo.view;
import java.io.IOException;
import java.util.Map;
import javax.faces.application.FacesMessage;
import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;
import javax.security.auth.Subject;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.LoginException;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import oracle.adf.share.ADFContext;
import oracle.adf.view.rich.event.DialogEvent;
import weblogic.security.SimpleCallbackHandler;
import weblogic.security.URLCallbackHandler;
import weblogic.security.services.Authentication;
import weblogic.servlet.security.ServletAuthentication;
public class LoginBean {
    String _username = null;
    String _password = null;
    public static String USERNAMETOKEN = "_____demoOnlyUsernameAttrString___________";
    public static String PASSWORDTOKEN = "_____demoOnlyPasswordAttrString___________";
    public LoginBean() {
        super();
    public void setUsername(String _username) {
        this._username = _username;
    public String getUsername() {
        return _username;
    public void setPassword(String _password) {
        this._password = _password;
    public String getPassword() {
        return _password;
  public void onLoginAction(DialogEvent dialogEvent) {
      if (dialogEvent.getOutcome()== DialogEvent.Outcome.ok ){
        doLogin();
      else{
        //cancel, do nothing
  private String doLogin() {
      String un = _username;
      byte[] pw = _password.getBytes();
      FacesContext ctx = FacesContext.getCurrentInstance();
      HttpServletRequest request = (HttpServletRequest)ctx.getExternalContext().getRequest();
      try {         
          CallbackHandler handler = new URLCallbackHandler(un,pw);
          Subject mySubject = weblogic.security.services.Authentication.login(handler);
          weblogic.servlet.security.ServletAuthentication.runAs(mySubject, request);
          ServletAuthentication.generateNewSessionID(request);
          //save username and password. Note that in a real application this is
          //*NOT* what you should do unencrypted. Note that this is a demo
          //Store username , password in session for later use
          //when connecting to Twitter
          ADFContext adfctx = ADFContext.getCurrent();
          Map sessionScope = adfctx.getSessionScope();
          sessionScope.put(this.USERNAMETOKEN, un);
          sessionScope.put(this.PASSWORDTOKEN, new String(pw));
            String loginUrl;
            loginUrl = "/adfAuthentication?success_url=/faces" + ctx.getViewRoot().getViewId();
          HttpServletResponse response = (HttpServletResponse)ctx.getExternalContext().getResponse();
          sendForward(request, response, loginUrl);
      } catch (FailedLoginException fle) {
          FacesMessage msg =
              new FacesMessage(FacesMessage.SEVERITY_ERROR, "Incorrect Username or Password",
                               "An incorrect Username or Password" +
                               " was specified");
          ctx.addMessage("d2:it35", msg);
      } catch (LoginException le) {
          reportUnexpectedLoginError("LoginException", le);
      return null;
  private void sendForward(HttpServletRequest request,
                           HttpServletResponse response, String forwardUrl) {
      FacesContext ctx = FacesContext.getCurrentInstance();
      RequestDispatcher dispatcher = request.getRequestDispatcher(forwardUrl);
      try {
          dispatcher.forward(request, response);
      } catch (ServletException se) {
          reportUnexpectedLoginError("ServletException", se);
      } catch (IOException ie) {
          reportUnexpectedLoginError("IOException", ie);
      ctx.responseComplete();
  private void reportUnexpectedLoginError(String errType, Exception e) {
      FacesMessage msg =
          new FacesMessage(FacesMessage.SEVERITY_ERROR, "Unexpected error during login",
                           "Unexpected error during login (" + errType +
                           "), please consult logs for detail");
      FacesContext.getCurrentInstance().addMessage("d2:it35", msg);
      e.printStackTrace();
    public String logout() {
        FacesContext ctx = FacesContext.getCurrentInstance(); 
        ExternalContext ectx = ctx.getExternalContext();
        String logoutUrl = "faces" + ctx.getViewRoot().getViewId();
        ((HttpServletRequest)ectx.getRequest()).getSession().invalidate();
        try {
            ectx.redirect(logoutUrl);
        } catch (IOException e) {
            e.printStackTrace();
        return null;
}Home managed bean
package demo.view;
import java.io.IOException;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import javax.el.ELContext;
import javax.el.ExpressionFactory;
import javax.el.ValueExpression;
import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;
import javax.faces.event.ActionEvent;
import oracle.adf.model.binding.DCIteratorBinding;
import oracle.adf.view.rich.component.rich.RichPopup;
import oracle.adf.view.rich.component.rich.data.RichTree;
import oracle.adf.view.rich.component.rich.layout.RichPanelGroupLayout;
import oracle.adf.view.rich.component.rich.nav.RichCommandImageLink;
import oracle.adf.view.rich.context.AdfFacesContext;
import oracle.jbo.Key;
import oracle.jbo.uicli.binding.JUCtrlHierBinding;
import oracle.jbo.uicli.binding.JUCtrlHierNodeBinding;
import oracle.jbo.uicli.binding.JUCtrlHierTypeBinding;
import oracle.jbo.uicli.binding.JUIteratorBinding;
import org.apache.myfaces.trinidad.component.UIXSwitcher;
import org.apache.myfaces.trinidad.event.SelectionEvent;
import org.apache.myfaces.trinidad.model.CollectionModel;
import org.apache.myfaces.trinidad.model.RowKeySet;
public class HomeManagedBean {
    private RichTree locationsTree;
    private UIXSwitcher formSwitcher;
    private RichPanelGroupLayout formPanelGroup;
    private RichPopup popupP1;
    public HomeManagedBean() {
    public void setLocationsTree(RichTree locationsTree) {
        this.locationsTree = locationsTree;
    public RichTree getLocationsTree() {
        return locationsTree;
   * Custom managed bean method that takes a SelectEvent input argument to generically
   * set the current row corresponding to the selected row in the tree. Note that this
   * method is a way to replace the "makeCurrent" EL expression (#{bindings.<tree binding>.
