Sunday, November 14, 2010

Things You Must Know About ADF Faces Login Page

Oracle ADF 11g Developer Guide is primary source of information for every Oracle Fusion 11g developer. About security implementation, you can read from chapter 30.7 Creating a Login Page. What is the difference between smart and regular developer? Smart developer is proactive and always knows more than it is described in developer guide :) I will present today few aspects of ADF Login Page implementation you should keep in mind, when working with ADF Security.

I will use typical ADF Faces page to implement login screen - /faces/login.jspx:


I was using ADF Security wizard to define login page, just following documentation steps and I got strange behavior. When I'm running application, it redirects to login page - opening it, but just hangs and never brings login screen:


There are no errors or warnings in the log:


However, you should know - when ADF Faces page is defined as login page, even there is no page definition defined - it will be generated automatically:


When there is page definition, page will be automatically protected by ADF Security. Because there are no any grants by default for login page, it will be not accessible:


At the same time this page is defined as login page - framework is trying to load it, but fails because no permission defined. Its why application simply hangs.

In order to make it work, you need to specify anonymous role for login page - this will allow to render login screen:


When we are implementing ADF Faces login page, we can process username and password data, before doing authentication. We can set username to lower case, some LDAP systems are case sensitive - this will allow user to login, even he will type username in upper case:


If you are already working with new JDeveloper 11g PS3 beta release,  probably you have noticed that SimpleCallbackHandler class is deprecated:


Documentation still references deprecated SimpleCallbackHandler class for login action. Probably it will be update later with URLCallbackHandler class. Sample application for this post is using that class:


In order to test login functionality, I'm using mix of upper and lower case for username:


Login action is performed successfully with URLCallbackHandler class, username is converted to lower case:


Download sample application for this post - SecurityFormLogin.zip
at

48 comments:

  1. AnonymousNovember 14, 2010 at 1:20 PM

    Hi,

    at first very nice blog!

    But "JDeveloper 11g PS3 beta release" exists a public download-source for the beta release or is this "private"?

    Best regards

    ReplyDelete
  2. Andrej BaranovskijNovember 14, 2010 at 3:29 PM

    Hi,

    Its private...

    Andrejus

    ReplyDelete
  3. AnonymousNovember 14, 2010 at 6:30 PM

    Hi,

    first excellent blog :) i'm looking at your code for Login class and i'm wondering is it possible to call my own authentication servlet and not adf security servlet..i have a little project where i must use sso for authentication..i can use SSO.isAuthenticated(req, resp) to check if user is valid..and also i have a logout servlet which just sets logout url and it invalidates session..user informations are stored in database and i can't add them on wls (about 10 000 users)..i found some documentation about custom security but it worked only with 0c4j/jazn..can You give me any directions???

    ReplyDelete
  4. Andrej BaranovskijNovember 14, 2010 at 7:34 PM

    Hi,

    Its not calling ADF authentication servlet, its doing pure WebLogic authentication (weblogic.security). In your case, probably you could define your own security provider in WebLogic and use it for authentication. ADF application completely relies on WebLogic in this case, there is no ADF specific.

    Regards,
    Andrejus

    ReplyDelete
  5. UnknownApril 6, 2011 at 6:54 AM

    Hello,

    I'm facing similar problem.
    And i found you post. I configured everything same as your step.

    But I can't see pages as anonymous-role.

    I don't know what is wrong.

    I created index.jspx with anonymous-role and run page. But it goes to login.jspx.

    Thank you,
    Erdenebayar

    ReplyDelete
  6. Andrej BaranovskijApril 6, 2011 at 8:33 AM

    Hi,

    It will redirect to Login page only from pages set with authenticated permission. Most probably you are trying to access page with authenticated permission.

    Regards,
    Andrejus

    ReplyDelete
  7. UnknownApril 6, 2011 at 8:46 AM

    Hi,

    Thank you for your quick reply.

    How to set page with not authenticated? Is it anonymous-role?
    Because i'm new of ADF Security.

    Thank you,
    Erdenebayar

    ReplyDelete
  8. Andrej BaranovskijApril 6, 2011 at 9:50 AM

    Yes, just assign anonymous role. It must work.

    Andrejus

    ReplyDelete
  9. UnknownApril 7, 2011 at 3:36 AM

    Hi,

    I assigned anonymous-role, But not working. Same result.

    I attached my configurations, I think something wrong or corrupted.
    http://bit.ly/fX4QDd
    Can you review it?

    Erdenebayar,

    ReplyDelete
  10. UnknownApril 7, 2011 at 5:14 AM

    Hi,

    Maybe my anonymous provider not working.

    Also I deleted cwallet, jazn-data, jps-config, weblogic, weblogic-application. And When i again enable security, i get same result.

    But when i'm creating new application, it is working.

    Erdenebayar

    ReplyDelete
  11. Andrej BaranovskijApril 7, 2011 at 9:32 AM

    This can happen only if jps-config file is corrupted, you can copy most of the contents for that file from another working application and it should work fine.

    Andrejus

    ReplyDelete
  12. UnknownApril 7, 2011 at 11:15 AM

    Hmmm, Also not working.

    Are any anything for check? (Files).

    Is it possible to send you my application (ViewController)?
    If possible, please send me your mail.

    Because this security issue very urgent for me.

    Erdenebayar.

    ReplyDelete
  13. Andrej BaranovskijApril 7, 2011 at 3:36 PM

    Hi,

    You should compare two applications, you have one working?

    Andrejus

    ReplyDelete
  14. Patrik FrankovicSeptember 22, 2011 at 9:18 AM

    Hi Andrejus,
    I've succesfully implemented your login page and it's working fine, except one problem. If enter wrong credentials and hit login you'll get error message abot wrong un/pw, but if you hit button again without entering new credentials you'll get null pointer exception.I'm using Jdev 11.1.2.
    Thanx and regards,
    Patrik

    ReplyDelete
  15. Andrej BaranovskijSeptember 22, 2011 at 9:21 AM

    Sounds like a bug of 11.1.2

    Andrejus

    ReplyDelete
  16. Patrik FrankovicSeptember 22, 2011 at 12:23 PM

    Hi again,
    reseting Password field after bad login attempt solve the problem. :)

    setPassword(null);

    Thanx & regards,
    Patrik

    ReplyDelete
  17. Andrej BaranovskijSeptember 22, 2011 at 12:29 PM

    Good fix :)

    Andrejus

    ReplyDelete
  18. Andrej BaranovskijOctober 29, 2011 at 11:39 AM

    Or you can set both username and password fields to be required - this will prevent login attempt with empty password.

    Andrejus

    ReplyDelete
  19. AnonymousFebruary 8, 2012 at 11:45 AM

    I tried to deploy your application to weblogic after migrating it to release 2, then deploy to managed weblogic but it kept stuck on a loop trying to resolve login page. I also developed a sample application from scratch on release 2 and enabled adf security with same error.

    Any help?

    ReplyDelete
  20. Andrej BaranovskijFebruary 8, 2012 at 6:34 PM

    Can you send me migrated source code you was trying to deploy?

    Thanks,
    Andrejus

    ReplyDelete
  21. Wendy TrompMay 21, 2012 at 2:41 PM

    I'd like to know if you found a solution to the problem the last poster had. I have the same problem....

    ReplyDelete
  22. Andrej BaranovskijMay 21, 2012 at 2:47 PM

    I never received sample app from reader.

    When loop happens, make sure to remove anonymous autogenerated role from jazn-data. Restart JDev and assign anonymous role manually to the Login page def.

    Andrejus

    ReplyDelete
  23. AnonymousJune 6, 2012 at 2:47 AM

    Thanks Andrejus, this tutorial will help me a lot.

    ReplyDelete
  24. Xahar HassanJune 19, 2012 at 2:18 PM

    I tried your application.
    But then it's giving me this exception:
    Caused by: java.lang.InstantiationException: weblogic.wsee.jaxws.client.async.AsyncTransportProvider

    ReplyDelete
  25. Andrej BaranovskijJune 19, 2012 at 6:43 PM

    JDeveloper version?

    Andrejus

    ReplyDelete
  26. AnonymousJuly 24, 2012 at 3:28 PM

    "When loop happens, make sure to remove anonymous autogenerated role from jazn-data. Restart JDev and assign anonymous role manually to the Login page def."

    This helps me a lot. Thanks!

    ReplyDelete
  27. AnonymousAugust 23, 2012 at 2:57 PM

    Hello Andrejus, your post is reaaly helpfull; i just have a question about dispatcher redirection; When i submit my authentification form , i want to stay on the same page without reloading it.
    at same time display the authenticated username.
    is there a way to do that ?

    ReplyDelete
  28. Andrej BaranovskijAugust 23, 2012 at 3:00 PM

    Yes, may be you can redirect to the same Login page.

    Andrejus

    ReplyDelete
  29. ector MOctober 1, 2012 at 11:58 PM

    Hello,
    thanks for the example...

    could you please help me, i need to get the attributes added in weblogic console, like phone number, email addres, etc

    im new on ADF, so everything you can tell me will be useful...

    thanks in advance
    regards
    ESM

    ReplyDelete
  30. Murat KalınNovember 26, 2012 at 3:25 PM

    Hi,

    I'm facing with image rendering problem when try to customize login.html page. Tried to assign anonymous role to it but can't see it in jazn-data.xml. Any suggestion?

    Thank you
    Murat

    ReplyDelete
  31. UnknownFebruary 1, 2013 at 11:02 PM

    excellent post

    ReplyDelete
  32. Votre future présentation...February 12, 2013 at 2:16 PM

    Hi Andrejus,

    for logout in weblogic server :
    /adfAuthentication?logout=true&end_url=/faces/index.jsf

    it's not the same when i use Glassfish.

    ReplyDelete
  33. AnonymousFebruary 25, 2013 at 8:56 AM

    hi,
    I followed your application for login page. actually I migrated my project developed in JDeveloper11.1.1.2 to JDeveloper11.1.2.0 . login page is displaying but I am entering username and password . it failed with the error incorrect username or password . and in console I got the following exception :javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User SYS javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User SYS denied.
    so please tell me where I did wrong thing. need to some settings in realm??

    ReplyDelete
  34. Andrej BaranovskijFebruary 28, 2013 at 1:19 PM

    Hi,

    You should define your user in jazn-data.xml and test it. User SYS is not available by default in ADF.

    Andrejus

    ReplyDelete
  35. InuNovember 25, 2013 at 1:00 PM

    Hi,
    while am trying to configuring the formbased authentication in webcenter portal application,it is taking defualtAuthentication.I have given grant to some page but while loging it is taking default authenticated password.what i need to do.please suggest me?

    ReplyDelete
  36. AnonymousApril 29, 2015 at 2:07 PM

    Dear Andrejus,
    How can I manage weblogic integrated security in my application?
    i.e. change password, create new user, assign roles, define new roles, assign resources to roles etc.
    Regards,
    Gideon.

    ReplyDelete
  37. Andrej BaranovskijApril 29, 2015 at 2:28 PM

    Hi,

    You can do this with OPSS API.

    Regards,
    Andrejus

    ReplyDelete
  38. AnonymousJune 5, 2015 at 3:09 PM

    Hi Andrejus,

    based on your experience, do you know if it is possible to "split" authentication and authorization processes via weblogic providers? We are trying by configuring an AD provider to authenticate user credentials only from active directory (which does not have security groups) and then a subsequent SQL provider to only "authorize" (for security groups only) but does not work...

    Thanks and Regards!
    GB

    ReplyDelete
  39. AnonymousOctober 23, 2015 at 4:47 PM

    Hi, Is it possible to do the silent login to an ADF application from another application without jumping to login page as we do with HTTP Post method

    ReplyDelete
  40. Andrej BaranovskijOctober 23, 2015 at 4:51 PM

    If both apps are deployed on the same managed server, i think it should happen.

    Andrejus

    ReplyDelete
  41. UnknownJanuary 15, 2016 at 10:04 AM

    Hi Andrejus,

    Could you please provide a sample application for silent login to an ADF application from another ADF application without jumping to login page

    ReplyDelete
  42. RogelioNovember 4, 2016 at 4:14 PM

    Hi Andrejus

    My name is Vanderlei Souza
    I'm trying to implement a logout function in my application.
    I'm using an af: button that references a managed bean, but when the application is running on the server returns a message that my MB is null. The application is the PageTemplate type, have some guidance on how to proceed?
    I appreciate greatly

    ReplyDelete
  43. PaulNovember 26, 2016 at 1:44 PM

    1st: Thank you Andrejus!

    What is the difference between smart and regular developer? Smart developer is proactive and always knows more than it is described in developer guide.

    AB - "Classic"

    ReplyDelete
  44. Andrej BaranovskijNovember 26, 2016 at 5:28 PM

    Thanks ! :)

    ReplyDelete
  45. AnonymousFebruary 1, 2017 at 10:41 AM

    problem with downloading Sample application
    please update the link

    ReplyDelete
  46. Andrej BaranovskijFebruary 1, 2017 at 11:32 AM

    You can download all old samples from Google Archive: https://code.google.com/archive/p/jdevsamples/downloads

    Andrejus

    ReplyDelete
  47. Govind MishraFebruary 20, 2017 at 10:26 AM

    Hi Andrejus,

    I have used bookmark / deep link in my application.. while accessing bookmark page if it's not already logged in then it will bring login page but after login it does not forward to bookmark page instead it forwards to default page... please give hint how can I fix this..?

    Regards,
    GIMISHRA

    ReplyDelete
  48. AmritOctober 19, 2017 at 1:56 AM

    Hi Andrejus

    I am new in ADF. I have work on login and logout pages. when my app run first run from jdevelper 12c it ask me for login and after successful login it open all authenticated pages. but after logout and login again on same user or different user it fail to open any page. no error in log. please help me to sort out this issue.

    Thanks
    Amritpal

    ReplyDelete