Securing VBCS Application via Roles

 You use authentication to manage access to the pages and data in your application. In addition to the default authentication roles, you can fine tune access to your application resources by creating user roles and assigning authenticated end users to them.

All app users are automatically assigned either the Anonymous User or Authenticated User authentication role, or both. If access to the app requires authentication, all users are automatically granted the role Authenticated User when they sign in. If anonymous access to the app is also allowed, users that sign in are granted the Authenticated User role and the Anonymous User role, and users who are not signed in are only granted the Anonymous User role.

In addition to the Authenticated User role, users who sign in to your application can be assigned a user role based on their user credentials and the groups they've been assigned to in Oracle Identity Cloud Service (IDCS).User roles can help control what a user sees in your application. For example, you can use role-based permissions to limit access to the app, entire pages or flows, even set restrictions on certain components in a page, so only users with certain roles can view that information.

In the current blog we will show you the steps to control access to VBCS application via User Roles.

• Create a Basic VBCS App with default flow and pages in it
• Define Role in User Roles
• Navigate to App Settings > User Roles > Create Role

                

• Create a new Role “AUTHORIZED_ROLE” and map it with IDCS groups

        

• Add Role access in app-flow.json file
• Navigate to Webapp > Json

    

• Replace empty security tag with below

    "security": {

    "access":{

      "requiresAuthentication": true,

      "roles": ["AUTHORIZED_ROLE"]

    }

This will enforce the logged in User to have the specific role to access the UI, if user does not have the necessary role, it will not navigate to the app hence restricting unauthorized access

As with every approach this approach also has some Pro's and Con's:

• Pro's :
• Easy Setup
• No custom coding required
• Con's:
•  No Control on Error Codes or Message
• No Control on Router/Navigate functions hence cannot navigate to custom error page