How to implement Custom Authentication and Authorization in Oracle SOA 11g

Can anyone please tell me, how to implement Custom Authentication in Oracle SOA 11g ?
Because in Oracle SOA 10.1.3.4 , i have implemented this custom authentication and authorization by implementing BPMAuthenticationService, BPMAuthorizationService, BPMIdentityService to verify againt my database systems.
implementation classes like the mentioned below
1).
public class SampleAuthenticationService extends SampleServiceBase implements BPMAuthenticationService {
2).
public class SampleAuthorizationService extends SampleServiceBase implements BPMAuthorizationService {
3).
public class SampleIdentityService extends SampleServiceBase implements BPMIdentityService {
Please help me to implement the authentication and authorization in Oracle SOA 11g .
thanks in advance

To start with please go through following document
http://docs.oracle.com/cd/E21764_01/integration.1111/e10231/adptr_jms.htm
http://docs.oracle.com/cd/E23943_01/integration.1111/e10231/adptr_file.htm
Regards
Arpit

Similar Messages

  • How can I get authentication and authorization through OS X open directory with the Sun ZFS STOR ZS3-2

    how can I get authentication and authorization through OS X open directory with the Sun ZFS STOR ZS3-2
    I have configure NFS, I need help configuring the share that I created in the Sun ZFS STOR ZS3-2 to connect with the OS X Open Directory

    Hi,
        You may  try checking the help page for ldap configuration :
    https://<Appliance_IP>:215/wiki/index.php/Configuration:Services:LDAP
    ZFS Storage supports LDAP, NIS, AD as directory service.
    Hope Open Directory is also based on LDAP and may work in similar fashion.
    Thanks
    Nitin

