Implementing Authorization based on roles

Question

Hi,
I have the list of users created in ldap/oid and their roles in the data base table.
I wrote the following method in AppModuleImpl.java which returns data from pl/sql to ADF BC.
public String callgetUserRole(String usrRole){
String result = null;
CallableStatement plsqlBlock = null;
String statement = "BEGIN :1 := *get_roles(:2);* END;";
plsqlBlock = getDBTransaction().createCallableStatement(statement, 0);
try{
plsqlBlock.registerOutParameter(1, OracleTypes.VARCHAR);
plsqlBlock.setString(2, usrRole);
plsqlBlock.execute();
result = plsqlBlock.getString(1);
//catch
return result;
get_roles is the pl/sql function created in the database.
The above method is returning the role for the user who logged in.
for example: if User1 logged in, it return 'USER' which is the role of user1
if User2 logged in, it returns 'NON_USER'.
I have a SAVE button in my sample application. This button should be disabled if role is 'non_user' and enable if the role is 'user'.
How can I achieve this?
Thanks

Answer 1

If you are going to use this information in the user interface a lot it's probably better to use real security roles rather than trying to roll (forgive the pun) your own separate role lookup from the database. you can then directly check again that role with a simple expression on the button. Or if you're on 11g you can use ADF Security fully and check to see if you have permissions to carry out that function - again in expression language (loads about this stuff on the code corner: http://www.oracle.com/technology/products/jdev/tips/fnimphius/index.html)
However, Assuming you have what you have, you need to be careful about the separation of your layers. if the role information is held in a DB Table can you create an ADFBC view object directly on that and then write a service method to return all the info for that user into a Map in the session?
If that's the case then you can use expression language on the button to enable or disable as required.