Practical Guide for Oracle WebCenter PS3 Security Implementation

This article is about best practices for WebCenter PS3 security implementation. Provided information is not necessarily complete, I will post updates in my future posts. Main goal is to give sample start-up application, it should help to jump start your WebCenter PS3 project and avoid certain level of beginner confusion. Sample application - EnterprisePortalApp_v1.zip, is focused around secured landing page implementation and Login/Logout functionality. By default, auto-generated sample application based on WebCenter PS3 template from JDeveloper 11g doesn't have secured landing page. Every customer is wondering, where is a point to have landing page with anonymous access, this article will explain in detail how to fix this.

First, let's look more closely into problem I'm talking about. Typical WebCenter PS3 application contains navigation model, it renders menu structure on runtime:

When accessing landing page, user is redirected directly into home page with menu structure - anonymous access is enabled:

User can login directly inside home page, authentication will be performed and same home page will render authorized items:

What we want to achieve, is to redirect all anonymous users to Login page first and only then after successful authentication process to home page. If we check web.xml, Form-Based authentication is configured by default for WebCenter PS3 application:

The question is, how to enable it? As you can see, Login page is registered as login.html. We can open and check login.html after it will be removed from excluded items:

All looks good, there is redirect to actual login.jspx:

Real thing we are looking for is inside pages.xml file, it is where page hierarchy is defined:

Home page is defined to be accessible for anonymous users, its why redirect to login page is not happening when accessing landing Home page:

Click Delegate Security option and remove anonymous grant for Home page access:

Run portal application, you will get resource not found error:

From URL we can see it points to pages_home resource, this is basically home page from pages.xml hierarchy. Now since we disabled anonymous access, this resource is not accessible anymore. Open index.html file, where landing URL is defined:

Change it to point to home.jspx directly:

ADF Security will redirect anonymous users to login.jspx:

Login and enter inside portal:

From first look, all seems to work now. But believe, we need to apply few more fixes. For example, if user will try to logout now, again will get resource not found error:

First attempt to resolve this issue is to set logout_success URL in faces-config.xml:

Login/Logout works now for landing home page:

But it still doesn't work when current selected menu item points to ADF Task Flow.

Let's do some heavy refactoring for auto-generated WebCenter PS3 application and ensure Login/Logout works in all cases. First things I would recommend is to disable page hierarchy, especially when you are using combination of ADF Task Flows in the same menu structure. Open pages.xml file and remove Home page:

Once page is removed from pages hierarchy, it appears in jazn-data.xml and can be defined with ADF Security permissions as any other ADF resource:

Define required permissions:

Remove page Page Hierarchy from navigation model:

Add page link pointing to Home page inside navigation model:

In order Home page menu item to be selected by default, add externalId attribute to Home page link:

Open faces-config.xml and reference externalId of Home page as login_success URL, this allow to select Home menu item by default after successful authentication - /wcnav_externalId/defaultMenu:

One more thing, you need to extend WebCenter PS3 View Handler class. Otherwise it gets confused with navigation model items during Login/Logout actions. I have received extended WebCenter PS3 View Handler class from Oracle support, same class is available inside provided sample application. You can check in faces-config.xml, it is specified to point to extended View Handler:

Method from extended class filters and validates every navigation request, see comments inside:

Now we are done, all should work smooth. Just one more small but important best practice, make sure you protect external menu items. Its all good if menu item points to ADF page or ADF Task Flow, it will inherit security permissions from ADF Security. But if menu item points to external resources, this menu item by default is directly accessible by app-context-root/faces/menuItemId:

Open navigation model and change external resource Visible property from default #{true}:

To authenticated: