ADF Security -- permissions dont work as documented in Jdev Article

Question

Hello
i read the article Introduction to ADF Security in Jdev 10.1.3.2, Feb 2007. I followed the steps and authentication worked fine. However, Authorization did not work until i defined permission at All Level start with PageDef itself down to Iterator, until the attribute level. The documentation does not state that the attribute level is also required. An extract is
"The application developer defines authorization declaratively for iterator bindings, action bindings, and method bindings defined in the ADF page definition (pageDef.xml) file and, alternatively, for the entire page definition itself"
I found the document more appealing as i dont believe that it feels right to visit each and every attribute for each iterator in the application when i want all the attributes to inherit their premission from the iterator (Select and Update). If i dont do that, the page appears but no rows are shown (expect the total no of row indicator, which is probably working due to the iterator Read Permission)
I read in other posts that the attributes need to be handled, is there multiselect option, that i can use to do group attribute permission setting
rgds
Ammar Sajdi
REALSOFT
Amman - Jordan

Answer 1

Hi,
you are correct that attribute bindings too need to be authorized. In 10.1.3 ADF Security is an all or nothing approach, which means that you either have authorization or you don't.
This is an administration overhead that we eliminate for JDeveloper 11. In JDeveloper 11 we treat all bindings as publicly accessible unless there is a permission defined for it. This makes security administration easier.
Frank