LDAP authorization with ADF

Hi,
I am in the earlier stage of developing a web application with Jdev 10.3 using ADF BC. I authorize the users against LDAP in my application. I got some help about orion.application.xml file and jazn. But I need some thing more to start up with.
I was trying the option that is available in jdev under tools->ADF Security wizard. But I am not sure about how to use it. Is there anyone who can help me in this?
Thanks,
Haripriya.S

Hi,
Thanks for the suggestion and I have put up my question in jdeveloper forum. but I havent got any replies upto now. Let me inform you once I get the answer.

Similar Messages

Process of login with ADF security

Hi,
I was looking at how to implement the process of Login with the ADF security using JDev 11g and I feel very good...
My question is if it is possible to use this tool in case of use a container as Tomcat 6.x or JBoss. If it is possible to use ADF security for these containers, what should be configured to work?

Hi,
ok, I'd like to use authorization with ADF security, but as you say it is not possible in Tomcat. well, but could implement it, if there must be 3 users with different roles of the little system that I want to develop. Any idea?. There maybe a small example with user roles to use without authorization of ADF security?.

LDAP (openldap) authorization with DAP (dymamic access policy)

Hello,
We have a asa 5520 and we try to make a ldap (openLdap) authorization with DAP (Dynamic Access Policy). We have problem with logical expression. We need more example of logical expression and we need to know how debug logical expression. We try to use de Debug dap trace and debug dap error but we need more debug informations.

Hi
I guess you are using an ldap attribute map, to map the ad group to a group policy. This does not work as you may expect when the user is part of multiple groups, I.e. the user will always be mapped to the same group (first or last in the list, not sure).
Possible solution : remove the ldap attribute map, and configure dap rules that check the ldap.memberOf attribute instead
Hth
Herbert
Sent from Cisco Technical Support iPad App - sorry for the brief explanation, if you need more details let me know.

Weblogic Portal 10.3.5 using JSF 1.2 portlets with ADF faces

We are developing Portal site using Weblogic Portal 10.3.5 with JSF portlet 1.2 and ADF faces (ADF Application runtime 11.1.1.5 ). But the JSF portlets not supporting ADF faces. Please let me know how we use ADF faces in JSF portlet 1.2 in Weblogic Portal.

Hi Murthy,
We did a detailed analysis.
(1) How do we add ADF taskflows, JSF in to weblogic portal desktop/pages? Do we create portlet out of JSF, and display on desktop/page? If this is the case, what about ADf task flows?
--> Taskflows can be deployed as WSRP2.0 portlets. Note 2 options are there JSF page as portlet or taskflow itself as portlets.
(2) How do we integrate weblogic user profiles and UUP (unified user profiles) with ADF and JSF?
--> ADF Security can use Weblogic Server realm as the security provider. Entitlements in WLP will have to be provided based on Weblogic Server roles. In case you are using external LDAP then both can be integrated withe external LDAP
(3) Can anybody shed some light which this better?
(a) weblogic portal with JPF (Java page flows), NetUI --Legacy approach
Pros:
-Easy Development
-Well tested integrated
Cons:
-Future support
-Enhancements may not be available
-Not really portable or standards based
(b) weblogic portal with ADF, JSF?
Pros:
-If your on Oracle stack then great
-Standards based
Cons:
-JSF Portlet bridge issues
-ADF Faces does not work on IE6!
Well what we are going for is JSR 286, Trinidad components (Supports IE6), JSF.
Difficult choice.
Venkat

How can I authenticate and authorize with Web Service on ESB ?

