ACE - keep user on SSL only if logged in

Hi everyone
We have a complicated scenario which we need to achieve using the ACE4710. This is what we want to achieve:
1) User browses to site http://www.site.com.
2) User logs in and login is posted to secure path https://www.site.com/myaccount.
3) Once the user is logged in, all subsequent requests to http://www.site.com/* need to be redirected to https://www.site.com/*. In other words, once the user has accessed /myaccount within the session, all further requests must be SSL, no matter which page on the site they are on.
Is this possible with the ACE?
Thanks

ACE has no knowledge about what happened in a previous connection.
All you can do is inspect the header of the new http request and identify some information which could identify if the user is logged in or not.
For example, if the server sets a particular cookie when the client is logged in, you can check the presence of this cookie to determine if the client is connected and send the redirect to https.
BUT, since the client will potentially keep the same cookie, even if he logs out, then ace will continue redirecting the client to https.
Only the server has the complete knowledge of the client state.
So the redirect should come from the server.
Gilles.

Similar Messages

  • How to keep track of the users who are all currently logged in

    Hi All,
    I have basic knowledge of Session and Servlets. I am wondering how to keep track of the users who are all currently logged in. There should be some way of achieving it.
    I thought of it and come up with having an Application variable that hold it when ever a user successfully logged in.
    Thanks in advance for any reply.

    You can do this by keeping data in a static veriable in a some class of yours. The variable will need to be a collection.
    Whenever a user loogs in to the site a servlet/jsp should put the users information in to the collection and when logs off or when the session expires the entry should be take off.
    You can achive this by storing the velues in a some sort of a week collection where the entries are automaticaly removed when all the other refferences to the entry goes out of scope.
    You might need to read bit about java.lang.ref package and WeekReference
    Or you can make the entry in the collection contain the last time that the user visited any of the pages and a thread can run time to time and clean up the older entries which have timed out

  • You can't use The following message is stopping me access my disk utility.  'this version of the application "Disk Utility" with this version of OS X.'  not only that my Mac pro keeps dropping my internet connection and logs on to BT Open.

    After installing Yosmite, The following message is stopping me accessing my disk utility.  'You can't use this version of the application “Disk Utility” with this version of OS X.' you have “Disk Utility” 12.1.1. 
    not only that my Mac pro keeps dropping my internet connection and logs on to BT Open.
    Help

    For whatever reason you don't have the Yosemite version of Disk Utility which is 13. I suggest you reinstall Yosemite.
    Reinstalling OS X Without Erasing the Drive
    Boot to the Recovery HD: Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.
    Repair the Hard Drive and Permissions: Upon startup select Disk Utility from the main menu. Repair the Hard Drive and Permissions as follows.
    When the recovery menu appears select Disk Utility. After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list.  In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive.  If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported click on the Repair Permissions button. Wait until the operation completes, then quit DU and return to the main menu.
    Reinstall OS X: Select Reinstall OS X and click on the Continue button.
    Download and install the 10.10.1 update.
    Note: You will need an active Internet connection. I suggest using Ethernet if possible because it is three times faster than wireless.
    Check that you have the current version of Disk Utility.

  • How Front End pool deals with fail over to keep user state?

         Hello to all, I searched a lot of articles to understand how Lync 2010 keeps user state if a fail happens in a Front Pool node, but didn't find anything clear.
         I found a MS info. about ths topic : " The Front End Servers maintain transient information—such as logged-on state and control information for an IM, Web, or audio/video (A/V) conference—only for the duration of a user’s session.
    This configuration
    is an advantage because in the event of a Front End Server failure, the clients connected to that server can quickly reconnect to another Front End Server that belongs to the same Front End pool. "
        As I read, the client uses DNS to reconnect to another Front End in the pool. When it reconnects to an available server, does he lose what he/she was doing at Lync client? Can the server that is now hosting his section recover all
    "user's session data"? Is positive, how?
       Regards, EEOC.

    The presence information and other dynamic user data is stored in the RTCDYN database on the backend SQL database in a 2010 pool:
    http://blog.insidelync.com/2011/04/the-lync-server-databases/  If you fail over to another pool member, this pool member has access to the same data.
    Ongoing conversations and the like are cached at the workstation.
    Please remember, if you see a post that helped you please click "Vote As Helpful" and if it answered your question please click "Mark As Answer".
    SWC Unified Communications

  • How do I keep BI Publisher running when I log out of the console in linux?

    I am using the standalone version of BI Publisher and I want to keep it running even after I log out of the console. I have a script that starts it so I typed 'nohup start_bipub.sh &' but when I log out it shuts down anyway. I started my apache server the same way and it still runs after I log out so the only thing I can think of is that X is being killed due to the logout and BI Pub needs it. Is there anyway to keep this process running?
    Thanks,
    Denise

    It depends on the data path from the tower you're using, through NATs and many routers, all the way back to the server. Which depends on your current location and sheer luck.
    For some users, the data path stays alive for 30-45 minutes at a time... thus the phone only has to ping the server that often for push to work. Their push doesn't use much battery.
    Other users have the misfortune of being connected via pathways that only keep a connection alive for 5-10 minutes. Their iPhones eat battery like crazy, and they usually end up switching to a 15-30 minute timed fetch instead.

  • Can I re-enable SSL in Firefox without downgrading? When I hit an SSL-only site, my only current option is to use another browser.

    Just hit an SSL-only site that I needed to access that FF 35 blocked. I don't see an obvious way to create an exception or re-enable it. We need this option... many users understand POODLE and can make an intelligent decision regarding the risks. TLS has its vulnerabilities as well.

    hello ancistrus, as you know ssl3.0 encrypted connections can be no longer considered secure since an attack vector against them ("POODLE") has become known. please contact the webmaster in charge of the site and urge them to update their encryption to something contemporary.
    https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
    if you want to re-enable ssl 3.0 in firefox you can do that - however keep the consequences in mind, that you will become vulnerable to the attack mentioned above: enter '''about:config '''into the firefox address bar (confirm the info message in case it shows up) & search for the preference named '''security.tls.version.min'''. double-click it, change its value to '''0''' and restart the browser.

  • Tacacs authentication fails for one user account for only one switch

    Hi,
    I am having an scenario, where as Tacacs authentication fails for one user account for only one switch.
    The same user account works well for other devices.
    The AAA configs are same on every devices in the network.
    Heres the show tacacs output from the switch where only one user account fails;
                  Socket opens:        157
                 Socket closes:        156
                 Socket aborts:        303
                 Socket errors:          1
               Socket Timeouts:          2
       Failed Connect Attempts:          0
            Total Packets Sent:       1703
            Total Packets Recv:       1243
              Expected Replies:          0
    What could be the reason ?
    No errors on ACS server; same rights had been given to the user account.
    Thanks to advise.
    Prasey

    Hi there,
    Does the user get authenticated in the ACS logs?
    reports and activity----> failed attempts
    ro
    reports and activity----->  passed authentications
    That will help narrow it down.
    Brad

  • You do not have sufficient privileges to complete this installation for all users of the machine. Log on as administrator and then retry this installation

    Hi all
    Have seen a couple threads regarding this but unfortunately nothing that solves my problem thus far!
    Right now, our developers are using the Domain Admin account to promote their website code using MSI files.  I'd like to change this as I feel the Domain Admin account should be on lock down and only used when absolutely necessary, pretty common.  The
    same goes for my account too, I would like to absolve as much use of the Domain Admin as I can.
    Problem is, when they run installers from their own accounts, they receive this error: You do not have sufficient privileges
    to complete this installation for all users of the machine. Log on as administrator and then retry this installation
    The accounts they are using are part of the Built In Administrators group and the Domain Admins group... I'm not sure what other permission you'd need in a domain?  We've gone as far as explicitly giving them local admin access on this server and still
    nothing changes.
    Is there a Group Policy or something that I can change to provide install rights and possibly remove these accounts as Domain Admin and more along the line of Power User?
    Thanks much for your help!
    Ryan

    Hi,
    You could use Software Restriction Policies (SRP’s) or Applocker(supported on Windows server 2008 R2/Windows 7 only) to restrict the running
    of the application for specific user.
    Description of the Software Restriction Policies
    http://support.microsoft.com/kb/310791
    HOW TO: Restrict Users from Running Specific Windows Programs
    http://support.microsoft.com/kb/323525
    How to Implement Group Policy Security Filtering
    http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Security-Filtering.htmlPlease remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

  • Windows cannot load the user's profile but has logged you on with the default profile for the system.

    My Windows 7  crashed a couple days ago after a windows update, I got this message.
    Windows cannot find the local profile and is logging you on with a temporary profile. Changes you make to this profile will be lost when you log off.
    I restarted the machine and got this message
    Windows was unable to load the registry. This problem is often caused by insufficient memory or insufficient security rights.
    DETAIL - The process cannot access the file because it is being used by another process. for C:\Users\TEMP\ntuser.dat
    I checked the event Log I found these .
    Windows cannot load the user's profile but has logged you on with the default profile for the system.
    DETAIL - Only part of a ReadProcessMemory or WriteProcessMemory request was completed.
    Windows has backed up this user profile. Windows will automatically try to use the backup profile the next time this user logs on.
    Windows cannot load the locally stored profile. Possible causes of this error include insufficient security rights or a corrupt local profile.
     DETAIL - The process cannot access the file because it is being used by another process.
    This is the first error in the event viewer after a successful logon
    The description for Event ID 34 from source ccSvcHst cannot be found. Either the component that raises this event is not installed on your local computer or the installation is corrupted. You can install or repair the component on the local computer.
     If the event originated on another computer, the display information had to be saved with the event.
    ccSetMgr
    Windows cannot load the user's profile but has logged you on with the default profile for the system.
    DETAIL - Access is denied.
    Looking at the Logs all I can tell is that after the Desktop Window Manager started if caused this error.
    The winlogon notification subscriber <SessionEnv> was unavailable to handle a notification event.
    then this one
    The Desktop Window Manager has exited with code (0x40010004)
    Then this before it shutdown.
    The User Profile Service has stopped.
    I started up the PC and the first message I got was
    How can I get access to my user profile? do I need to createa new Administrator account? Please help
    The EventSystem sub system is suppressing duplicate event log entries for a duration of 86400 seconds. The suppression timeout can be controlled by a REG_DWORD value named SuppressDuplicateDuration under the following registry key: HKLM\Software\Microsoft\EventSystem\EventLog.

    hi do the following
    1. In Search programs and files (Windows 7) area, type in regedit, and press Enter.
    2. If prompted click yes,
    3.  expand the following HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
    4. click the sid that related to your admin profile (if you not sure, click each sid and in turn look to the right hand side of registry editor it will show who that sid is related to one of the registry files should hae in description localhost\admin or
    something similair)
    5. right click the sid and press delete.
    6. restart your machine and log back on with the admin account, this will then rebuild the admin profile... dont worry when it loads and none of your personal settings are saved or files or folders... go to c:\users
    in here you will see two folders for the admin account, one will be just admin and the other most likely admin.localhost
    i cant remember which one is which but just check both, one will still have all your files and folders in it.
    i suggest making a backup of your data before doing this incase something does go wrong, but ive had this happen many times in a domain enviorment and has worked for me everytime.

  • Cant get com.apple.security.files.user-selected.read-only entitlement to work

    Hey I am curious how can I get the .ipa compiled file for iOS to be able to read all the directories on the iPhone?
    I made a file browser but I cant get to the pictures
    I tried adding the entitlements in Flash Builder 4.6 in the descriptor file like this:
    <key>com.apple.security.files.user-selected.read-only</key>
    <true/>
    <key>com.apple.security.assets.movies.read-only</key>
    <true/>
    <key>com.apple.security.assets.pictures.read-only</key>
    <true/>
    in the
      <iPhone>
            <Entitlements>
            <![CDATA[
    I got Push notifications working and accepted in the app store but it can't read the pictures directory when browsing for a file
    I know the app id and stuff is set up right or I wouldnt have been able to get it accepted in the app store.  In the entitlements area of course I have the application identifier set and aps-environment and keychain access groups and whatnot set up right.
    When I try to put the app onto the iPhone with iTunes it just says 'Entitlements are not valid' (does not mention anything about mismatched ids) I can't find anything about how to add this entitlement and I could have sworn I saw a thing that said I can just use the descriptor file to add entitlements in some of the documentation I have it set to use air 3.4
    Is there something I am doing wrong, how do I get apple to just put these entitlements in the mobileprovision file, I cant seem to edit it, if I do I also get an error in itunes that is some hex code...

    Did you ever solve your problem?
    I just transfered my web hosting and e-mail to bluehost. I had some of the same problems you are having. I noticed you have your incoming server set to bluehost.
    Incoming mail server: (SSL) box610.bluehost.com (sever requires authentication which I already have done)
    If bluehost is your server this is what worked for me:
    Account Information
    Account type— POP
    Description—anything you want
    Email Address—in your case would be [email protected]
    Full name—  first and last name
    Incoming server—mail.magnus.com
    User name—[email protected] Notice it is the @ symbol not a +
    password— your password . Remember they are case sensitive
    Outgoing Mail server—select edit smpt server list from the drop down window
    select the + to add a server
    Account Information
    Description—may be left blank
    Server name—mail.magnus.com
    TSL Certificate—None
    Advanced
    Use default ports
    Check  Use SSL
    Authenticate—password
    Username—[email protected]
    passowrd—your password
    Click ok
    In the accounts window
    Outgoing SMTP— select the server you just created.
    Check—use only this server
    Select the Advance tab next to the Mailbox Behaviors
    Check use SSL— it will be port 995
    Authenticate —use password
    Ann

  • How to use "Days to keep historical data" & "Maximum time between logs(hh:mm:ss)

    Iam using LabVIEW DSC. Values are being logged continously into citadel.
    Is it possible to retain data of just one month and delete the earlier data as fresh data is being logged into citadel?
    Is it possible to achieve this feature with "Days to keep historical data" & "Maximum time between logs(hh:mm:ss)" options in the history menu of Tag configuration editor ?

    Yes, Days to keep historical data does what you are looking for. After the specified number of days, the old data gets overwritten with new data. So, you always have only the specified number of days' of data in Citadel.
    Note: You may sometimes see that old data doesn't get overwritten till after a day or so of your setting (depending on how much data is being logged). This is because Citadel logs in "pages" and waits till the current page it's logging to is full before it starts overwriting the old ones.
    You do not have to use the 'Max time between logs' option for this. This option forces Citadel to log data every so-many hh:mm:ss regardless of whether or not the data has changed. Note that this is NOT a way to "log data on
    demand". Because, this periodic logging of data would change for a particular tag when its data changes. So, even with this setting all data may not get logged at one shot. Anyways, as I said, you do not have to use this setting for what you're trying to do.
    Regards,
    Khalid

  • Possible to make an item editable for certain users and read only for other

    Is it possible to make an item editable for certain users and read only for others?
    I've been able to accomplish this by taken the select statement that I used to define an authorization scheme, placing it in the Read Only condition of the item. However, I would like to simply reference the authorization scheme to utilize caching, and to help keep things cleaner for future maintenance.
    Is it possible to reference an authorization scheme in an item condition similar to the way another item can be referenced by preceding it with a colon (i.e. :P1_First_Name)?

    Thank you, your suggestion worked.
    It would be nice on a future release of APEX if a drop-down box existed under the Ready Only section that would allow an existing Authorization Scheme to be selected or negated when applying the Read Only attribute to a form item.

  • Satellite L450 - The user profile service failed the log on

    Hi
    I have a Toshiba Satellite L450 and I have had it for a while now and this has never happened before, when I turn it on it goes through the usual and then comes up with my name and a box for me to type my password, as normal. But when I put my password in it says:
    The user profile service failed the log on
    User profile cannot be loaded
    The only option I have is to log off and when I do it takes me back to the password bit. If I put the password in wrong it tells me its wrong.....
    Cant do anything with it, I have tried shutting down, etc....looked through the manual and cant see anything about it in there either.......... :(

    Hi mate
    Please attach to this Microsoft document:
    +Error message when you log on to a Windows Vista-based or Windows 7-based computer by using a temporary profile: "The User Profile Service failed the logon. User profile cannot be loaded+
    http://support.microsoft.com/kb/947215
    It seems to be known issue to Microsoft. You have to use the FIX posted there.
    Good luck

