Mittwoch, Dezember 22, 2004

 

Write your own JSP EL-Functions to secure your web app

Frank has a very good description to use the J2EE security model to secure your web pages fine granular (ADF UIX: Enabling and disabling page compression in UIX). However I have an extention to this: Within the ADF UIX Framework you can easily extend EL and write your own EL methode like ${isUserInRole('GuestRole')}. As you know UIX was the initial idea to specify JavaServer Faces. So with UIX you can write for each component your own renderer. This means you can write your own Java methodes and call it within the EL renderer like this:

<submitButton disabled="${ctrl:isUserInRole(uix, 'GuestUserRole')}" text="Save" >

To accomplish this you must write the following code:

public final class ELFunctions{
public static Boolean isUserInRole(Object uix, String role) throws Exception{
ControllerImplicitObject uixObj = (ControllerImplicitObject)uix;
boolean isInRole = uixObj.getBajaContext().getServletRequest().isUserInRole(role);
return new Boolean(isInRole);
}
}

After writing your static Java EL Function you must write a framework factory class. This is accomplished by usage of the UIExtention Framework:

public class ELFunctionExtension implements UIExtension {
static Class funcClass = com.bm.ui.common.ELFunctions.class;

static Class getFuncClass(String className){
try {
Class clazz = Class.forName(className);
return clazz;
}
catch(ClassNotFoundException classnotfoundexception) {
throw new NoClassDefFoundError(classnotfoundexception.getMessage());
}
}

public void registerSelf(ParserManager parserManager) {
XMLUtils.registerFunctions(parserManager, "http://xmlns.oracle.com/uix/controller",
funcClass != null ? funcClass : (funcClass = getFuncClass ("com.bm.ui.common.ELFunctions")));
}

public void registerSelf(LookAndFeel lookandfeel) { }

}


Additional you must register the UIExtention in the WEB-INF/uix-config.xml file:

<ui-extensions>
<extension-class> com.bm.ui.common.ELFunctionExtension </extension-class>
</ui-extensions>


Now you can access the isUserInRole() method directly from the uiXML code:

<submitButton disabled="${!ctrl:isUserInRole(uix,'PowerUserRole')}" text="Save" >
or
<submitButton disabled="${not ctrl:isUserInRole(uix,'PowerUserRole')}" text="Save" >
or
<submitButton disabled="${ctrl:isUserInRole(uix,'GuestUserRole')}" text="Save" >







<< Home

This page is powered by Blogger. Isn't yours?