ADF Interview Questions - Set 6

Question: What are the types of Application Authentication available at Run Time in ADF?
Answer: Two types-
1. Implicit: Based on JAAS permissions for anonymous-role role
2. Explicit: Based on security constraint on authentication servlet that you can define by using the Configure ADF Security Wizard

Question: What is ADF BC Model Authorization?
Answer: It prevents unauthorized access to entity objects or its attributes. Enable developers to:
1. Secure access to an entire entity object or only certain attributes
2. Specify the which of the following actions the members of a role can perform on entity objects or attributes.
Entity object - Read, Delete, Update
Attribute of EO - Update

Question: How to grant permissions on resources to Roles? 
Answer: You can associate roles to grants on resources as below:
Groups of pages - Grant access on Bounded task flow in jazn-data.xml
Individual pages - Grant access on Page Definition in jazn-data.xml 
Rows - Grant access on entity objects or attributes in EO security and authorization.

Question: How to secure page with no data?
Answer: You can create an empty page definition file and grant access on Page Definition in jazn-data.xml 

Question: What are the different Identity Store options available in ADF Security Wizard?
Answer: Application XML: 
1. Used for small-scale applications or testing
2. Uses the Oracle Platform Security for Java's file-based repository
3. Configured in JDeveloper—user and role information stored in jazn-data.xml
LDAP:
1. Identity store configured outside of JDeveloper
2. Scalable and secure
3. Integrates with Oracle Single Sign On

Question: What are the different Authentication Type options available in ADF Security Wizard?
Answer: 1. HTTP Basic Authentication: Browser authentication is used; the user name and password are not encrypted. This is useful for testing authentication without the need for a custom login page.
2. HTTP Digest Authentication: Browser authentication is used; the user name and password are encrypted, so it is more secure than basic authentication.
3. HTTPS Client Authentication (Public Key Certificate): This strong authentication mechanism uses a certificate and transmits over SSL.
4. Form-Based Authentication: The developer can specify a login page and a page to display when login fails.

Question: What is the difference between Authentication and Authorization in ADF?
Answer: Authentication determines which users can access the application where as Authorization determines what functions users are allowed to perform after they enter the application.

Question: How can we handle response to the Browser Back Button?
Answer: The task-flow-reentry property can used to determines if user can return to an exited task flow by clicking the
browser’s Back button:
1. reentry-allowed: Reentry is allowed 
2. reentry-not-allowed: User will return to a page within the bounded task flow but an exception will be thrown on performing any action like button click.
3. reentry-outcome-dependent: Depends on outcome when same ADF bounded task flow was previously exited.

Question: How can we handle exception in ADF?
Answer: By designating an Exception Handler Activity. The exception handler activity can be any supported activity type like a view or router.
Steps - Right-click the activity in the task flow diagram, then choose Mark Activity > Exception Handler.
When you designate that an activity is the exception handling activity for a task flow, the task flow metadata updates with an <exception-handler> element that specifies the ID of the activity

Question: What are the different data control scopes available in ADF Taskflow?
Answer: Shared and Isolated

Question: What are the different Transaction Start Options available in ADF Taskflow?
Answer: Transaction start options on the called task flow definition specify whether a called ADF bounded task flow should -
1. new-transaction - Create a new transaction
2. requires-existing-transaction - Join an existing transaction
3. requires-transaction - Create a new one only if there is no existing transaction