ADF Security basics

Question

I've been reading about the adf security and have been trying to implement it in a simple application. The documents I've been referring to are the Oracle Fusion middleware developer guide, Chapter 28 and the online videos from the Core Code center. I've also read some blog entries but there isn't much information about adf security on the web.
This is what I'm trying to do:
I want a welcome page which is accessable to everybody. You can choose to login from the welcome page and then you have a option to go to a task flow which the user has access rights to.
I set up the security context in the web.xml accordingly:
<security-constraint>
<web-resource-collection>
<web-resource-name>adfAuthentication</web-resource-name>
<url-pattern>/adfAuthentication</url-pattern>
<url-pattern>/</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>valid-users</role-name>
</auth-constraint>
</security-constraint>
Thus securing the / url pattern. I then gave anonymous-role access to the welcome page, thinking that it would make the page public. But I still have to log in to get access to the welcome.jspx. Maybe I'm not supposed to set the url pattern to / in the security-constraint, but it was the only way I could find to secure the task-flow. If the url pattern was only /adfAuthentication then I was not redirected to the login.jspx page when trying to access it as anonymous.
I've read chapter 28 three times but I still find it somewhat confusing. How are the web.xml and the jazn-data.xml files linked? What am I doing wrong here?
I've managed to secure the taskflow and users with view access to that task flow are the only users that can see it. But there also seem to be some bugs conserning jdeveloper and the jazn-data.xml file. For example I made access right changes in the jazn-data.xml file. I granted view access to a specific page to a user. I then ran the applicaion to see if he had access and he didn't. I then shut down jdeveloper and started it up again and re-ran the application and then the user had access. Hopefully the future updates will fix this.
Best regards,
Sturla Thor

Answer 1

Hi,
"/" protects the application root and requires users to login before the application renders the first page. There is no way to grant anonymous access to this. To defer authentication you will have to remove "/" and just stick with the other entry, which is used by the ADF Security authentication servlet.
To login from the welcome page is a it tricky because there exist no standard API for this. There is a WebLogic proprietary API that you can use. But then you will need to make sure that the user is explicitly redirected after providing the login credentials so the container becomes aware of it
The code below is from a sample I wrote
import weblogic.servlet.security.ServletAuthentication;
    public String login()  {
            FacesContext fctx = FacesContext.getCurrentInstance();           
            HttpServletRequest  request = (HttpServletRequest)fctx.getExternalContext().getRequest();
            HttpServletResponse response = (HttpServletResponse)fctx.getExternalContext().getResponse();      
            int authSuccess;
            try {               
                authSuccess = ServletAuthentication.login(username,password,request,response);
                if (authSuccess == ServletAuthentication.AUTHENTICATED){
                    userAuthenticated = true;
               loginPanel.setRendered(false);
               return "login";
            // the login exception provides information abput the cause of the failure (e.g. account locked,
            // password expired etc. For this, make sure the authentication provider propagates the exception
            catch(FailedLoginException fle){
                  String excmessage = fle.getMessage();
                  boolean authentication_failed = excmessage.indexOf("090304") > -1?true:false;
                  if (authentication_failed){
                      informUser("Authentication failed because of a wrong credentials pair",
                                 "Please make sure a valid username and password pair is provided in correct case",usernamefield);
                  else{
                      informUser("Authentication failed with unknown reason",
                                 "Please call the IT SWAT team at 0123-456-7",usernamefield);
            catch (LoginException le) {
                  informUser("Authentication failed with unknown reason","Please call the IT SWAT team at 0123-456-7",usernamefield);
                  // once you explored the possibilities that raise the exception you can
                  // provide finer grained messages
                  le.printStackTrace();
                  // parse error message for information to give to the user
        return null;
    }Frank