Hello,
I want to authenticate and authorize client with Web Service published
by HTTP/SOAP BC.
Simply if it is an Web Service as J2EE application, I will use
Basic Authentication with JAX-RPC and Realm.
But I think that Web Service published by HTTP/SOAP BC is not belong
to J2EE Application. Threre is no place to describe security role mapping
(like web.xml).
JBI 1.0 the section "5.5.1.1.3 Normalized Message Properties" comments
JAAS Subject is given in the NM Properties. Really in this package
com.sun.jbi.internal.security.*
implements JAAS autentication and authorization (at JaasAuthenticator).
But I can't see how to configure my Service to use this.
How can I authenticate and authorize with Web Service on ESB ?
I referred to the resources.
Mutual Authentication for Web Services: A Live Example
http://developers.sun.com/prodtech/appserver/reference/techart/mutual_auth.html
XML and Web Services Security
http://java.sun.com/j2ee/1.4/docs/tutorial/doc/Security7.html
JAAS Authentication Tutorial
http://java.sun.com/j2se/1.4.2/docs/guide/security/jaas/tutorials/GeneralAcnOnly.html
Thanks,
Takurou
- environment ---------------------------------------------
OpenESB : Project Open ESB Starter Kit
AppServer : Sun Java Systems Application Server 9.0 PE
OS : Windows XP
I don't assume to use SSL (if It's necessary I will try).
User information is stored in a LDAP Server.
-----------------------------------------------------------

Hello,
I read this resource.
SecurityDesign
http://www.glassfishwiki.org/jbiwiki/Wiki.jsp?page=SecurityDesign
Then I think [non-ssl and ssl/tls and so on] securing by basic authentication is ongoing feature at this time.
But I can't see well why this page comments 'HTTP over SSL, TLS'.
HTTP/SOAP Binding Component Overview
http://download.java.net/general/open-esb/docs/jbi-components/httpsoap-bc.html
Does BC support only "SSL server authentication" ?
Doesn't BC support "SSL client authentication" by username/password ?
Thanks,
Takurou

Using OWSM for SAML verification and LDAP authorization

I can verify SAML tokens by using EM security (verifying SAML tokens) but when I use OWSM I get this error at the proxy (by adding the step : SAML - Verify WSS 1.0 Token to the policy of a server agent)
Exception in thread "main" java.lang.NoSuchMethodError: oracle.security.wss.saml.SAMLAssertionIssuer.<init>(Ljavax/xml/rpc/handler/soap/SOAPMessageContext;Lorg/w3c/dom/Document;Loracle/security/wss/config/SamlTokenConfigType;Z)V
Also I need to LDAP authorize the subject of SAML after verification of SAML token. Is it just enough to put the LDAP authorize step after SAML verification?
Won't I need any EXTRACT CREDENTIAL step?
Regards
Farbod

When we were asked to combine OBIEE 10g with Active Directory, we chose external Table Authorization to get information on the groups, a user is part of.
In general, one could follow these articles to achieve AD Authentication:
[http://www.oraclebidwh.com/2008/10/obiee-ldap-authentication-using-microsoft-ad/|http://www.oraclebidwh.com/2008/10/obiee-ldap-authentication-using-microsoft-ad/]
[http://www.oraclebidwh.com/2008/11/obiee-ldap-authentication-using-microsoft-ad-2/|http://www.oraclebidwh.com/2008/11/obiee-ldap-authentication-using-microsoft-ad-2/]
To sum it up: Read User-information from AD. Knowing a user's login-name then, one could query an external table, which consists of user and group information. Everything is setup within initializationBlocks, which could be created in the administration tool.
Problem: As you already said, the problem is, that this external user--group table has to be filled and updated "manually". That is, someone has to input new users or at least assign them to the existing groups.
In our case, there's an admin who knows what sql is and how to work with it.
Another solution could be, to prepare a xml-file, containing user and group information and add it to your repository. The tables could then be queried, too. Although, xml files can become quite unhandy, if a lot of information is held within it, they can be edited via external tools or at least with a standard text editor.