   * treeModel.makeCurrent}that Oracle JDeveloper adds to the tree component SelectionListener
   * property when dragging a collection from the Data Controls panel. Using this custom
   * selection listener allows developers to add pre- and post processing instructions. For
   * example, you may want to enforce PPR on a specific item after a new tree node has been
   * selected. This methods performs the following steps
   * i.   get access to the tree component
   * ii.  get access to the ADF tree binding
   * iii. set the current row on the ADF binding
   * iv.  get the information about target iterators to synchronize
   * v.   synchronize target iterator
   * @param selectionEvent object passed in by ADF Faces when configuring this method to
   * become the selection listener
   * @author Frank Nimphius
  public void onTreeSelect(SelectionEvent selectionEvent) {
    /* REPLACES */
    //#{bindings.allLocations.treeModel.makeCurrent}
   /* custom pre processing goes here */
  //get the tree information from the event object
  RichTree tree1 = (RichTree) selectionEvent.getSource();
  //in a single selection case ( a setting on the tree component ) the added set only
  //has a single entry. If there are more then using this method may not be desirable.
  //Implicitly we turn the multi select in a single select later, ignoring all set
  //entries than the first
  RowKeySet rks2 = selectionEvent.getAddedSet();
  //iterate over the contained keys. Though for a single selection use case we only expect
  //one entry in here
  Iterator rksIterator = rks2.iterator();
  //support single row selection case
  if (rksIterator.hasNext()){
    //get the tree node key, which is a List of path entries describing the
    //location of the node in the tree including its parents nodes
    List key = (List)rksIterator.next();
   //get the ADF tree  binding to work with
    JUCtrlHierBinding treeBinding = null;
    //The Trinidad CollectionModel is used to provide data to trees and tables. In the
    //ADF binding case, it contains the tree binding as wrapped data
    treeBinding = (JUCtrlHierBinding) ((CollectionModel)tree1.getValue()).getWrappedData();
    //find the node identified by the node path from the ADF binding layer. Note that
    //we don't need to know about the name of the tree binding in the PageDef file because
    //all information is provided
    JUCtrlHierNodeBinding nodeBinding = nodeBinding = treeBinding.findNodeByKeyPath(key);
    //the current row is set on the iterator binding. Because all bindings have an internal
    //reference to their iterator usage, the iterator can be queried from the ADF binding
    //object
    DCIteratorBinding _treeIteratorBinding = null;
    _treeIteratorBinding = treeBinding.getDCIteratorBinding();
    Key rowKey = nodeBinding.getRowKey();
    JUIteratorBinding iterator = nodeBinding.getIteratorBinding();
    iterator.setCurrentRowWithKey(rowKey.toStringFormat(true));
    //get selected node type information
    JUCtrlHierTypeBinding typeBinding =  nodeBinding.getHierTypeBinding();
    // The tree node rule may have a target iterator defined. Target iterators are
    // configured using the Target Data Source entry in the tree node edit dialog
    // and allow developers to declaratively synchronize an independent iterator
    // binding with the node selection in the tree.
    String targetIteratorSpelString = typeBinding.getTargetIterator();     
    //chances are that the target iterator option is not configured. We avoid
    //NPE by checking this condition
    if (targetIteratorSpelString != null && !targetIteratorSpelString.isEmpty()) {
      //resolve SPEL string for target iterator
      DCIteratorBinding targetIterator = resolveTargetIterWithSpel(targetIteratorSpelString);
      //synchronize the row in the target iterator
      targetIterator.setCurrentRowWithKey(rowKey.toStringFormat(true));
    /********************* DISPLAY INPUT FORM FOR SELECTED NODE **********************/
    //get the name of the selectected tree node object. In this sample the value is
    //adf.sample.model.DepartmentsView,adf.sample.model.EmployeesView or
    //adf.sample.model.LocationsView
    String selectedNodeObjectRef = typeBinding.getStructureDefName();
    //write selected node object reference to session
    AdfFacesContext adfFacesCtx = AdfFacesContext.getCurrentInstance();
    Map viewScope = adfFacesCtx.getViewScope();
    viewScope.put("nodeRef",selectedNodeObjectRef);
    //refresh form display
    adfFacesCtx.addPartialTarget(this.getFormPanelGroup());
   * Helper method to resolve EL expression into DCIteratorBinding instance
   * @param spelExpr the SPEL expression starting with ${...}
   * @return DCIteratorBinding instance
  private DCIteratorBinding resolveTargetIterWithSpel(String spelExpr){
   FacesContext fctx = FacesContext.getCurrentInstance();
   ELContext elctx = fctx.getELContext();
   ExpressionFactory elFactory = fctx.getApplication().getExpressionFactory();
   ValueExpression valueExpr = elFactory.createValueExpression(elctx, spelExpr,Object.class);
   DCIteratorBinding dciter = (DCIteratorBinding) valueExpr.getValue(elctx);  
   return dciter;
    public void setFormPanelGroup(RichPanelGroupLayout formPanelGroup) {
        this.formPanelGroup = formPanelGroup;
    public RichPanelGroupLayout getFormPanelGroup() {
        return formPanelGroup;
    //based on the current state of the login link,
    //log user in or out
    public void onLoginLogout(ActionEvent actionEvent) {
        RichCommandImageLink rcil = (RichCommandImageLink) actionEvent.getComponent();
        String commandLinkIcon = rcil.getIcon();
        if (commandLinkIcon.indexOf("glbl_login_msg.gif") >0){
          //login
          RichPopup.PopupHints hints = new RichPopup.PopupHints();
          popupP1.show(hints);
        else{
          //logout        
          FacesContext fctx = FacesContext.getCurrentInstance();
          ExternalContext ectx = fctx.getExternalContext();
            try {
                ectx.redirect("/adfAuthentication?logout=true&end_url=/faces/home.jspx");
            } catch (IOException e) {
                e.printStackTrace();
    public void setPopupP1(RichPopup popupP1) {
        this.popupP1 = popupP1;
    public RichPopup getPopupP1() {
        return popupP1;
}Source code in home page
<af:commandImageLink text="Logout" id="commandImageLink1"
                                                          icon="#{resource['images:glbl_logout.gif']}"
                                                     rendered="#{securityContext.authenticated}" partialSubmit="true"
                                                     immediate="false"
                                                          inlineStyle="font-family:Arial, Helvetica, sans-serif; font-size:11px; color:White;"
                                                             action="#{LoginBean.logout}"/>
                                     <af:commandImageLink text="Login" id="cil1"
                                                          icon="#{resource['images:glbl_login_msg.gif']}"
                                                     rendered="#{!securityContext.authenticated}"
                                                          inlineStyle="font-family:Arial, Helvetica, sans-serif; font-size:11px; color:White;"
                                                          action="#{LoginBean.toString}">
                                    <af:showPopupBehavior popupId="p1" triggerType="action" align="startAfter"
                                                          alignId="cil1"/>
                                </af:commandImageLink>
                                <af:popup id="p1" binding="#{HomeManagedBean.popupP1}">
                                    <af:dialog id="d2" title="Please Login" type="okCancel" closeIconVisible="false"
                                               modal="true" stretchChildren="none"
                                               dialogListener="#{LoginBean.onLoginAction}">
                                        <af:panelFormLayout id="pfl5">
                                            <af:inputText label="Username" id="it34" columns="20"
                                                          value="#{LoginBean.username}"/>
                                            <af:inputText label="Password" id="it35" secret="true" columns="20"
                                                          value="#{LoginBean.password}"/>
                                            <af:message id="m2" for="it35" messageType="error"/>
                                        </af:panelFormLayout>
                                    </af:dialog>
                                </af:popup>Other settings:
1. No welcome page set in web.xml
2. No redirect page set in jazn-data.xml
3. Users, Enterprise and application roles set in ADF Security
4. Managed Beans registered in adfc-config.xml
Help greatly appreciated!

Answer 1

Without going through all the code:
the visibility of the links depends on
logout:
rendered="#{securityContext.authenticated}"
login:
rendered="#{!securityContext.authenticated}"This means, if you see the logout link, but not the loging link, the framework assumes that you are logged in already.
Investigate in this direction.
Timo