  • How to get ADF authentication and authorization working on server

    I am having an issue with deployment & ADF authentication and authorization.
    From the below testing results, you can see that I am unable to log in when I have deployed my app to my standalone server with both ADF security authentication and authorization turned on. I have included web.xml, jazn-data.xml and the page/server error I am receiving.
    When making an attempt to log in I get the following results:
    Running Locally with ADF Authentication:                                           Works Fine
    Running Locally with ADF Authentication & Authorization:         Works Fine
    Deployed to server with ADF Authentication:                                    Works Fine
    Deployed to server with ADF Authentication & Authorization:  Doesn’t Work
    What I have already tried: Removed all anonymous grants, using the same database credentials as the app user, deploying app twice (on the redeploy not including the login credentials & app policies at the application properties). Various modifications to web.xml e.g. welcomefilelist etc
    JDeveloper Version: 11.1.2.4
    Server Web Logic: 10.3.6
    Server ADF: 11.1.1.16
    Page Error when trying to log in:
    Error 401--Unauthorized
    From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
    10.4.2 401 Unauthorized
    The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.46) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity MAY include relevant diagnostic information. HTTP access authentication is explained in section 11.
    Server error when trying to log in:
    Servlet failed with Exception oracle.adf.controller.security.AuthorizationException: ADFC-0619: Authorization check failed: 'wpd.mobility.view.pageDefs.homePagePageDef' 'VIEW'.
    at oracle.adf.controller.internal.security.AuthorizationEnforcer.handleFailure(AuthorizationEnforcer.java:182)
            at oracle.adf.controller.internal.security.AuthorizationEnforcer.internalCheckPermission(AuthorizationEnforcer.java:162)
            at oracle.adf.controller.internal.security.AuthorizationEnforcer.checkPermission(AuthorizationEnforcer.java:116)
            at oracle.adfinternal.controller.state.ControllerState.checkPermission(ControllerState.java:663)
            at oracle.adfinternal.controller.state.ControllerState.initializeUrl(ControllerState.java:700)
            at oracle.adfinternal.controller.state.ControllerState.synchronizeStatePart2(ControllerState.java:531)
            at oracle.adfinternal.controller.application.SyncNavigationStateListener.afterPhase(SyncNavigationStateListener.java:59)
            at oracle.adfinternal.controller.lifecycle.ADFLifecycleImpl$PagePhaseListenerWrapper.afterPhase(ADFLifecycleImpl.java:530)
            at oracle.adfinternal.controller.lifecycle.LifecycleImpl.internalDispatchAfterEvent(LifecycleImpl.java:120)
            at oracle.adfinternal.controller.lifecycle.LifecycleImpl.dispatchAfterPagePhaseEvent(LifecycleImpl.java:168)
            at oracle.adfinternal.controller.faces.lifecycle.ADFPhaseListener$PhaseInvokerImpl.dispatchAfterPagePhaseEvent(ADFPhaseListener.java:131)
            at oracle.adfinternal.controller.faces.lifecycle.ADFPhaseListener.afterPhase(ADFPhaseListener.java:74)
            at oracle.adfinternal.controller.faces.lifecycle.ADFLifecyclePhaseListener.afterPhase(ADFLifecyclePhaseListener.java:53)
            at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._executePhase(LifecycleImpl.java:447)
            at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:202)
            at javax.faces.webapp.FacesServlet.service(FacesServlet.java:508)
            at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
            at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
            at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
            at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:205)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at oracle.adfinternal.view.faces.webapp.rich.RegistrationFilter.doFilter(RegistrationFilter.java:125)
            at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
            at oracle.adfinternal.view.faces.activedata.AdsFilter.doFilter(AdsFilter.java:60)
            at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
            at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl._doFilterImpl(TrinidadFilterImpl.java:293)
            at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl.doFilter(TrinidadFilterImpl.java:199)
            at org.apache.myfaces.trinidad.webapp.TrinidadFilter.doFilter(TrinidadFilter.java:92)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
            at java.security.AccessController.doPrivileged(Native Method)
            at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
            at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
            at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
            at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
            at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
            at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
            at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
            at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
            at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
            at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
            at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
            at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
            at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
    Web.xml
    <?xml version = '1.0' encoding = 'windows-1252'?>
    <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
             version="2.5">
      <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>client</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.PARTIAL_STATE_SAVING</param-name>
        <param-value>false</param-value>
      </context-param>
      <context-param>
        <description>If this parameter is true, there will be an automatic check of the modification date of your JSPs, and saved state will be discarded when JSP's change. It will also automatically check if your skinning css files have changed without you having to restart the server. This makes development easier, but adds overhead. For this reason this parameter should be set to false when your application is deployed.</description>
        <param-name>org.apache.myfaces.trinidad.CHECK_FILE_MODIFICATION</param-name>
        <param-value>false</param-value>
      </context-param>
      <context-param>
        <description>Whether the 'Generated by...' comment at the bottom of ADF Faces HTML pages should contain version number information.</description>
        <param-name>oracle.adf.view.rich.versionString.HIDDEN</param-name>
        <param-value>false</param-value>
      </context-param>
      <context-param>
        <description>Security precaution to prevent clickjacking: bust frames if the ancestor window domain(protocol, host, and port) and the frame domain are different. Another options for this parameter are always and never.</description>
        <param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
        <param-value>differentOrigin</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.FACELETS_SKIP_XML_INSTRUCTIONS</param-name>
        <param-value>true</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>
        <param-value>true</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.FACELETS_DECORATORS</param-name>
        <param-value>oracle.adfinternal.view.faces.facelets.rich.AdfTagDecorator</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.FACELETS_RESOURCE_RESOLVER</param-name>
        <param-value>oracle.adfinternal.view.faces.facelets.rich.AdfFaceletsResourceResolver</param-value>
      </context-param>
      <filter>
        <filter-name>JpsFilter</filter-name>
        <filter-class>oracle.security.jps.ee.http.JpsFilter</filter-class>
      </filter>
      <filter>
        <filter-name>trinidad</filter-name>
        <filter-class>org.apache.myfaces.trinidad.webapp.TrinidadFilter</filter-class>
      </filter>
      <filter>
        <filter-name>adfBindings</filter-name>
        <filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
      </filter>
      <filter-mapping>
        <filter-name>JpsFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
      </filter-mapping>
      <filter-mapping>
        <filter-name>trinidad</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>ERROR</dispatcher>
      </filter-mapping>
      <filter-mapping>
        <filter-name>adfBindings</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
      </filter-mapping>
      <filter-mapping>
        <filter-name>adfBindings</filter-name>
        <servlet-name>adfAuthentication</servlet-name>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
      </filter-mapping>
      <listener>
        <listener-class>oracle.adf.mbean.share.connection.ADFConnectionLifeCycleCallBack</listener-class>
      </listener>
      <listener>
        <listener-class>oracle.adf.mbean.share.config.ADFConfigLifeCycleCallBack</listener-class>
      </listener>
      <listener>
        <listener-class>oracle.bc4j.mbean.BC4JConfigLifeCycleCallBack</listener-class>
      </listener>
      <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
      </servlet>
      <servlet>
        <servlet-name>resources</servlet-name>
        <servlet-class>org.apache.myfaces.trinidad.webapp.ResourceServlet</servlet-class>
      </servlet>
      <servlet>
        <servlet-name>BIGRAPHSERVLET</servlet-name>
        <servlet-class>oracle.adf.view.faces.bi.webapp.GraphServlet</servlet-class>
      </servlet>
      <servlet>
        <servlet-name>BIGAUGESERVLET</servlet-name>
        <servlet-class>oracle.adf.view.faces.bi.webapp.GaugeServlet</servlet-class>
      </servlet>
      <servlet>
        <servlet-name>MapProxyServlet</servlet-name>
        <servlet-class>oracle.adf.view.faces.bi.webapp.MapProxyServlet</servlet-class>
      </servlet>
      <servlet>
        <servlet-name>adfAuthentication</servlet-name>
        <servlet-class>oracle.adf.share.security.authentication.AuthenticationServlet</servlet-class>
        <init-param>
          <param-name>success_url</param-name>
          <param-value>/faces/Pages/homePage.jspx</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
      </servlet>
      <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>/faces/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>resources</servlet-name>
        <url-pattern>/adf/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>resources</servlet-name>
        <url-pattern>/afr/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>BIGRAPHSERVLET</servlet-name>
        <url-pattern>/servlet/GraphServlet/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>BIGAUGESERVLET</servlet-name>
        <url-pattern>/servlet/GaugeServlet/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>MapProxyServlet</servlet-name>
        <url-pattern>/mapproxy/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>resources</servlet-name>
        <url-pattern>/bi/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>adfAuthentication</servlet-name>
        <url-pattern>/adfAuthentication</url-pattern>
      </servlet-mapping>
      <mime-mapping>
        <extension>swf</extension>
        <mime-type>application/x-shockwave-flash</mime-type>
      </mime-mapping>
      <mime-mapping>
        <extension>amf</extension>
        <mime-type>application/x-amf</mime-type>
      </mime-mapping>
      <security-constraint>
        <web-resource-collection>
          <web-resource-name>test</web-resource-name>
          <url-pattern>/faces/pages/*.</url-pattern>
          <url-pattern>/faces/*.</url-pattern>
        </web-resource-collection>
        <auth-constraint>
          <role-name>valid-users</role-name>
        </auth-constraint>
      </security-constraint>
      <security-constraint>
        <web-resource-collection>
          <web-resource-name>adfAuthentication</web-resource-name>
          <url-pattern>/adfAuthentication</url-pattern>
        </web-resource-collection>
        <auth-constraint>
          <role-name>valid-users</role-name>
        </auth-constraint>
      </security-constraint>
      <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
          <form-login-page>/login.html</form-login-page>
          <form-error-page>/error.html</form-error-page>
        </form-login-config>
      </login-config>
      <security-role>
        <role-name>valid-users</role-name>
      </security-role>
    </web-app>
    Jazn-data.xml
    <?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?>
    <jazn-data xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/jazn-data.xsd">
      <jazn-realm default="jazn.com">
        <realm>
          <name>jazn.com</name>
          <users>
            <user>
              <name>*****</name>
              <display-name>*******</display-name>
              <description>******</description>
              <credentials>********<credentials>
            </user>
          </users>
          <roles>
            <role>
              <name>support</name>
              <display-name>support</display-name>
              <members>
                <member>
                  <type>user</type>
                  <name>mobile</name>
                </member>
              </members>
            </role>
          </roles>
        </realm>
      </jazn-realm>
      <policy-store>
        <applications>
          <application>
            <name> myapp </name>
            <app-roles>
              <app-role>
                <name>mob_mobile_support</name>
                <class>oracle.security.jps.service.policystore.ApplicationRole</class>
                <display-name>mob_mobile_support</display-name>
                <description>support role</description>
                <members>
                  <member>
                    <name>mobile</name>
                    <class>oracle.security.jps.internal.core.principals.JpsXmlUserImpl</class>
                  </member>
                </members>
              </app-role>
            </app-roles>
            <jazn-policy>
              <grant>
                <grantee>
                  <principals>
                    <principal>
                      <name>SUPPORT</name>
                      <class>oracle.security.jps.internal.core.principals.JpsXmlEnterpriseRoleImpl</class>
                    </principal>
                  </principals>
                </grantee>
                <permissions>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name> myapp.view.pageDefs.*</name>
                    <actions>view</actions>
                  </permission>
                </permissions>
              </grant>
              <grant>
                <grantee>
                  <principals>
                    <principal>
                      <name>mob_mobile_support</name>
                      <class>oracle.security.jps.service.policystore.ApplicationRole</class>
                    </principal>
                  </principals>
                </grantee>
                <permissions>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name> myapp.view.pageDefs.addapplicationPageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name>Pages.addappmsgtypPageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name>Pages.addoperationPageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name> myapp.view.pageDefs.homePagePageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name> myapp.view.pageDefs.loggingSearchPageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name>myapp.view.pageDefs.workHistoryPageDef</name>
                    <actions>view</actions>
                  </permission>
                </permissions>
              </grant>
            </jazn-policy>
          </application>
        </applications>
      </policy-store>
    </jazn-data>

    Read Frank's article http://www.oracle.com/technetwork/issue-archive/2012/12-jan/o12adf-1364748.html
    Then you have to check if the user use use to login are defined in the stand alone server. If you server is running in production mode there is no automatic user or role migration. You have to to this by yourself.
    Once you have check that the users are present, you have to check if the enterprise roles are mapped to the corresponding application roles.
    Timo

  • Unable to start several servers using the custom. authentication and authorization Provider

    I downloaded the Sample Security Providers (http://developer.bea.com/managed_content/direct/SampleSecurityProvidersUnmanaged.zip)
    and followed the user guide for installation.
    We have following configuration:
    - One domain with 3 servers :
    - ADM: admin, console
    - WTL_1 : WebTool server 1
    - WTL_2 : WebTool server 2
    WTL_1 and WT_2 are member of cluster WTL_Cluster
    I try to restart all servers. It worked fine for the first one (ADM), but for
    the other two I got followinf exception:
    ####<Nov 13, 2002 10:29:02 AM CET> <Emergency> <WebLogicServer> <isoit652.bbn.hp.com>
    <WTL_1> <main> <kernel i
    dentity> <> <000342> <Unable to initialize the server: Fatal initialization exception
    Throwable: java.lang.SecurityException: Authentication denied: Boot identity not
    valid
    java.lang.SecurityException: Authentication denied: Boot identity not valid
    at weblogic.security.service.SecurityServiceManager.doBootAuthorization(SecurityServiceManager.java:1024)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:1166)
    at weblogic.t3.srvr.T3Srvr.initialize1(T3Srvr.java:697)
    at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:589)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:277)
    at weblogic.Server.main(Server.java:32)
    Do you have any idea why it worked only for one server?
    Thanks for any help
    My Chi

    Hi John,
    Actually, thanks to your examples, I have my Authentication Scheme setup using a custom authentication function that first checks that the Username/Password are valid, and if so, then validates that the user has also been setup in AD with one of the groups used by my application. What I'm wondering is, when I replace the built-in Authentication Function it appears that the function that I code must have the correct signature (accepts UserName and Password, and returns a boolean)... but I really want to be able to also return the actual AD Group that the user is assigned to for use within my Authorization Schemes. I'm not sure if/how I can do this from my authentication function, or if I just need to re-query AD again in my Authorization Schemes to get the AD group that the user is assigned to.
    Appreciate the help,
    Lori

  • How many types of authentications in sharepoint and how to implement those authentication in sharepoint?

    Hi All,
    How many types of authentications in sharepoint and how to implement those authentication in sharepoint?
    can any one explain the above things with examples?
    Thanks in Advance!

    In addition to
    A Sai Gunaranjan you can also check this URL for Sharepoint 2010:
    http://technet.microsoft.com/en-us/library/cc288475(v=office.14).aspx
    http://www.codeproject.com/Tips/382312/SharePoint-2010-Form-Based-Authentication
    ***If my post is answer for your query please mark as answer***
    ***If my answer is helpful please vote***

  • Authentication and Authorization question.

    Hi All,
    I require your help in getting validated my understanding on Authentication and Authorization. This is wrt to WebLogic Server and WebLogic Portal.
    Authentication.
    1. The custom authentication provider can authenticate(user and group) against any datastore(LDAP OR DB). The LoginModule is a kind of blockbox and it can return true/false depending on authentication.
    2. The end result of this process is true/false.
    Authorization.
    1. The custom authorization providers can authorize the authenticated user based on role. All these entities ie(user,group,role) can be either in LDAP OR DB.
    2. The end result of this process is true/false.
    Role mapping.
    1. The custom role mapper can put all the roles that a user belongs and returns all Role. This can happen agaist LDAP OR DB.
    2. The end result is list of roles for a user.
    Security policy configuration.
    Is it mandatory that a user/group/role should be existing in WebLogic Server LDAP server(OR Portal LDAP server) to create these policies and authorization rules. What i mean by is that can user,group,role can exist in application specific database and still can be used for creatiing security policies??
    Thanks,
    Prashanth Bhat.

    The Security Providers are useful/can be used for developing a standard j2ee application , which will be deployed as standard j2ee application.
    The DA means Delegated Administrator, which is way how portal components are restricted to different types of administrators.
    The VE means Visitor Entitlemens, which is way how portal components are restricted to end users.
    My question is whether thess(DAs and VEs) can also be put
    our datastore for access rights??
    Thanks,
    Prashanth Bhat.

  • JAXWS EJB3.0 Based WebService Authentication and Authorization - Weblogic

    Hi Experts,
    I need to Create a EJB3.0 WS where this Service has static Authentication and Authorization. How can I achieve it, any pointer.
    TIA

    The below sample is for basic authentication and authorization.
    Web service
    ========
    import javax.ejb.Stateless;
    import javax.ejb.TransactionAttribute;
    import javax.ejb.Remote;
    import javax.jws.WebMethod;
    import javax.jws.WebService;
    import javax.annotation.security.RolesAllowed;
    import javax.ejb.SecurityRoles;
    @Stateless(mappedName="com.slsbBean")
    @Remote( { com.bea.Service.class})
    @WebService(name="TransactionPortType", serviceName="TransactionService",
    targetNamespace="http://example.org")
    public class ServiceBean implements Service {
    @WebMethod()
    @RolesAllowed ( {"Admin","Manager"})
    public void testMethod(String s) {
    System.out.println("inside ejb method");
    System.out.println("username : " + weblogic.security.SubjectUtils.getUserPrincipal(weblogic.security.Security.getCurrentSubject()));
    Client
    ====
    import java.util.Map;
    import javax.xml.ws.BindingProvider;
    public class Test {
    public static void main(String[] args) {
    TransactionService simple = new TransactionService();
    TransactionPortType port = simple.getTransactionPortTypePort();
    BindingProvider bindingProvider = (BindingProvider) port;
    Map<String, Object> reqContext = bindingProvider.getRequestContext();
    reqContext.put(BindingProvider.USERNAME_PROPERTY, "XXXXXX");
    reqContext.put(BindingProvider.PASSWORD_PROPERTY, "XXXXXX");
    port.testMethod("hello");
    Regards,
    Sunil P

  • Issue in External Table Authentication and Authorization in OBIEE11G

    Hello Gurus,
    Can anyone help me how to configure External Table Authentication and Authorization in OBIEE11g through weblogic server not like in 10g style(Through INIT Blocks).
    I've followed the (Doc ID 1338007.1) document. But when i'm restart the Managed servers and Admin servers after configuring the SQLAuthenticator all my services are showing down.
    I already raised the SR (SR 3-6286054151) on this issue. But still i didn't get any reply from them.
    Can anyone help me out on this issue or can anyone me send the document for "how to configure External Table Authentication and Authorization in OBIEE11g" . It's really appreciate for your quick response.
    my mail ID [email protected]
    Thanks,
    Syam.
    Edited by: 942658 on Oct 13, 2012 10:55 AM

