Which methods support RBAC in OER REX?

Question

We have programmed some interfaces against oracle enterprise repository's API (the REX API). We're currently trying to implement some Role Based Access Control (RBAC) within the repository. We followed the documentation to implement this with the custom access settings. It works wonderfully when we access OER via Oracle's GUI. The documentation for the REX API seems to indicate that the same user accesses/authorizations that are in OER would be what the user is allowed via the API calls. The behavior I'm seeing is that some methods in the API support RBAC properly (like assetReadXML, assetReadArrayFromSummary, assetQuerySummary etc.) and each user only sees assets they're allowed to see.
However it appears to me (through testing) that some methods don't RBAC, and a user can see all data, even data they shouldn't be able to see (e.g. assetRead lets a user see an asset even if custom access settings should disallow it).
Is there any documentation that states which methods are RBAC compatible and which ones are not?
We're using OER 11g.
Thanks so much!

Answer 1

Sure it can be done.
//Web Service method
public MyObject MyModifyObjectMethod(MyObject local){
local.setMyInteger(new Integer(44));
local.setMyString("Hello World, from the web service");
return local;
This will work as long as MyObject conforms to JAXRPC parameter and return type standards. Now, it will not modify the original object, so you will have to create a new referance to your object and set it equal to your method, or set the original object equal to your method. Like this.
//Client side calling code
MyObject myObj = new MyObject();
myObj = remoteStub.MyModifyObjectMethod(myObj);
//OR
MyObject myObj = new MyObject();
MyObject myObj2 = remoteStub.MyModifyObjectMethod(myObj);
Anyway, I hope this helps.
"Hate, anger, aggression, the dark side are they, and easily they flow."
-Really Short Jedi Master