Apex authentification vs. authorization

I want to create an open public application where all pages are common and need no personal login to show the information. Only some objects (create, change - buttons) on different pages I want to control with the authorization mechanism based on the Username. Only an authorization schema with a table of usernames in background and the allocation to the buttons is not enaugh.
Thanks for your information in advance

Hello jes
thanks for your answer, my
1st step was to create a oracle-table with names, which I want allow to use the create-buttons etc.
2nd step was the creation of an named authorization schema (exist rule based )with the inside sql like select id from <table> where usename = :APP_USER
3rd step was to allocate this authorization schema to the security options of the create-Button
Because the application is public, and nobody has to log in into the application and therefore the user is PUBLIC_USER. The problem is I can't differentiate the users inside the application

Similar Messages

EN4093R LDAP authentification and authorization

Hi,i want to configure ldap authentification and authorization. Can anyone help me to configure this. In my test environment – I want to give our Domain Admins access to our switches. I found only basic configuration in the user manual but I got now information to configure groups. Could I configure two or more groups to access the switch?

What thype of ldap server are you using? Microsoft Windows 2012 or 2008. I got a problem with 2012 not give the groups back with some users.
Same problem as
https://supportforums.cisco.com/message/3866327#3866327
debug ldap 255
shows correct value with one user that is workin:
[196] Authentication successful for Administrator to 192.168.20.80
[196] Retrieved User Attributes:
[196]   objectClass: value = top
[196]   objectClass: value = person
[196]   objectClass: value = organizationalPerson
[196]   objectClass: value = user
[196]   cn: value = Administrator
[196]   description: value = Vordefiniertes Konto f..r die Verwaltung des Computers bzw. der Dom..ne
[196]   distinguishedName: value = CN=Administrator,CN=Users,DC=xxxx,DC=local
[196]   instanceType: value = 4
[196]   whenCreated: value = 20081201134058.0Z
[196]   whenChanged: value = 20131126141559.0Z
[196]   displayName: value = Administrator
[196]   uSNCreated: value = 12298
[196]   memberOf: value = CN=G_SSLVPN,OU=Service,OU=Groups,OU=XXXXX,DC=XXXX,DC=local
[196]           mapped to Group-Policy: value = ssl_admin
[196]           mapped to LDAP-Class: value = ssl_admin
One user that is not working:
no entries with memberOf in debug
[190] Authentication successful for sdag to 192.168.20.80
[190] Retrieved User Attributes:
[190]   objectClass: value = top
[190]   objectClass: value = person
[190]   objectClass: value = organizationalPerson
[190]   objectClass: value = user
[190]   cn: value = sdag
[190]   distinguishedName: value = CN=sdag,OU=Lieferanten,OU=Users,OU=xxxx,DC=xxxxxx,DC=local
[190]   displayName: value = sdag
[190]   homeMTA: value = CN=Microsoft MTA,CN=SRVSBS01,CN=Servers,CN=erste administrative gruppe,CN=Admini
[190]   proxyAddresses: value = smtp:sdag@xxxx
[190]   proxyAddresses: value = SMTP:sdag@xxxxx

Authorization Scheme using the APEX Authentication Scheme

How would you build an authentication scheme that is using the APEX Authorization scheme. All users are belonging to a group which could be Oracle, External or Developer and I'd like to hide certain pages from the External users.
I am not sure if I can grab the group name from some V('..') function and make something work?
Cheers,
Andy

I'll give it a try again, sorry for not being able to describe the problem better!
I am using the APEX built in authorization and authentication to make my life simple with regards to user mgmt. So all the users are managed using the Home>Administration>Manage Application Express Users. Every user belongs to an APEX group (Home>Administration>Manage Application Express Users>User Groups). For example:
User A belongs to Group External
User B belongs to Group Oracle
User C belongs to Group Admin
Now, there are certaing pages in my application that I want to restrict from the Group External (but the Group Admin and Group Oracle can see them).
So my question is really how would I build such an Authorization Scheme to accomplish this? Not suer about which APEX API functions I should use to get this data and how to build the function.
I hope this makes more sense?
Andy

Cisco Prime Infrastructure 1.3 Tacacs+ authorization problem

Hello,
We are having trouble setting our new installation of Cisco PI 1.3 to work with Tacacs+ configured on ACS 4.2.
We have followed procedure explained in Cisco PI 1.3 configuration guide and in Tacacs+ logs we can see that we have successful authentification but authorization is unsuccessful:
21/05/2013,16:36:44,Authen OK,pradoicic,admins,192.168.187.109,,192.168.187.109,wifi-prime-p-vm01,AP,ACS1AERO,1,,,192.168.187.109,No Filters activated.,,,No,
21/05/2013,16:36:44,Author failed,pradoicic,admins,192.168.187.109,,Service denied,protocol=HTTP service=NCS,NCS HTTP,192.168.187.109,wifi-prime-p-vm01,AP
We have added user group into ACS as is explained in configuration gude and we have also tried to add virtual domain at the beggining or at the and of the list but that didn't solve our problem.
Is there anything that we can do in order to make Cisco PI to authentificate users using Tacacs+?
Any help in finding solution for this problem will be very appreciated.
Regards,
Jelena

