Oracle Portlet security实践

1: 基于oid组的权限认证
  1.1 配置${portletName}.properties,添加如下配置
 

        autoReload=true
	oidManager=true
	oidAdminClass=${OidAdminClass} extends oracle.portal.provider.v2.oid.OidInfo
	oidHost=${oidhostName}
	oidPort=${oidPortNumber} default is 389
	oidUser=${oidadmin user name} default is orcladmin
	oidPasswd=******
  

  1.2 ${OidAdminClass} 可以参考一下实现
 

   import oracle.portal.provider.v2.ProviderContext;
   import oracle.portal.provider.v2.oid.OidInfo;

   public class ${OidAdminClass}  extends OidInfo {
       
        private final String OID_HOST_PROPERTY = "oidHost";
        private final String OID_PORT_PROPERTY = "oidPort";
        private final String OID_USER_PROPERTY = "oidUser";
        private final String OID_PASSWD_PROPERTY = "oidPasswd";

        public void init(ProviderContext pc)
        {

            // This class gets its data from the deployment config file
            // deployments/oid.properties
            // 
            // The data has already been extracted and is accessible via
            // ProviderContext.  

            setLDAPHost( (String)pc.getAttribute(OID_HOST_PROPERTY) );
            setLDAPPort( (String)pc.getAttribute(OID_PORT_PROPERTY) );
            setLDAPUser( (String)"cn=" + pc.getAttribute(OID_USER_PROPERTY) );
            setLDAPPasswd( (String)pc.getAttribute(OID_PASSWD_PROPERTY) );
        }
    }
  

  1.3 配置provider.xml
   

          <securityManager class="oracle.portal.provider.v2.security.GroupSecurityManager">
          <group>cn=${group1},cn=${portalID},cn=Groups,dc=cn,dc=oracle,dc=com</group>
          <group>cn=${group2},cn=${portalID},,cn=Groups,dc=cn,dc=oracle,dc=com</group>
      </securityManager>
    

2: 自己实现portlet 认证
  2.1:创建类${SecurityManager} extends oracle.portal.provider.v2.security.PortletSecurityManager
  2.2: 实现方法public boolean hasAccess(ProviderInstance pi, PortletDefinition pd, ProviderUser user) 和        public boolean hasAccess(PortletReference ref, ProviderUser user) throws PortletNotFoundException
  2.3:在这个方法里可以实现自己的业务逻辑来判断当前用户能否访问指定的provider.
    2.4:这种方式比较灵活，可以所有的逻辑都自己控制。