    Hi John,
    Thanks for your quick response.
    We configured "ReadOnlySQL Provider" by following the Oracle's white paper(Doc ID 1338007.1) Please find the below steps what we configured in weblogic console.
    1. Created the Data Source
    2. In the data source specified the Database driver--> *Oracle's Driver Thin for service connections: Versions:9.0.1 and later.
    3. Defined the connection Properties .
    4. Selected targets as Admin server and bi_server.
    Then Activate changes
    5. Created new provider by using ReadOnlySQL Authenticator
    6. In the provider specific tab we given the SQL statements and saved it.
    7. Restarted the Admin and Managed servers.
    After restarted the services when we open the Enterprise Manager page all the services are showed as Undefined - means red.
    Apart from that we followed your suggested link http://askjohnobiee.blogspot.com/2012/09/how-to-oid-authentication-with-groups.html
    For External table authentication do we need to configure BISQLAuthenticator or ReadOnlySQLAuthenticator ?
    If we configure BISQLAuthenticator we just import Groups from database to Console application. Then how can it Authenticated to the User ?
    Please let me know your ideas on this.
    Thanks,
    Syam

  • How to implement Dual Authentication in Oracle Apex

    Currently I am learning an oracle Apex tools. I am pretty confuse and not able to find any help for authentication scheme offered from oracle Apex. Like I would like to implement dual authentication scheme i.e. I want to implement Database Authentication and LDAP authentication. If user is fail in authenticate in Database Credential then I would like to check him in LDAP Credential. If user is present in LDAP credential then User is able to login. But if user is not present in any of them then again Login page should get displayed.
    Edited by: user2074688 on Jun 24, 2010 3:27 PM

    Dual Authentication doesn't exist as predefined Authentication Scheme, you need to program that yourself.
    So what you need to do is create a custom Authentication Scheme where you at first check user credentials against Database and then against LDAP.
    Have fun,
    Peter
    Blog: http://www.oracle-and-apex.com
    ApexLib: http://apexlib.oracleapex.info
    Work: http://www.click-click.at

  • Weblogic portal external authentication and authorization

    In our project we are using Weblogic portal 10.3 and Oracle 11g as back end. While creating the domain, I have specifed Oracle as back end. All the portal relevant schemas are created in Oracle database. For our application, We have created a specific schema. In a project specific schema, we have user table which containing fields like user name, password, email and other relevant fields. How to configure in weblogic to access this table for authentication instead of the user table in portal schema? As well as I need to know, in a admin console if a new user is created then the details will be stored in a portal schema table or in a project schema user table? Ultimately, I want to configure the project specific table to store the user details when the user created via admin console.
    Need this urgently.

    Hi Rajesh
    Basically you need Custom Authenticator to store and authenticate all your users from your own specific DB Tables (that has user information). For this you need to develop Custom Authenticator. Please note that this has nothing to do with the Portal. This is core weblogic security stuff. I compiled some links for you. Incase if you have Oracle Support, open a ticket with them Oracle support do have a fully working sample custom RDBMS Authenticator that stores and authenticates Users from specific set of custom Tables. They will send you right away. I hope someone in these forums may have this sample also in their personal blogs/forums.
    And, Yes, you can force your Custom Authenticator to be the default one and to store the users when you create the users in Admin Console. Basically when you create the users you should see the option like to create the users in which Authentication Provider like that.
    http://download.oracle.com/docs/cd/E12840_01/wls/docs103/dvspisec/atn.html (Authentication Providers)
    http://download.oracle.com/docs/cd/E12840_01/wls/docs103/dvspisec/atn.html#wp1145342 (Do You Need to Develop a Custom Authentication Provider?)
    http://download.oracle.com/docs/cd/E12840_01/wls/docs103/dvspisec/atn.html#wp1089150 (How to Develop a Custom Authentication Provider)
    http://download.oracle.com/docs/cd/E12840_01/wls/docs103/secmanage/atn.html#wp1204261 (Changing the Order of Authentication Providers)
    Thanks
    Ravi Jegga

