17.7 Securing Portlets

Portlet security consists of three major areas of functionality:

  • Authentication

    When users first access a secure URL, they must be challenged for information that verifies their identity, such as a user name and password, or a digital certificate.

  • Authorization

    Authorization is the process that allows certain users to access parts of an application. Some parts of an application may have public access while others may be accessible only to a limited number of authenticated users.

  • Communication Security

    Communication security is the means by which Oracle Portal establishes the authenticity of communications (for example, messages) to and from portlet providers. In a heavily networked environment, it is critical to verify that communications are authenticated.

This section explores portlet security related to authorization. It contains the following subsections:

You will find a more in-depth discussion of portlet security, including Authentication, Authorization, and Communication Security, in Oracle Fusion Middleware Administrator's Guide for Oracle Portal.

17.7.1 Granting Global Privileges on Portlets

The procedure for granting global privileges to a user is outlined in Section 17.3.1, "Granting Global Privileges to a User". The procedure for granting global privileges to a group is outlined in Section 17.3.2, "Granting Global Privileges to a Group". This section lists and describes the global privileges relating to portlets. It includes the following subsections:

Note:

Global privileges confer a great deal of power on the user or group to whom they are granted. As a result, such privileges should be granted very cautiously and only to users or groups who truly require them. There should be only a small number of users with global privileges.

17.7.1.1 Portlet-Related Global Privileges on All Portlets

The portlet-related global privileges that apply to all portlets include:

  • NoneNo global privileges are granted on portlets.

  • ManageCreate, edit, or delete any portlet in any provider.

  • EditEdit any portlet in any provider.

  • ExecuteExecute any portlet in any provider. Users and groups with this privilege can see all portlets, even when portlet security is enforced. The Show link appears in the Portal Navigator for all portlets. To view portlets through the Portal Navigator, drill down through the providers listed under the Providers tab.

  • AccessView any portlet in any provider.

  • PublishPublish any page portlet, navigation page, or Portal DB provider portlet to the portal. Publishing a portlet makes it available for adding to pages.

17.7.1.2 Portlet-Related Global Privileges on All Providers

The portlet-related global privileges that apply to providers of portlets include:

  • NoneNo global privileges are granted on providers.

  • ManageRegister, edit, and de-register any provider, as well as display and refresh the Portlet Repository. Users and groups with this privilege are also allowed to grant edit privileges on any provider.

  • EditEdit any registered provider.

  • PublishRegister and de-register any provider.

  • ExecuteView the portlets of any provider.

  • CreateCreate portlet providers. Users and groups have the Manage privilege on any provider they create. This means they can perform all manage operations (such as edit and de-register) on any provider they create.

17.7.1.3 Portlet-Related Global Privileges on All Portal DB Providers

The portlet-related global privileges on all Portal DB providers include:

  • NoneNo global privileges are granted on portlets.

  • ManageEdit, delete, or export any Portal DB provider. Create, edit, delete, or export any portlet in any Portal DB provider. Grant access to any Portal DB provider and any portlet in any Portal DB provider.

  • Edit ContentsEdit or export any portlet in any Portal DB provider.

  • View SourceView the PL/SQL package specification and body and run any portlet in any Portal DB provider. This privilege is intended primarily for users or groups who may want to look at a portlet's source to understand how to call it.

  • PersonalizePersonalize any portlet from any Portal DB provider.

  • Run—Run any portlet in any Portal DB provider.

  • CreateCreate Portal DB providers. Users and groups with this privilege can edit, delete, and export the providers they create, and they can create, edit, delete, and export any portlet in any provider.

17.7.2 Granting Personalization Privileges on Portlets

Many personalization privileges can be granted on portlets at the global level, the page level, and the tab level. When personalization privileges are granted at the global level, users with such privileges can use them on every portlet in the portal. When personalization privileges are granted at the page level, users with such privileges can use them on every portlet on the page. When personalization privileges are granted at the tab level, users with such privileges can use them on every portlet on the tab, though not on other portlets on the page that contains the tab.

In most cases, personalizations affect only the view of the user who makes them. A portlet must be edited, rather than personalized, before changes display to all users viewing the portlet.

An exception to this is when the portlet instance is shared. Provided users have sufficient privileges to edit a page, they can share a portlet instance to make their view of a portlet, along with all of its personalizations, available to other users. Shared portlet instances are available for selection under the Shared Portlets page in the Portlet Repository. The sharing option is available on pages, though not on pages that are based on Portal Templates. For more information, see Section 15.7, "Sharing a Portlet Across Multiple Pages".

Granting global access privileges on a portal is discussed in Section 17.3, "Granting Global Privileges". Granting access privileges on a page is discussed in Section 17.5, "Securing Pages". Granting access privileges on a tab is discussed in Section 17.6, "Securing Tabs". This section lists and describes portlet-related access privileges for the portal, for pages, and for tabs.

Global-, page-, and tab-related privileges pertaining to portlet personalizations include:

  • The global privilege Personalize on the object type All Portal DB providers

    Users with this privilege can personalize their view of any portlet in the portal.

  • The page or tab privilege Personalize Portlets (Full)

    Users with this privilege can alter their view of the page by adding portlets to the page, and deleting, moving, hiding, or showing any portlet on the page. Additionally, such users can change the style applied to their view of the page. Personalization changes are visible only to the user who makes them. For example, if a user with this privilege deletes a portlet from a page, the portlet will nonetheless continue to display on other users' views of the page. Likewise, if a user with this privilege adds a portlet to a page, only that user sees the portlet; it does not display when other users view the page.

    For users with this privilege to change the style applied to their view of a page, the option Allow Privileged Users To Personalize Page Style must be selected for the page group. This option is available on the Main tab of page group properties.

  • The page or tab privilege Personalize Portlets (Add-Only)

    Users with this privilege can alter their view of the page by adding portlets to the page, and removing, hiding, or showing the portlets that they add. Additionally, such users can change the style applied to their view of the page.

    For users with this privilege to change the style applied to their view of a page, the option Allow Privileged Users To Personalize Page Style must also be selected for the page group. This option is available on the Main tab of page group properties.

  • The page or tab privilege Personalize Portlets (Hide-Show)

    Users with this privilege can alter their view of the page by hiding, showing, or rearranging any portlet on the page. Additionally, such users can change the style applied to their view of the page. These changes are visible only to the user who made them. For example, if a user with this privilege hides a portlet on a page, that portlet is hidden only for that user; other users still see the portlet.

    For users with this privilege to change the style applied to their view of a page, the option Allow Privileged Users To Personalize Page Style must also be selected for the page group. This option is available on the Main tab of page group properties.