Need recommendations for flexible, secure portals...

November 21, 2007 5:29 AM

Need Secure Flexible Portal Technology Recommendations...

I need to create a portal that can present different views to different people. It needs to be able to invoke existing web-based applications, as well as present summary and alert information from each app through what have been called "portlets".

It also needs to keep track of messages between users, almost like an email system, but with enforced read and receipt notifications and enforced notification of download of attachments back to a database.

I think the main characteristics I need are:

1) Rigorous security, with code injection filtering, etc.
2) Enforced audit trailing of *all* configuration changes and data entries, including username, rationale and timestamp.
3) Each user could be of more than one type, and therefore have different views available.
4) The portal will be hosted for mutiple organizations, so segmentation needs to be possible, so each organization sees its own portal.
5) BUT some users can work for more than one organization, but should only have one account regardless of how many organizations. When they log in, they should be authenticated, and then able to access each portal to which they have been granted access by each organization, potentially having different roles per organization. Other users will have different accounts - one for each organization for which they work.
6) Data driven view configurations.

Someone suggested SharePoint, but I'm not sure.

WHat choices do I have, and where do I start looking, and why?

posted by blue_wardrobe to computers & internet (9 comments total)

You're missing two important details-

- How much are you looking to spend?
- Are you a programmer and/or do you have technical resources or funding (see above) to customize a system?

I'm fairly sure there's no turnkey solution to do what you want out of the box. Something like Sharepoint is a nice start, if you've already got a Windows environment and know how to work in the environment.
posted by mkultra at 7:19 AM on November 21, 2007

I've used products that do pretty much all of those things except for the audit trailing, although it's possible that's a config option I haven't used. The messaging system might be included in some portal products that reach more into being community solutions, like SharePoint.

What products have you actually looked at? I know a good portion of JSR-168 compliant portals (the Java Portlet standard) are going to comply with most of your requirements. I've used Vignette's application portal and it covers a lot of the bases too.
posted by mikeh at 7:27 AM on November 21, 2007

Thanks for the followup.

Budget is as yet undefined, but likely to be generous. However, this doesn't mean I want to spend money unnecessarily.

The overriding factors will be functionality and rapid deployment capability.
posted by blue_wardrobe at 7:50 AM on November 21, 2007

And I am no longer a programmer, but have capacity to understand most information you throw at me.

I won't be doing the work. A small legion of developers will be. Resources are not the issue.

But getting a good recommendation is.

The mention of JSR-168 for instance, is a good pointer. Any others?
posted by blue_wardrobe at 7:52 AM on November 21, 2007

I have to admit, I read "Secure Flexible Portal Technology" and thought "Aperture Science!"
posted by mrbill at 9:12 AM on November 21, 2007

As an addendum:

When my company originally adopted a portal for our intranet, they chose the best-of-breed product for each task. Application portal, content management, security, etc.

Don't do this. You want to buy products that will actually work together, not just in theory. If it means you saddle yourself to one product line and pay a contractor to make up for the other 10%, do it.

I'd look at what your current application architecture is and work accordingly. Do you currently use Active Directory and do you want it to be the repository for security roles? If so, make sure the product you're using respects that (most do). Otherwise, make sure that the built-in user grouping is robust.

Pretty much every portal is going to allow segmentation. Some do this by catering the front page to different user groups -- what you see is based on your role. Others add another level and allow you to make "Sites" that really act as completely separate structures.

Are you shooting for something with built-in content management, or will that be pulled in from another source?
posted by mikeh at 11:37 AM on November 21, 2007

@mikeh: the content won't be articles, etc. but will be individual data records or messages directed individually to the user. The messages may have attachments.

The applications which would be invoked are J2EE-based apps, and one or two of them have ways of surfacing information to SAP NetWeaver's portal.

We would host the portal for a number of other companies, or they might use it. We're trying to create a standardized configuration for it.
posted by blue_wardrobe at 4:14 PM on November 21, 2007

Except for the audit trailing, I believe DotNetNuke will meet your needs. I've only used an older version of DNN, so it's possible that the new version has decent audit trailing capabilities. It's free, but some of the modules that have been built cost money.
posted by k1ng at 8:28 PM on November 21, 2007

Since your applications are J2EE apps, and you'll need the aforementioned JSR-168 compliance, you might look to see what your J2EE app server vendor offers. For example, if you're using IBM Websphere, they also offer a Portal application which meets all the requirements you mention in your numbered list above. As for the messaging requirement, this might be something that ties into your existing infrastructure/messaging system, if you have one.
posted by me & my monkey at 1:28 PM on November 23, 2007