How can i implement "my own" security in ADF 11g

Question

Hi everybody,
I have a problem and hope anyone could help me...
Currently i am developing a ADF application, and i want to implement the security... the problem i have (and i read a lot of posts in the forum and other blogs and i don't found anything that help me) is that the "validation" of the user of password is with a webservice..... and the "roles" of the application are given to me with another web service.
I read a lot and in the Fusion's Developer Guide in chapter 30 (Enabling ADF Security in a Fusion Web Application) explains very good how to implement the security in the application, but, that example really doesn't work for my problem.
I wan't to know any way to in the "doLogin" action of my "Login button in my login page" to implement my own logic.
public String doLogin() {
2 String un = _username;
3 byte[] pw = _password.getBytes();
4 FacesContext ctx = FacesContext.getCurrentInstance();
5 HttpServletRequest request =
6 (HttpServletRequest)ctx.getExternalContext().getRequest();
7 CallbackHandler handler = new SimpleCallbackHandler(un, pw);
8 try {
9 Subject mySubject = Authentication.login(handler); <<----------------------------- Here i wan't to invoke the WS that validate the user and pwd.
10 ServletAuthentication.runAs(mySubject, request);
11 String loginUrl = "/adfAuthentication?success_url=/faces" +
12 ctx.getViewRoot().getViewId();
13 HttpServletResponse response =
14 (HttpServletResponse)ctx.getExternalContext().getResponse();
15 sendForward(request, response, loginUrl);
16 } catch (FailedLoginException fle) {
17 FacesMessage msg = new FacesMessage(FacesMessage.SEVERITY_ERROR,
18 "Incorrect Username or Password",
19 "An incorrect Username or Password" +
20 " was specified");
21 ctx.addMessage(null, msg);
22 } catch (LoginException le) {
23 reportUnexpectedLoginError("LoginException", le);
24 }
25 return null;
26 }
And i wan't to know if i can save some other user information in some kind of session (like company, mail and other stuff).....
And when i can login validating usr and pwd from the WS... how could i manage my roles ?
Welll i hope anyone can help me.
Regards from Mexico.

Answer 1

Hi,
to do this, you create a JAAS Login Module to authenticate against the Web Service. This then you wrap in an authentication provider that you configure with WLS. ADF Security does not perform any authentication itself and instead leaves it for the container.
http://download.oracle.com/docs/cd/E17904_01/web.1111/e13718/atn.htm#i1154044
Frank