How to approach authorization taking data into account (?)

Question

hi
I have been similar to "Introduction to ADF Security in JDeveloper 10.1.3.2" for an approach to authorization taking data into account.
For example to solve something like this:
Some users should be able to update SCOTT.EMP.SAL, but only for those records where they "are manager" (e.g. based on SCOTT.EMP.MGR).
Because the current (10.1.3) "OracleAS JAAS Provider" Re: ADF Security : custom SecurityContext seem to provide the API hooks or customization features I think I need for this, I tried the following approach:
(1) A solution implementation should preferably be "JAAS like", using classes from the "java.security" package like java.security.Permission or java.security.AccessControlContext etc. This way it is more likely to be future proof and could possibly more easily be integrated with future JAAS solutions from Oracle.
(2) To minimize dependencies in my application, I introduced only one custom interface that does what I really want to do, that is "to check permissions":
package accesscontrolstuff.common.security;
import java.security.AccessControlException;
import java.security.Permission;
public interface PermissionChecker
     public void checkPermission(Permission pPermission)
          throws AccessControlException;
}(3) It should be possible to easily check permissions in the business service implementation (ADF BC) and the view/controller layer (JSF managed beans).
I have created an example application that implements this approach (check README.txt) :
http://verveja.footsteps.be/~verveja/files/oracle/AccessControlStuffApp-v0.01.zip
It has an updateAllEmp.jspx page that has a button for each EMP row to give a raise (that is update SCOTT.EMP.SAL). It will show an error message when the user is not allowed to give a raise.
It has an updateSomeEmp.jspx page that has a button only for the EMP rows where the user is allowed to give a raise.
question :
All suggestions for improvement, on the approach or the example application, are welcome.
(using JDeveloper 10.1.3.3.0 : ADF Business Components and ADF Faces)
regards
Jan Vervecken

Answer 1

Thanks for you reply Frank and for going through the example.
(a1) about "... the example could be coded without JAAS in the application as well ..."
I'm not sure I understand when an application is "with JAAS" or "without JAAS" (in an Oracle context)?
(The AccessControlStuffApp-v0.01.zip example includes an orion-application file that has a jaas-mode configured, which I could probably use for an implementation variation the works with a javax.security.auth.Subject instance, but the current implementation works with the "no jaas-mode" variant using the getUserPrincipalName() method.)
(a2) about "This makes it hard to manage security roles ..."
I don't think I understand. For the example, all authorization configuration is in the EMP table, why would that be hard to manage?
What alternative would you suggest to "manage" security on the EMP table as is intended in the example?
(a3) about "I think the required enhancement would be to add the dynamic permissions to an existing ADFSecurityContext ..."
That sounds like what I have been looking for (see forum thread "ADF Security : custom SecurityContext").
(a4) about "... and make this available to the business service as well ..."
That would probably be useful.
see also http://www.oracle.com/technology/products/jdev/howtos/1013/adfsecurity/adfsecurity_10132.html
that says : "The defense-in-depth security design pattern demands that application developers implement application security with multiple lines of defense. ..."
Thank you for pointing developers to this thread.
regards
Jan