ADF application with WebLogic Data source problem

Abdelrahman ElGiar

I have deployed an ADF application twice on WebLogic with different web context root

and created two data sources with different connections and different providers

every application has its Specific connection that match with the data source

two applications login successfully with any password that matches user name at other data source

ex : if 2 DS...first DS has user name 1 and pw : 1 and other DS with user name 1 and pw : 2

2 application login successfully with any password of them.. !

Abdelrahman ElGiar

I used SQL Authentication provider

The problem I detected when using this is when you have more than one applications deployed, the WebLogic lets users from all providers to log in any application deployed.

How to make it different for each application

AnatoliAtanasov

Hi there,

Most probably you have two databases / schemas each connected with SQL Authentication provider via a specific data source. In that case you rely 100% on WLS for authentication.

When you have more than one users repo integrated with a WLS domain realm you need to make sure that there are no duplicated users within the two repos. Otherwise you need to have two separate domains where you deploy the two versions for the app with a single SQL authenticator connected to the corresponding database / schema.

HTH,

A.

dvohra21

Deploy the two applications to two managed servers. Please also refer ADF Security Across Multiple WebLogic Managed Servers

Abdelrahman ElGiar

https://community.oracle.com/tech/developers/discussion/comment/16781068#Comment_16781068

Hello Anatoli,

in my case, some of the users will be duplicated

did you mean that I need to create two "realms". everyone with a different Data source and provider?

and there's any way to map every application with the specific provider?

Abdelrahman ElGiar

https://community.oracle.com/tech/developers/discussion/comment/16781139#Comment_16781139

I should install the new managed server for every application?

dvohra21

If only two applications are to be deployed, only two managed servers are needed. If 10 applications are deployed, deploy to 10 different managed servers.

Abdelrahman ElGiar

https://community.oracle.com/tech/developers/discussion/comment/16781577#Comment_16781577

Hello, dvohra

This will be an efficient solution to the server?

if I have many apps all these services will destroy the memory or I have only this solution in my case

dvohra21

Create a CustomSQLAuthenticator per user or per application. Please refer "SQL Authentication Provider for Oracle ADF"

AnatoliAtanasov

https://community.oracle.com/tech/developers/discussion/comment/16781190#Comment_16781190

In WLS you always have a single security realm active (unless you use the WLS mutli tenancy option which is being deprecated in late versions).

One workaround could be to:

1. identify which of the two users repos has higher priority;
2. order the the authN providers respectively, e.g. first repoA and then repoB
3. set the JAAS control flag to both providers to SUFFICIENT - https://docs.oracle.com/middleware/1213/wls/SECMG/atn_intro.htm#SECMG699

This way if a user (e.g. john.doe that exists in both repos) if found in repoA and password supplied credentials are valid it will be authenticated against repoA, else the authN will move on to the repoB.

An interesting question would be how the groups extraction will be handled in the proposed solution.

HTH,

A.

oladslw

Leveraging on the difference between authentication and authorization should get you closer to where you want to be.

If you are using ADF security then you can assign different roles and or groups to each application.

If you are confident with messing around with the application specific realm, then you will have a better control too but to reduce the complexity of what you are trying to achieve. I'll suggest you authenticate then check if the user is authorized to use the logged in application i.e. by checking if the user is a member of a group or role, if not; terminate the user session and redirect to login screen.