3rd party payment integration with ADF application

Hi ADF experts,
We have a requirement to integrate our ADF application with 3rd party payment gateway.
For this we have created 2 servlets(one to post data, and one for relay response) which will talk to payment gateway.
Since we are using servelts, we wont have access to bindings or any of ADF features. We manage the handshake between servlets and ADF app by passing data through session variables.
I am not happy with this solution, even though it works in our test environment. I would prefer a complete ADF soultion rather than using servelts/jsps.
Is there a standard way(either inbuilt in ADF or extensions) to integrate 3rd party gateway with ADF application which is safe and secure?
Jdev used: 11.1.1.1.5
Payment gateway used: authorize.net
thanks
-Venkat

You can access adf application module from a servlet. All you have to do its to setup a pagedef for the servlet.Check out my blog http://tompeez.wordpress.com/2011/12/16/jdev11-1-2-1-0-handling-imagesfiles-in-adf-part-3/ Which shows how to do this.
I'm not aware of standard integration to a payment service.
Timo

LDAP authorization for VPN

I am having problems getting the LDAP authorization to work. None of the instructions I find seem to coincide with my version of ASDM 5.0(7) and ASA 7.0(7).
SO if anyone has the right instructions for these version can you send me a link?
I get as far of testing it and it fails. When I test it asks for a user name but never a password. so I am not sure what I am doing wrong.
Any help appreciated.

Post your AAA & VPN profile config from the device please?

Integration of Webcenter Discussion service with ADF Application

Hi,
I'm in the process of integrating the Webcenter Discussion service in an ADF Application.
I have completed the following steps.
1. Installed JDeveloper 11g and Webcenter 11g.
2. Configured the Discussion server which was installed along with Webcenter 11g.
3. Integrated Discussions with ADF Application by creating a Discussion connection.
The ADF Application is running fine. But the forums are displaying empty. In the Discussion server, I'm unable to create new users and there are no options to create forums and to create threads.
Help me in getting the below things,
1. Where we can create forums?
2. What settings we need to make for new forums and where to do those settings?
3. Are there any settings to create new users as i have only one default user 'weblogic'? When i create new users from Discussion server, I'm getting the message as 'Create users not supported'.

Hope you are using WC_Collaborations managed server to manage all discussion forum activites.
For you requirement ,you need to navigate the following url:
http://<server address>:<WC_collaboration port>/owc_discussions/admin
it will take you to jive forum admin page .where you can create new forums and new users also. For user and groups management ,visit -
http://docs.jivesoftware.com/latest/documentation/forums-admin-guide.html#users_groups
In your application , all users are coming from weblogic server's embedded LDAP or from external LDAP(if you configure so ). there also you can create user.
I have a doubt ,regarding your application.
Are you using only ADF application ,or webcenter application.
for displaying discussion forum ,you need webcenter discussion forums taskflows in your page .
If you use only ADF application,then you need to add all the forum corresponding libraries in your application otherwise need to consult with oracle support.

Deploy authenticate VPN using LDAP AD (with user group)

Hi,
I'm stucking in configuration of LDAP Server with authenticate for VPN user using group in Windows Domain. I would like to create a group like "vpn-group" in Domain. If someone want to vpn, I just have to add that user in the group "vpn-group" then I can connect to the company.
Here is my configuration
aaa new-model
aaa authentication login userauthen local group ldap
aaa authorization network groupauthor local
ldap attribute-map map1
map type sAMAccountName username
ldap server server1
ipv4 192.168.0.5
attribute map map1
bind authenticate root-dn cn=administrator,cn=users,dc=test,dc=local password 7 0235114B0E144E621518
base-dn cn=vpn-group,cn=users,dc=test,dc=local
Please advice me.

I got it working by including the AD security group in the search-filter
search-filter user-object-type User)(memberOf=CN=vpn-group,OU=Security groups,OU=company,DC=test,DC=local

Issue with SharePoint foundation 2010 to use Claims Based Auth with Certificate authentication method with ADFS 2.0

I would love some help with this issue. I have configured my SharePoint foundation 2010 site to use Claims Based Auth with Certificate authentication method with ADFS 2.0 I have a test account set up with lab.acme.com to use the ACS.
When I log into my site using Windows Auth, everything is great. However when I log in and select my ACS token issuer, I get sent, to the logon page of the ADFS, after selected the ADFS method. My browser prompt me which Certificate identity I want
to use to log in and after 3-5 second
and return me the logon page with error message “Authentication failed”
I base my setup on the technet article
http://blogs.technet.com/b/speschka/archive/2010/07/30/configuring-sharepoint-2010-and-adfs-v2-end-to-end.aspx
I validated than all my certificate are valid and able to retrieve the crl
I got in eventlog id 300
The Federation Service failed to issue a token as a result of an error during processing of the WS-Trust request.
Request type: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Additional Data
Exception details:
Microsoft.IdentityModel.SecurityTokenService.FailedAuthenticationException: MSIS3019: Authentication failed. ---> System.IdentityModel.Tokens.SecurityTokenValidationException:
ID4070: The X.509 certificate 'CN=Me, OU=People, O=Acme., C=COM' chain building failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. 'A certification chain processed
correctly, but one of the CA certificates is not trusted by the policy provider.
at Microsoft.IdentityModel.X509CertificateChain.Build(X509Certificate2 certificate)
at Microsoft.IdentityModel.Tokens.X509NTAuthChainTrustValidator.Validate(X509Certificate2 certificate)
at Microsoft.IdentityModel.Tokens.X509SecurityTokenHandler.ValidateToken(SecurityToken token)
at Microsoft.IdentityModel.Tokens.SecurityTokenElement.GetSubject()
at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.GetOnBehalfOfPrincipal(RequestSecurityToken request, IClaimsPrincipal callerPrincipal)
--- End of inner exception stack trace ---
at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.GetOnBehalfOfPrincipal(RequestSecurityToken request, IClaimsPrincipal callerPrincipal)
at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.BeginGetScope(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state)
at Microsoft.IdentityModel.SecurityTokenService.SecurityTokenService.BeginIssue(IClaimsPrincipal principal, RequestSecurityToken request, AsyncCallback callback, Object state)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.DispatchRequestAsyncResult..ctor(DispatchContext dispatchContext, AsyncCallback asyncCallback, Object asyncState)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.BeginDispatchRequest(DispatchContext dispatchContext, AsyncCallback asyncCallback, Object asyncState)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.ProcessCoreAsyncResult..ctor(WSTrustServiceContract contract, DispatchContext dispatchContext, MessageVersion messageVersion, WSTrustResponseSerializer responseSerializer, WSTrustSerializationContext
serializationContext, AsyncCallback asyncCallback, Object asyncState)
at Microsoft.IdentityModel.Protocols.WSTrust.WSTrustServiceContract.BeginProcessCore(Message requestMessage, WSTrustRequestSerializer requestSerializer, WSTrustResponseSerializer responseSerializer, String requestAction, String responseAction, String
trustNamespace, AsyncCallback callback, Object state)
System.IdentityModel.Tokens.SecurityTokenValidationException: ID4070: The X.509 certificate 'CN=Me, OU=People, O=acme., C=com' chain building
failed. The certificate that was used has a trust chain that cannot be verified. Replace the certificate or change the certificateValidationMode. 'A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
at Microsoft.IdentityModel.X509CertificateChain.Build(X509Certificate2 certificate)
at Microsoft.IdentityModel.Tokens.X509NTAuthChainTrustValidator.Validate(X509Certificate2 certificate)
at Microsoft.IdentityModel.Tokens.X509SecurityTokenHandler.ValidateToken(SecurityToken token)
at Microsoft.IdentityModel.Tokens.SecurityTokenElement.GetSubject()
at Microsoft.IdentityServer.Service.SecurityTokenService.MSISSecurityTokenService.GetOnBehalfOfPrincipal(RequestSecurityToken request, IClaimsPrincipal callerPrincipal)
thx
Stef71

This is perfectly correct on my case I was not adding the root properly you must add the CA and the ADFS as well, which is twice you can see below my results.
on my case was :
PS C:\Users\administrator.domain> $root = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\
cer\SP2K10\ad0001.cer")
PS C:\Users\administrator.domain> New-SPTrustedRootAuthority -Name "domain.ad0001" -Certificate $root
Certificate : [Subject]
CN=domain.AD0001CA, DC=domain, DC=com
[Issuer]
CN=domain.AD0001CA, DC=portal, DC=com
[Serial Number]
blablabla
[Not Before]
22/07/2014 11:32:05
[Not After]
22/07/2024 11:42:00
[Thumbprint]
blablabla
Name : domain.ad0001
TypeName : Microsoft.SharePoint.Administration.SPTrustedRootAuthority
DisplayName : domain.ad0001
Id : blablabla
Status : Online
Parent : SPTrustedRootAuthorityManager
Version : 17164
Properties : {}
Farm : SPFarm Name=SharePoint_Config
UpgradedPersistedProperties : {}
PS C:\Users\administrator.domain> $cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("C:\
cer\SP2K10\ADFS_Signing.cer")
PS C:\Users\administrator.domain> New-SPTrustedRootAuthority -Name "Token Signing Cert" -Certificate $cert
Certificate : [Subject]
CN=ADFS Signing - adfs.domain
[Issuer]
CN=ADFS Signing - adfs.domain
[Serial Number]
blablabla
[Not Before]
23/07/2014 07:14:03
[Not After]
23/07/2015 07:14:03
[Thumbprint]
blablabla
Name : Token Signing Cert
TypeName : Microsoft.SharePoint.Administration.SPTrustedRootAuthority
DisplayName : Token Signing Cert
Id : blablabla
Status : Online
Parent : SPTrustedRootAuthorityManager
Version : 17184
Properties : {}
Farm : SPFarm Name=SharePoint_Config
UpgradedPersistedProperties : {}
PS C:\Users\administrator.PORTAL>

Help required with ADFS 3.0 client certificate authentication

Hi,
I am currently working on integrating ADFS 3.o for Single Sign On to some 3rd party services along with PKI solution. The basic requirement is that I should be able to choose client authentication certificate as an authentication method in ADFS and then
federate user credentials to 3rd party trust for single-sign-on.
I had done this successfully with ADFS 2.0 and that setup is working fine. I have the setup as ADFS 3.0 client authentication method enabled. When I open browser to logon, the ADFS 3.0 page displays a message as "Select a certificate that you want to
use for authentication. If you cancel the operation, please close your browser and try again." but the certificates are not displayed for selection.
The certificates are valid and have valid chaining to CA. Could someone help me resolve this issue?
Thanks!
-Chinmaya Karve

Hi Yan,
Thanks for your response. I have gone through the posts that you have suggested, and my setup looks pretty much as expected.
So, as I mentioned earlier, I have 2 parallel setups with 3rd party service(SalesForce). Once of them is running ADFS 2.0 and another one has ADFS 3.0. I can logon to the third-party services, from both the setups using username/format. I can logon to SF
using client authentication certificate from ADFS 2.0 setup, but from the same client machine, when I try to logon SF via ADFS 3.0, the browser just does not pick up any certificate. The page just shows message of "Select a certificate that you want to use
for authentication. If you cancel the operation, please close your browser and try again.".
I have checked the browser, and it has the right certificates. Also, the same browser/machine is used to logon to SF through ADFS 2.0 via client certificate, which works just fine !
I am really confused now, as to whose issue this really is...
Just to confirm, I am using Certificate Authentication from ADFS 3.0 Authentication Methods for both Intranet and Extranet.
Any suggestion or inputs where I could have gone wrong in the setup?
Thanks!

How to configure ldap.ora with multiple ldap contexts

Hello.
My company has recently taken on another environment with it's own LDAP configuration. It's a bit tedious to have to keep switching my ldap.ora for both ldap configurations. Are there any good suggestions for either allowing me to search both LDAP configurations (2 separate LDAP setups, with 2 default context)? Or is there a smooth way to populate 1 LDAP with the others data? Or perhaps some form of redirect on one LDAP to the other LDAP server for queries?
Some basic info: LDAP is Oracle OID version 10gR2
Please let me know if you have any useful ideas...

Hi,
Here is the of OVD benefits :
1-Easy to setup and manage via our Management client; 2-Unifies multiple directories into a single access point; 3-Normalize and Unify multiple directories; 4-Directly accesses remote repositories;
5-Allows a unified view of an entry using data from multiple repositories;6-Can act as an LDAP proxy and firewall;
Why you can not use OVD to improve these? Read, LDAP to the other LDAP server for queries, allowing you to search both LDAP?
I hope this helps.
Thiago L Guimaraes

Problem with ADF Table and doDML method.

HI,
I have a problem with ADF Trinidad Table. I have one search form and which i click on search button the result is coming it's working fine, And when i click on CreateInsert button to insert a new row it's adding after entering all the data into the table when i click on button on the page i am getting error like
Messages for this page are listed below.
Error
Missing mandatory attributes for a row with key oracle.jbo.Key[1 ] of type AppModule.CmSubscribersView1
Error
Attribute Name in AppModule.CmSubscribersView1 is required
Error
Attribute CreatedBy in AppModule.CmSubscribersView1 is required
Error
Attribute CreationDate in AppModule.CmSubscribersView1 is required
Here Created By and Creation Date are not available in the table i need to set these data from back end for that i have used doDML() method in the entity object and i written the logic but this method not even invoking as i couldn't able to see the logs in the server.
protected void doDML(int operation, TransactionEvent e) {
super.doDML(operation, e);
System.out.println("^^^^^^^^^^^^^^^^66666Inside entity object^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ");
// AppModuleImpl am=new AppModuleImpl();
// Number userID= am.getUserId();
//System.out.println("User id in the Entity Object Is: "+userID);
oracle.jbo.domain.Date dt = new Date();
if(operation ==DML_INSERT){
EntityDefImpl cmSubscribers=CmSubscribersImpl.getDefinitionObject();
CmSubscribersImpl newSubscribers=(CmSubscribersImpl)cmSubscribers.createInstance2(getDBTransaction(),null);
Number n=new Number(1599);
newSubscribers.setCreatedBy(n);
newSubscribers.setCreationDate(dt);
newSubscribers.setLastUpdateDate(dt);
newSubscribers.setLastUpdatedBy(n);
But still the same problem can any one help me inthis.
Regards,
Edited by: user5802014 on Aug 21, 2009 2:04 PM

Hi,
Modify your method to call super.doDML() after initialization of mandatory attributes as below:
protected void doDML(int operation, TransactionEvent e) {
     oracle.jbo.domain.Date dt = new Date();
     if(operation ==DML_INSERT){
          //PRE-INSERT code begins
       EntityDefImpl cmSubscribers=CmSubscribersImpl.getDefinitionObject();
       CmSubscribersImpl newSubscribers=(CmSubscribersImpl)cmSubscribers.createInstance2(getDBTransaction(),null);
       Number n=new Number(1599);
       newSubscribers.setCreatedBy(n);
       newSubscribers.setCreationDate(dt);
       newSubscribers.setLastUpdateDate(dt);
       newSubscribers.setLastUpdatedBy(n);
       //PRE-INSERT code ends
       super.doDML(operation, e);
       //POST-INSERT code if any
     }else
        super.doDML(operation, e);
}Sireesha

Error in authentication with ldap server with certificate

Hi,
i have a problem in authentication with ldap server with certificate.
here i am using java API to authenticate.
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed.
I issued the new certificate which is having the up to 5 years valid time.
is java will authenticate up to one year only?
Can any body help on this issue...
Regards
Ranga

sorry i am gettting ythe same error
javax.naming.CommunicationException: simple bind failed: servername:636 exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed]
here when i am using the old certificate and changing the system date means i can get the authentication.
can you tell where we can concentrate and solve the issue..
where is the issue
1. need to check with the ldap server only
2. problem in java code only.
thanks in advance

LDAP authorization with ADF

Similar Messages

Maybe you are looking for