How to Disable WebLogic Administrator from WebCenter 11g PS3/PS4 Portal Applications Management

While testing your WebCenter 11g PS3/PS4 application security, don't forget to check how portal application behaves for WebLogic administrator user. Typically we don't want to grant admin access to portal for the same user who is administering WebLogic server. Let's see how it works.

Download sample application, where admin access is disabled for WebLogic administrator - EnterprisePortalApp_v9.zip.

When we generate new WebCenter 11g PS3/PS4 application, JDeveloper constructs default UI template. This template is applied for portal pages. Because application is deployed on WebLogic server, and weblogic admin user is one of the users available in security provider - obviously we can login into our application as weblogic user and authentication will be completed successfully:

What about authorization? It seems like by default WebLogic administrator is granted portal admin access as well - Administration link is visible:

It depends on requirements, but in most of the cases we don't want to grant portal admin access to WebLogic administrator. How to disable it?

First place to look - generated UI template. As we can see, showAdmin template attribute by default is enabled to all authenticated users. There is no much logic here, why all authenticated users should see portal Administration link:

We can fix it, by changing showAdmin value to check against Administrator role from ADF Security. Only portal administrators will be able to see Administration link:

We test again, still get same result - WebLogic administrator is able to access Administration link:

Seems like ADF Security role - Administrator is mapped with admin group from WebLogic. We can double check ADF Security configuration - Administrator role is mapped with our custom PortalManager group:

In turn, PortalManager group is assigned for redsam and scott users only, there is no WebLogic admin here:

Ah, here is a trick. Its not visible through wizard and is hidden, you should open Source Code view for ADF Security definition. Only in Source Code view we can see, that ADF Security role "Administrator" is mapped with WebLogic admin group called - "Administrators". We can remove this mapping:

WebLogic administrator will not be able anymore to perform portal application administration - link for Administration resources becomes disabled as well:

Try to login with real portal administrator - redsam user:

Redsam user is granted with ADF Security role - Administrator, access to administration resources is granted: