ADF Security Basics part 11: Best Practices

1.       Build your app with security enabled from the start

2.       Define permission grant for bounded task flow

3.       Do not define the grant for page def file level but the task flow level

4.       Use taskflows to reduce number of access points

5.       Define grant for pages outside taskflows

6.       Define custom permission to render UI components based on user access rights

7.       Define entity object attribute permission to manage user access to row-level data displayed by UI components

8.       Use page level and taskflow level permission grant to avoid exposing row-level create/insert operation to users with view permission only

9.       Do not allow users to access page by its file name

10.   Do not user jdeveloper as a user identity provisioning tool ask administrator to do configure the policies.