  • Archive and install (keep user's settings) didn't  work

    History
    PPC G5, original 1.8GHz single proccessor, OS 10.4.8
    1) using Brother P-Touch Editor 'uninstall' program, uninstalled ver 3.2
    2) installed version 3.2a
    3) removed P-Touch print driver 1.4
    4) installed print driver 1.41 -> it works (I don't know if it worked after updating to 10.4.8, but never had any troubles)
    5) -> PhotoShop does not load, splash screen shows 1/2 second, then nothing
    Console shows
    2007-03-04 21:20:27.350 Adobe Photoshop CS2[398] CFLog (21): Cannot
    find executable for CFBundle 0x81fa4d0 </Applications/Adobe
    Photoshop CS2/Adobe Photoshop CS2.app/Contents/Frameworks/
    LicMan.framework> (not loaded)
    Failed to load LicMan.framework
    Nisus Writer Express says I am unregistered pop up to use demo version or enter license #, pressing enter license #, it just goes to new document, does not allow license # to be entered
    Console shows:
    2007-03-05 20:29:01.013 Nisus Writer Express[980] Could not load
    Feedback defaults
    (this might not be an exclusive list of software not working)
    6) Backed up HD. this process was stopped with this error message:
    There was an error during copying Library from source to target: ditto: /Library/./Receipts/SecUpd2005-004Pan.pkg/Contents/Resources/French.lproj/Licen se.rtf; Input/out error
    (Note I am not running French version of anything)
    7) I replaced this file from a back up. The two files had the same date and size. This did not help problems. I then was able to complete the backup successfully
    Today
    1) I did a archive and install, keeping users preferences.
    rebooting I got this error:
    Application Launch Failure
    The application "Transport Monitor" could not be launched because of a shared library error: "8<Transport Monitor><Transport Monitor><HotSyncLib.PPC>"
    2) After reading Apple's warnings that things might not work properly after an archive and install until you upgrade to version you had before, I downloaded the 10.4.8 combo updater.
    Still got the same error when rebooting
    3) Ran software update and updated Daylight savings, some security patches, Java, etc.
    4) On reboot I still get this error about the Transport Monitor/shared library
    HELP?

    Perhaps you should try reinstalling Photoshop and Nisus Writer, but first be sure you completely uninstall them:
    Uninstalling Software: The Basics
    Most OS X applications are completely self-contained "packages" that can be uninstalled by simply dragging the application to the Trash. Most applications create preference files which are stored in the /Home/Library/Preferences/ folder. Although they do nothing once you delete the associated application, they do take up some disk space. If you want you can located them in the above location and delete them, too.
    Some applications may install an uninstaller program that can be used to remove the application. In some cases the uninstaller may be part of the application's installer, and is invoked by clicking on a Customize button that will appear during the install process.
    Some applications may install components in the /Home/Library/Applications Support/ folder. You can also check there to see if the application has created a folder. You can also delete the folder that's in the Applications Support folder. Again, they don't do anything but take up disk space once the application is trashed.
    Some applications may install a startupitem or a Log In item. Startupitems are usually installed in the /Library/StartupItems/ folder and less often in the /Home/Library/StartupItems/ folder. Log In Items are set in the Accounts preferences. Open System Preferences, click on the Accounts icon, then click on the LogIn Items tab. Locate the item in the list for the application you want to remove and click on the "-" button to delete it from the list.
    If an application installs any other files the best way to track them down is to do a Finder search using the application name or the developer name as the search term.
    There are also several shareware utilities that can uninstall applications:
    AppZapper
    CleanApp
    Yank
    SuperPop
    Uninstaller
    Spring Cleaning
    Look for them at www.versiontracker.com or www.mackupdate.com.
    For more information visit The XLab FAQs and read the FAQ on removing software.

  • How to restrict contributor users to  edit only few set of pages

    Hi All,
    We wanted to restrict some of the contributor users to edit only few set of pages,
    is that possible to implement ?
    Can somebody please give some pointers
    Thanks
    Hari

    I was looking for a hint in the documentation and could not find any. This means that either it is something obvious (not to me, unfortunately), or this concept is not native to the Site Studio. This means that all contributors are equal - at least, the section http://docs.oracle.com/cd/E21764_01/doc.1111/e10614/c01_intro.htm#i422918 seems to be written in that way.
    What could you try?
    This section, http://docs.oracle.com/cd/E21764_01/doc.1111/e13650/ssxa_creatingsites.htm#CIHGGCFB , suggests that all contributors are assigned the role WCMContributor. There is probably no finer distinction than that a user has this role or not.
    Then, each of used objects (namely, region definitions, native/contributors files) have its metadata. You could try to give read-only access to those contributors who won't edit the region.
    Last thing, which looks the most promising, but also the most complicated, is that you will dynamically change the region template, based on a user logged in (a sort of self-defined contrib mode). An example can be found in this thread: Display Contributor Regions dynamically (note that the example is about languages, you will need to implement your own logic!)

Maybe you are looking for