Authorization to Portal resources (i.e., pages, portlets, etc.)

Question

I was able to create users, a group, a role, an entitlement, and a desktop through the Portal Admin Console to show that when I was logged in as one user I could see a certain portal page/tab, but when I was logged in as another user I could not see that portal page/tab. Does this provide the level of secure authorization needed throughout the Portal to prevent users from seeing Portal resources that they should not be able to see? I know that if I do not go through the Desktop's URL and instead go directly to the Portal's URL I see everything in the portal no matter what my roles and entitlements are. Do I need to investigate the WebLogic server's security realms in order to implement users, groups, and roles in a more secure manner?

Answer 1

Hello, I've found response, so I detail it here, if somebody encounts the same problem.
The problem is that a called PL/SQL procedure/funtion/portlet in a database could work in a alone page group with the right access. But when you put a template (+ ui_template or not) you have to create a specific DAD access for the portlets. Here's the step :
1) Log to Portal > Generator > Administer
2) Click on the left down corner on "Portal services Control" (sorry, I translate from french) and access to Oracle Enterprise Manager.
3) Select in the right up corner "HTTP SERVER" and after in the main menu "administration"
4) On the left, select and click on "PL/SQL properties" > "DADs" (on the upper menu)
5) Here, click on "Create" > "general"
6) Fill the blanks (Name was "/pls/my_schema" for me and "default page" was "MY_SCHEMA.MY_PORTLET.MY_PROCEDURE").
So I thanks all people who take care of these posts, and I hope it could be useful for anyone.
Best regards,
Antoine