First thing first, here you can download source code - jet_adfbc_security.zip . This archive contains ADF BC REST application and JET source code (you need to copy it into your local JET application).
Take a look first into JET login form. This is where we collect username/password and call login function. One important detail - invalidComponentTracker, this allows to report required validation error, when user hits login button with empty username or password:
Here is the login function in JET. If there are no validation errors, it executes POST against ADF BC REST service custom method. In response we could return user info, preferences, etc. This is the only one request where we are using username/password. Key point of this request is to get JSESSIONID from ADF BC REST server, so we could use it for subsequent requests, without sending username/password again. This is similar concept to ADF Faces, it is also using JSESSIONID to track web user and HTTP session on the server. If login is successful, we are reading custom parameter from response with JSESSIONID value. JET router is updated to render different menu structure after login:
Custom response parameter is populated on the server in Filter class. On authentication request this parameter is set once:
ADF BC REST application is enabled with standard ADF Security:
This is how it works. Login form in JET:
Login is successful with redsam/welcome1 user. Two tabs are rendered - Home and People. Home tab displays chart with employees:
We should dive deeper and check what happens with REST communication. POST method in response gets custom parameter with JSESSIONID value, if authentication is successful based on Authorization header parameter:
Chart data in Home tab is retrieved through GET method and this method is not using Authorization header anymore. It calls REST method using JSESSIONID in URL. JESSIONID must be before URL parameters:
Home tab is implemented with JET chart component:
JSESSIONID is included into REST call URL through getURL method, which is referenced by JET collection:
People tab implements table with pagination support:
Same approach is applied in People tab. JSESSIONID is appended into URL through getURL method, before URL parameters:
People UI with paginated table in JET:
REST request URL contains JSESSIONID:
