BPEL Read Only Console - Role Based Security

I saw numerous people asking about BPEL read only console, which is not supported out of the box. I guess Oracle might ship this feature in 11g, but here is the hack which will obviously come in mind of any web-developer.

First of all, BPEL Console is just a common J2EE web application which front servlet and couple of JSPs behind the scene. It is deployed in "soasuite/j2ee/oc4j_soa/applications/orabpel/console" By default it is secured by JAZN file based security which you can easily look at "WEB-INF/web.xml".

In nutshell, I just wrote servlet filter and provided non-intrusive role based security to BPEL console. Here are the steps I followed:

---

Step 1. I wrote standard Servlet Filter with help of java.util.regex.Pattern class.

Note: Current filter code doesn't care about user's role. Every single request will be filtered against filterlist.txt file shown below:

---

Step 2: I wrote to fake servlet to test this servlet Filter. Now we need to integrate this filter with BPELConsole. We can check in "/soasuite/j2ee/oc4j_soa/config/default-web-site.xml" that BPELConsole is located at "soasuite/j2ee/oc4j_soa/applications/orabpel/console".

a) I put compiled BPELFilter.class file in "soasuite/j2ee/oc4j_soa/applications/orabpel/console/WEB-INF/classes" directory. This is how it looks like: "/soasuite/j2ee/oc4j_soa/applications/orabpel/console/WEB-INF/classes/bpelfilterproject/BPELFilter", where bpelfilterproject is the package name.

b) I changed soasuite/j2ee/oc4j_soa/applications/orabpel/console/WEB-INF/web.xml file to apply this filter settings:

These changes are good enough to make BPEL console read only. Now if we restart SOASuite and click on one of the sensitive URL, e.g. Purge Instances, it should show the page with following message:

---

Step 3: We are done with basic component, but now it is time to do some Role based security. I had to dig into some JAZN settings in order to make this thing worked. I followed the link http://download.oracle.com/docs/cd/B12314_01/web.904/b10325/configja.htm#1007274 which was very helpful. I realized that BPELConsole is using only one Role called "PUBLIC" which is defined in Web.xml file and not mapped to any of the OC4J Role!!!

So let's follow the best practice which has been defined for ESB console already.
- I need to create two roles called "viewers" and "admins".
- I need to define this role in web.xml and map to oc4j role using orien-web.xml file.
- I need to assign admins to bpeladmin
- I need to assign viewers to guest
- Change the Filter code to do Role based filtering

Then let's do it:

a) Create viewers and admins role from EM as shown below:

b) assign "admins" role to "bpeladmin" user and "viewers" role to "guest" user. (Note: BPELDefaultDomainAdmin is always required to access anything in BPELDomain).

c) Let's change the source code. Here is what I did:

Note: Essentially I am relying on two roles viewers and admins, and if role is viewers and not admins, then I start doing filtering. As we know, bpeladmin can have both viewers and admins role.

d) Final change would be to create these roles in console's web.xml file and and assign those roles to OC4J roles. Here is how "soasuite/j2ee/oc4j_soa/applications/orabpel/console/WEB-INF/web.xml" file looks like:

And to associate these roles with OC4J roles, we need to change /soasuite/j2ee/oc4j_soa/application-deployments/orabpel/console/orien-web.xml file. Here is how orien-web.xml file looks like:

Cool. Now if I login as bpeladmin, everything works great, and when I login as guest it is all read only.

---

Source code along with Read-Me document can be downloaded from this link.