Securing REST resources

User_GC8WM

I have one question about securing REST Resources. Let's say that idea is to grant access on 2 resources (view objects) to 2 users. One user is supposed to see first resource, and second user is supposed to see second resource.

And here's the problem. When I add two users, either of them can see both resources. I tried with different roles but cannot separate resources to users.

According to oracle document about creating ADF RESTful web services (https://docs.oracle.com/middleware/1221/adf/develop/GUID-8F85F6FA-1A13-4111-BBDB-1195445CB630.htm#ADFFD54061), this is straight forward procedure.

Thank you in advance.

Timo Hahn

User, tell us your exact JDev version, please!

Yes, from the document it looks easy. Problem is, that we can't see your application and configuration.

Can you provide a reproducible test case (build on the HR DB schema)?

Timo

Shay Shmeltzer-Oracle

Did you define policies on the data objects that you exposed as REST endpoints?

How to Define Policies for Data

dvohra21

Are two separate resource grants created for the two different user->resource?

User_GC8WM

https://community.oracle.com/tech/developers/discussion/comment/16811999#Comment_16811999

I have two view objects based od custom query without entities. Reading provided document, I saw that there is option to grant select on entitiy object, but there's not similar option in view object.

User_GC8WM

https://community.oracle.com/tech/developers/discussion/comment/16812020#Comment_16812020

I'm not sure what you asking me :D