OAF and Function Security

A function is a piece of functionality that is assigned to, or excluded from a responsibility/menu.
A function may or may not point to a OAF page/Form.

Function Security is one of the several options for Dynamic User Interface. We can control the behavior of application depending on whether a function is granted or not.
here are two ways of implementing Function Security:

• Declarative
• Programmatic

Declarative Implementation:

We can control only the following item properties using this approach:

• Rendered
• Read Only
• Disabled
• Required

Set the value for any of the above properties according to the following SPEL syntax:

${oa.FunctionSecurity.<FunctionName>}

** Above value can be added via Personalization as well.

 

Property	Property Internal Name	Expression	Test Result
Rendered	RENDERED_ATTR	${oa.FunctionSecurity.<myFuncName>}	Returns True if <myFuncName> is granted, otherwise False.
Read Only	READ_ONLY_ATTR	${oa.FunctionSecurity.<myFuncName>}	Returns False if <myFuncName> is granted, otherwise True.
Disabled	DISABLED_ATTR	${oa.FunctionSecurity.<myFuncName>}	Returns False if <myFuncName> is granted, otherwise True.
Required	REQUIRED_ATTR	${oa.FunctionSecurity.<myFuncName>}	Returns no if <myFuncName> is granted, otherwise Yes.

 
Note: Most people expect the declarative syntax to return True/Yes for properties if the function is granted and false otherwise, which is not the case.

A more flexible solution is to use a transient attribute in VO. Use function security in the getter method of the transient variable (Refer Programmatic Implementation). Use SPEL to set the properties of the UI Widgets. With this approach other possible values (uiOnly or validatorOnly) for Required property as well.

Programmatic Implementation:

Following methods test if a function is accessible under the current security context:

• OAPageContext.testFunction("<Function Name>") ;
• OADBTransaction.testFunction("<Function Name>") ;

Above methods return True if function is granted else return False.

OADBTransaction.testFunction is used in BC4J and PageContext version is used

in OAController.

We can have lot more control Programmatically. For example, we can modify the query of a VO, control the options being displayed in a drop down.

Use of Function Security to secure access to a page:
Prior to 11.5.10, we used to set the "Function" property on the PageLayout. If user is granted that function the page will render otherwise typical error "Insufficient Priviledges for current operation" is thrown if user attempts to navigate to that page.

While setting the Function property still works the recommended approach from 11.5.10 onwards is to set the Rendered property of PageLayout with the following syntax:
${oa.FunctionSecurity.<FunctionName>}

Note: There are two ways of navigating to a page; you can navigate by passing page parameter or you can pass OAFunc parameter.
If you are navigating to a page using OAFunc=<FunctionName>, again the function security is checked. If Function is granted to the user, then navigation is successful, else "Insufficient Priviledges" error is thrown.