  • An issue with authentication and authorization on ISE 1.2

    Hi, I'm new to ISE.
    I have an issue with authentication and authorization.
    I have ISE 1.2 plus patch 6 installed on VMware.
    I have built-in Windows XP supplicant and 2960 cisco switch with IOS c2960-lanbasek9-mz.150-2.SE5.bin
    On supplicant I use EAP(PEAP) with EAP-MSCHAP v2.
    I created  authentication and authorization rules with Active Directory  as External Identity Source. Also I applied  authorization profile with DACL.I login on Windows XP machine under different Active Directory accounts. Everything works fine (authentication, authorization ), but only for several hours. After several hours passed , authentication and authorization stop working . I can see that ISE trying authenticate and authorize users, but ISE always use only one account for  authentication and authorization . Even if I login under different accounts ISE continue to use only one last account.
    I traied to reboot switch and PC,but it didn’t help. Only rebooting of ISE helps. After ISE rebooting, authentication and authorization start to work properly for several hours.
    I don’t understand is it a glitch or I misconfigured ISE or switch, supplicant?
    What  should I do to resolve this issue?
    Switch configuration:
     testISE#sh runn
    Building configuration...
    Current configuration : 7103 bytes
    ! Last configuration change at 12:20:15Tue Apr 15 2014
    ! NVRAM config last updated at 10:35:02  Tue Apr 15 2014
    version 15.0
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname testISE
    boot-start-marker
    boot-end-marker
    no logging console
    logging monitor informational
    enable secret 5 ************
    enable password ********
    username radius-test password 0 ********
    username admin privilege 15 secret 5 ******************
    aaa new-model
    aaa authentication dot1x default group radius
    aaa authorization network default group radius
    aaa authorization auth-proxy default group radius
    aaa accounting update periodic 5
    aaa accounting dot1x default start-stop group radius
    aaa server radius dynamic-author
     client 172.16.0.90 server-key ********
    aaa session-id common
    clock timezone 4 0
    system mtu routing 1500
    authentication mac-move permit
    ip dhcp snooping vlan 1,22
    ip dhcp snooping
    ip domain-name elauloks
    ip device tracking probe use-svi
    ip device tracking
    epm logging
    crypto pki trustpoint TP-self-signed-1888913408
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-1888913408
     revocation-check none
     rsakeypair TP-self-signed-1888913408
    crypto pki certificate chain TP-self-signed-1888913408
    dot1x system-auth-control
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    ip ssh version 2
    interface FastEthernet0/5
     switchport mode access
     ip access-group ACL-ALLOW in
     authentication event fail action next-method
     authentication event server dead action reinitialize vlan 1
     authentication event server alive action reinitialize
     authentication host-mode multi-auth
     authentication open
     authentication order dot1x mab
     authentication priority dot1x mab
     authentication port-control auto
     authentication periodic
     authentication timer reauthenticate server
     authentication violation restrict
     mab
     dot1x pae authenticator
     dot1x timeout tx-period 10
     spanning-tree portfast
    interface FastEthernet0/6
     switchport mode access
     ip access-group ACL-ALLOW in
     authentication event fail action next-method
     authentication event server dead action reinitialize vlan 1
     authentication event server alive action reinitialize
     authentication order dot1x mab
     authentication priority dot1x mab
     authentication port-control auto
     authentication periodic
     authentication timer reauthenticate server
     authentication violation restrict
     mab
     dot1x pae authenticator
     dot1x timeout tx-period 10
     spanning-tree portfast
    interface FastEthernet0/7
    interface Vlan1
     ip address 172.16.0.204 255.255.240.0
     no ip route-cache
    ip default-gateway 172.16.0.1
    ip http server
    ip http secure-server
    ip access-list extended ACL-ALLOW
     deny   icmp any host 172.16.0.1
     permit ip any any
    ip radius source-interface Vlan1
    logging origin-id ip
    logging source-interface Vlan1
    logging host 172.16.0.90 transport udp port 20514
    snmp-server community public RO
    snmp-server community ciscoro RO
    snmp-server trap-source Vlan1
    snmp-server source-interface informs Vlan1
    snmp-server enable traps snmp linkdown linkup
    snmp-server enable traps mac-notification change move
    snmp-server host 172.16.0.90 ciscoro
    radius-server attribute 6 on-for-login-auth
    radius-server attribute 6 support-multiple
    radius-server attribute 8 include-in-access-req
    radius-server attribute 25 access-request include
    radius-server dead-criteria time 5 tries 3
    radius-server vsa send accounting
    radius-server vsa send authentication
    radius server ISE-Alex
     address ipv4 172.16.0.90 auth-port 1812 acct-port 1813
     automate-tester username radius-test idle-time 15
     key ******
    ntp server 172.16.0.1
    ntp server 172.16.0.5
    end

