Coding Security Implementing Portlet Security

Creating PLSQL Portlets 8-31 raise wwpro_api_provider.PORTLET_SECURITY_EXCEPTION; end if; ... end show; 6. Find the is_runnable function. is_runnable is the place where you implement your security checks. In this example, the security check is quite simple. If the user is logged on that is, not in a public session, then the function returns true and the portlet is displayed to the user. For your own purposes, you could, of course, code much more complex security checks in the is_runnable function. function is_runnable p_provider_id in integer ,p_reference_path in varchar2 return boolean is begin -- -- Portlet security check. It allows the portlet to be visible -- if the user is logged on, that is, the current session is not a -- public session. -- return wwctx_api.is_logged_on; end is_runnable; 7. Optionally, if you want to see this portlet on a page and it is not already in the Portlet Repository, refer to the instructions in Section 8.3.2, Implementing the Provider Package for information on how to add it. 8. Once your portlet appears in the repository, you can add it to a page to test it. To add your portlet to a page, follow the instructions in Oracle Fusion Middleware Users Guide for Oracle Portal.

8.8 Improving Portlet Performance with Caching

Oracle Portal provides for the caching of PLSQL portlets. This functionality permits PLSQL portlets to cache their Web content on the middle tier. Subsequent requests for the content may be retrieved from the cache, with or without validation from the database, decreasing the database workload. Oracle Portal provides three types of caching for your PLSQL portlets: ■ Validation-based caching compares a key value to check whether the contents of the cache are still valid. If the key value does not change, it uses the cached content. Otherwise, it makes a round trip to the portal node to fetch the portlet content. ■ Expiry-based caching uses a given expiration period for the contents of the cache when rendering the portlet. This form of caching is useful for content that changes infrequently or at very regular intervals for example, every day at the close of business. ■ Invalidation-based caching is the most complex form of caching but also the most flexible. The objects in Oracle Web Cache are considered valid as long as they are not invalidated explicitly. You can also combine invalidation-based caching with either expiry-based or validation-based caching. 8-32 Oracle Fusion Middleware Developers Guide for Oracle Portal Because Oracle Portal supports user personalization of pages and portlets, the view of a page can vary from one user to another. Oracle Portals caching is designed to allow content to vary on a per-user basis, even if the URL is the same across all users. Therefore, portal objects can be cached at either the user level or the system level and can be described as follows: ■ User-level caching is for a specific user. The cache entries are unique for that user and cannot be accessed by other users. ■ System-level caching is for all users. One cache entry is used for all users. Examples of content that might be suitable for system-level caching are page banners and news portlets. When a database provider issues a request for a portlet, the request is sent to the portletss show procedure. This procedure accepts the portlet_runtime_record as a parameter. This record structure contains fields that can be examined and set by the portlet to enable caching. The caching control fields of this record are as follows: ■ caching_key: This value is communicated in the ETAG header for this request and returned back to the portlet provider in subsequent requests. Setting this field enables validation-based caching. ■ caching_period: This field enables expiry-based caching. The value is the number of minutes the content should be held in the cache. This mode overrides validation-based caching. If a value is set for this field, then the caching_key field is ignored. ■ caching_level: This field defines whether the content is meant for general use or for a specific user. The valid values are SYSTEM and USER.

8.8.1 Using Caching

The general model for working with portlet caching varies according to the type of caching you choose. To a great extent, the type of caching you choose depends on the portlet content. If the portlet content changes at fairly regular intervals for example, at the close of business every day, then it probably makes sense to use expiry-based caching. If the portlet content changes at irregular intervals, then validation- or invalidation-based caching is probably best.

8.8.1.1 Validation-Based Caching

If you choose validation-based caching, the general model is as follows: 1. Set the caching_key field of the portlet_runtime_record parameter. Add a check to compare the value of the current key with the value of the caching_key field of the portlet_runtime_record parameter. Note that the first time the show procedure is called, the key is null and its value must be set. 2. Determine whether you want to use system or user level caching. Set the caching_level field of the portlet_runtime_record parameter accordingly.

8.8.1.2 Expiry-Based Caching

If you choose expiry-based caching, the general model is as follows: 1. Set the caching_period field of the portlet_runtime_record parameter to the desired interval for the cache in minutes. Creating PLSQL Portlets 8-33 2. Determine whether you want to use system or user level caching. Set the caching_level field of the portlet_runtime_record parameter accordingly.

8.8.1.3 Invalidation-Based Caching

If you choose invalidation-based caching, the general model is as follows:

1. Indicate to Oracle Portal that it must generate specific headers for Oracle Web

Cache by calling wwpro_api_provider.USE_INVALIDATION.

2. Determine whether you want to use system or user level caching. Set the

caching_level field of the portlet_runtime_record parameter accordingly.

3. Optionally, set up validation- or expiry-based caching as well.

4. Add invalidation logic to your portlet where needed for example, when the

portlet is personalized and make appropriate calls to wwpro_api_ invalidation.

8.8.2 Configuring and Monitoring the Cache

The Oracle Fusion Middleware Administrators Guide for Oracle Portal describes how to configure caching as well as how to monitor and tune performance.

8.8.3 Implementing Validation-Based Caching

The caching example, located in ..\pdkplsql\pdk\plsql\cache in PDK-PLSQL pdkplsql.zip, illustrates how you can implement validation and expiry-based caching. You can browse through this example as follows to see how the validation-based functions are implemented in a portlet: 1. Open the validcache_portlet.pkb file in an editor. 2. At the very top of the file, notice the aliases for the caching level constants. CREATE OR REPLACE package body VALIDCACHE_PORTLET is -- Caching Constants CACHE_LEVEL_SYSTEM constant varchar210 := SYSTEM; CACHE_LEVEL_USER constant varchar210 := USER; 3. Find the show procedure. Notice first that the p_portlet_record is an in and out parameter for this procedure. procedure show p_portlet_record in out wwpro_api_provider.portlet_runtime_record 4. In the procedures security check, the caching fields of p_portlet_record are set to null if the security check fails. begin if not is_runnable p_provider_id = p_portlet_record.provider_id ,p_reference_path = p_portlet_record.reference_path then -- Set it to null so that cache does not get used even if exists p_portlet_record.caching_level := null;