In one of our ADF Training batches, we had noticed an issue related to ADF Security not working on the authorization part when enabled on a Oracle ADF REST API.The authentication part was working fine, but the authorization was failing on ADF 12.2.1.2.0

After scratching the head for few hours, the solution has been arrived at...Thanks to Google Search and Andrejus Post.

Seldom you expose a webservice operation without a security attached to it..Let us see how we can attach the simple username token based authentication to the webservice we had created in our previous posts.

Checkout the code from below repository if you haven’t completed the previous exercises.

https://code.adfapps.com/svn/adfwebservices

adftraining/adftraining

TAG : CUSTOM_METHOD_WEBSERVICE

Oracle ADF has helped us to develop a webservice with ADF BC pretty fast by using the service interface of the App Module.In the last version of this webservice, we just created an EO,VO and exposed the AM methods as a webservice.What if you need a custom functionality written in a custom method in the AM to be exposed as a webservice? We have an option in the service interface of the AM to expose the custom methods in AM as a webservice method too.

Lets start by creating the custom method in the AM.

In the last post, I had walked you through the creation of simple ADF webservice which is based on the Departments table in XE database.There was no validation on the create or update method of the webservice in the previous version.There is a lot of chance that the caller of this webservice may send some junk data into your system through the webservice which doesn’t handle the validations properly.I have a lot of experience with my clients on this aspect :).

Also, the caller won’t know the ids in our system and most probably they will send the names(For Ex: Location id will not be known to the callers but they will know the Location Name).Instead of writing code to handle this kind of scenario, you can simply handle it by attaching the lov to the location id attribute.But this is tricky because locationid attribute is bigdecimal but how the caller will send the location name which is a string ??

Let me show the trick :)

Oracle ADF has a cool feature for building SOAP based webservices using ADF Business Components.I will take you through series of blog entries to build a simple webservices with ADF BC, adding validation using lovs, adding security to the web services etc.

I will be using Oracle XE for the database access and will post the workspace at code.adfapps.com website for you to checkout directly from your jdeveloper.