ADF Security 11g and ADF Business Components

Looks like in JDeveloper 11g, ADF Security works as it should work. In this post I will cover ADF Security part, related only to ADF Business Components. For example, Oracle Business Component Browser can be used now to test security configuration in Model layer. It wasn't working in 10g and in 11g Technology Preview builds, however in Production it works!

Now, if you will run secured Application Module with Oracle Business Component Browser, you will get authentication dialog:


This dialog was raised in previous JDeveloper builds as well, however authentication never was passed, it works now.

You can download my sample application - ADFSecurity.zip. This sample is configured with ADF Security and contains 3 users (all with welcome1 password):

• john (role: clerk)
  
• susan (role: manager)
  
• steve (role: developer)

Sample application contains one Entity object - Jobs. This entity is secured for update action:


Two roles are authorized to update on entity level - manager and clerk:


Additionally, JobTitle attribute is secured for update action:


This action is authorized only to manager role:


If you will run Application Module with susan (role: manager) user:


All entity attributes will be available for udate:


With john (role: clerk) user:


All attributes except JobTitle can be updated. It happens, because only manager role is authorized to update JobTitle attribute:


If Application Module will be tested with steve (role: developer) user:


User will not be able to update any attribute, since this user is not authorized for update action: