Resource Permission stored in DB

Question

Hi Everyone
My customer is using a forms application that he needs to migrate to ADF.
The new application should reuse the existing tables, PL/SQL APIs to such an extent that the old forms application should be available at the same time with the new ADF application as the existing forms will be gradually migrated to ADF over a longer period of time.
In this application there is one menu which is unique. Customer has a table AUTHORISATION to store the permissions on some menu entries (submenu or executable) . Each executable menu entry has a form (fmb) and some columns (with possible values 0 or 1) for the actions allowed on that form:
VIEW - 1 if view action is allowed, 0 if not
CREATE - the same
UPDATE - the same
DELETE - the same
Although he is aware that this is not a very strong security model as users can connect to sqlplus and update the table manually, customer would like to keep this table and to continue using that even in ADF, and not to use Weblogic security provider to manage roles (using SQLAuthenticator for example) in the application as this would be too tedious for him. To make the problem more complicated users can login to the application and then choose the DB they wish to connect to, so this AUTHORISATION table is specific to each DB instance. So there are multiple AUTHORISATION tables (one table in each DB instance), but the user_id/username is the same in all of these tables.
In the ADF application, each form will be equivalent to a taskflow where the same operations would be allowed in page fragments. For example in the taskflow there will be a page fragment to display a list of records, another to display a detail of a record, another that allows to create a new record and so on. The access to the taskflow and within the taskflow needs to be driven by the same table. One taskflow will appear in the menu only once, that is for sure.
I have considered using a resource permission to define a logical entity on a menu entry, and then using expressions such as
#{securityContext.userGrantedResource
['resourceName=myPanel1;
resourceType=myLayoutPanel;
action=myAction']}
to control the access/navigation in the application. However I find it quite hard to adapt is to the current situation. I have build the necessary components so I can extract all the contents of this table and wrap it inside a sessionScope managed bean so that the access to these permissions to be available from anywhere within the user session.I can code the hard way in the application to control access and navigation(by example creating a generic pageFlow managed bean for each taskflow that will have boolean properties for each operation and this managed bean will be initialized at the beginning of the taskflow, then use this managed bean in EL expressions to control the permissions to the actions). There will be a team of developers that willl build each taskflow and there are many taskflows which follows exactly the same pattern (list of records->details/create/delete).I need to make sure there is a easy way to encapsulate all this using security EL if possible so that each developer should work in a consistent manner based on a taskflow template for example that they need to follow/implement.
I am using JDev version 11.1.2.2
Not sure if my approach is the right one, or anyone has better ideas. Please advise.
Thank you in advance
Edited by: Dan Cretu on 31 oct. 2012 23:46

Answer 1

Hi
Thanks Peter for the helpful hints. I am also using one page, main.jsf (in fact there is a taskflow with several method calls to perform some initialization after login and at the end user end up in the same page). I am also using dynamic tabs pattern to show all the taskflows in regions. I have not yet begun the design of the templates ( this is next on my list once I finish designing the security/permission layer), but your experience is really helpful as it very much ressembles what I have. This should help me a lot to design these CRUD taskflows in the same manner as forms.
For view permission and navigation I plan to implement this in the custom NavigationHandler class specified in faces-config.xml. As for the CRUD operations within the taskflow or I plan on using a router activity or a method call activity that would act like a router in order to encapsulate more complex logic if necessary (Haven't decided yet). The real challenge is when the CRUD operations are called from another taskflow opened in another tab. For example, from Departments taskflow to try and add a new employee which is in another taskflow. I guess the employee taskflow will need to have a parameter in order to define the operations to be performed in this taskflow (and use this parameter in a router activity for example) and if the operation is allowed the proper page/fragment for the creation would be shown in the new tab. Still a lot of ideas to put in practice and I need to think ahead of some potential problems in order to make everyone's life easier afterwards :-)
Kind regards