    Yes. Tried that (several times) didn't work.  5 people in my office, all with vers. 6.0.1 couldn't access their gmail accounts.  Kept getting error message that username and password invalid.  Finally solved the issue by using Microsoft Exchange and "m.google.com" as server and domain and that the trick.  Think there is an issue with imap.gmail.com and IOS 6.0.1.  I'm sure the 5 of us suddently experiencing this issue aren't the only ones.  Apple will figure it out.  Thanks.

  • How to Implement custom share functionality in SharePoint 2013 document Lib programmatically?

    Hi,
    I have created custom action for Share functionality in document library.
    On Share action i'm showing Model pop up with Share form with addition functionality.
    I am developing custom share functionality because there is some addition functionality related to this.
    How to Implement custom share functionality in SharePoint 2013  document Lib pro-grammatically?
    Regards,
    - Siddhehswar

    Hi Siddhehswar:
    I would suggest that you use the
    Ribbon. Because this is a flexible way for SharePoint. In my project experience, I always suggest my customers to use it. In the feature, if my customers have customization about permission then i can accomplish this as soon
    as possible. Simple put, I utilize this perfect mechanism to resolve our complex project requirement. Maybe we customize Upload/ Edit/ Modify/ Barcode/ Send mail etc... For example:
    We customize <Edit> Ribbon. As shown below.
    When user click <Edit Item>, the system will
    render customized pop up window.
    Will

  • How to implement session varibles and how to use it

    how to implement session varibles and how to use it.ple help me

    Please see the below blog, Hope it helps!!!
    http://obieetraining11.blogspot.com/2012/06/create-initialization-block-for-session.html

  • Authentication and authorization capability in weblogic application server

    Hi,
    Need input from architecture point of view -
    Requirement is typical - have to build a web center portal application with authentication and authorization capability.
    I can think of three architecture options:
    1. weblogic server (where webcenter portal application will be deployed) with oracle IDM (or any other full blown IDM suite)...
    2. weblogic server with Active Directory (or any other LDAP directory), and a LDAP authenticator is configured in weblogic...
    3. only weblogic server (users created in weblogic admin console)...
    Obviously 1st one is costliest option (product cost, infrastructure cost, maintenance cost) and most flexible. However I am discarding it purely because of cost.
    Confused between 2nd and 3rd.
    2nd option - separate user store, user can be added/deleted without touching application server, cost wise - 1 extra server and 1 LDAP directory product (or open source LDAP server)...
    3rd option - application server becomes very 'heavy' with all users information, you need to access server to add/delete users, probably cheapest option money wise... However it might affect application performance if users grow large...
    Please let me know if I should consider more parameters/points before deciding. Is there any important thing I am missing? Your input appreciated.
    Thanks.

    Hi,
    You are right your first requirement make more costly and complex environment.
    I would recommend to go with Second option instead of the third one.
    In cause in future if you want to use different server also you will have option to use external AD.
    Well now you will think why I recommend you second option instead of the third option.
    external LDAP is more secure than internal one.
    If you have any further query let me know.
    Regards,
    Kal

  • How to implement custom logging using log4j in Webcenter Portal Application

    I need to implement custom logging and export it to a new log file in Oracle 11.1.1.5 (Webcenter portal application). Please tell me the steps to implement this functionality.

    Please post questions for WebCenter Portal in it's own forum:
    WebCenter Portal

Maybe you are looking for