Hi,
On the Cisco PI side we have:
1. Added Tacacs+ server under Administration > AAA > TACACS+
We have entered all required parameters
2. Enabled AAA Tacacs+ mode under Administration > AAA > AAA Mode and we have choosed on auth failure or no server response oprion.
On the ACS side:
1. Under Network Configuration > New Entry we have added Cisco PI
2. Under Interface Configuration >TACACS+ (Cisco IOS) > New Services >
we have added Prime and HTTP (we have checked box infront of these service).
3. Under Group Setup > Edit Settings > prime HTTP service we have added custom attributes that we have copied from Cisco PI Admin group. We have also exported virtual domain information from Prime and have imported them on the beggining of the custom attributes and we have also tried to place that virtual domain information on the end but we have the same behavior.
For some reason ACS doesn't know how to return authorization information.
Regards,
Jelena

Acs 4.2 PEAP machine authentification wireless

Hi,
here at work, we have acs 4.2 as our radius server, and 2 wlc 4404 with a wism2 for our wireless network. we have 2 SSID network, lets call them SSID A and B. A have a more restricted access to server than B.
PEAP machine authentification is authorize on both network, to let our users laptop connect before the user login, this enable us to have our computer gpo deploy before the user logon, or have network access to authenticate a user to our directory if he had not logon previously on the laptop.
Users from group A can't logon to SSID B, they can only logon to SSID A, but we have some clever users from group A who have change they wireless setting to only send machine authentification (this can be done in the advance setting of a wireless network in windows 7) to connect to SSID B
We can't force the wireless config by GPO because we don't have an ad 2008 domain, we are still in 2003 soo we can't change the gpo for windows 7 wireless setting (I'm a network guy, I'll have to check more on this to be sure...)
I can't force user to require machine authentification and user authentification because we have a lot of ipad and iphone, and other mobile device that connect using only their user credentials.
Is there a way I could configure this without having to disable machine authentification for SSID B?
thank you

hi thank you for the quick answer,
however we don't have machine access restriction, in the windows eap setting we only have enable PEAP machine authentification.
this is ok because we want our notebook to be able to have access to the wifi (for gpo) before the user logon and we want any user to be able to use their own device. we are a educationnal institute, we don't want to force the teachers and student to only use the equipement we provide we want to give them more power over their choice of equipement.
SSID A is the student network, and SSID B is the teachers network.
the problem we have is some student use their active directory joined computer to get access to the SSID B. If they use their user credentials they won't have access. and as user bring their own device we can't force an peap machine authentification because students and teachers are allowed to BYOD.
is there a way to restrict machine (let's say in an OU) access to an SSID?

Authorization returning data

Hi, I'm new to APEX and I need to create an authorization scheme that doesn't just authorize a user to see certain pages or items, but certain data from tables (i.e. this user is only allowed to see this data, but not that data). The scheme can't just return a true or false that he is allowed to see it or find a keyword like Admin_user, as our tables aren't designed around that.
Is there any way for APEX to do authorization this way? I need to know if it's possible, and if so, just a simple example showing it can.

APEX authorization schemes don't do this. If you are using Enterprise Edition then the usual approach is using Virtual Private Database (VPD):
http://download.oracle.com/docs/cd/B19306_01/network.102/b14266/apdvpoli.htm#CHDFGBEB
APEX can hook into a VPD scheme—search this forum for "VPD".
If you are not licensed for Enterprise Edition then you probably want to build something similar using views.
(When posting questions please include APEX version, web server type/version, and database version/edition to enable appropriate solutions to be proposed.)

Apex instrallation 3.2.1

I installed apex 3.2.1 on oracle 10g and Oracle aplication server 10g release 10.1.3. The installation manual says to modify the marvel.conf file but i could not find it. I just foud the dads.conf and modified it with :
Alias /i/ "C:\product\10.1.3\OracleAS_1\Apache\images"
AddType text/xml xbl
AddType text/x-component htc
<Location /pls/apex>
Order deny,allow
PlsqlDocumentPath docs
AllowOverride None
PlsqlDocumentProcedure wwv_flow_file_mgr.process_downloadd
PlsqlDatabaseConnectString localhost:1521:desa10g ServiceNameFormat
PlsqlNLSLanguage AMERICAN_AMERICA.AL32UTF8
PlsqlAuthenticationMode Basic
SetHandler pls_handler
PlsqlDocumentTablename wwv_flow_file_objects$
PlsqlDatabaseUsername APEX_PUBLIC_USER
PlsqlDefaultPage apex
PlsqlDatabasePassword apex
PlsqlRequestValidationFunction wwv_flow_epg_include_modules.authorize
Allow from all
</Location>
I tried to open apex with :
http://araymund:7777/pls/apex/apex_admin
but o got
Service Temporarily unavailable.
What can i do ???
Alfredo Raymundo

Hi,
This si a pretty good post on the subject. I have to confess that I upgraded to 11g first, and used the pl/sql gateway. The thing I noted was saving the dads.conf as marvel.conf - I'd save as both to cover yourself.
J

Upgrading BOE XI R2 into XI 3.1

Dear all,
I have this scenario for upgrading from boe xi r2 to xi 3.1
1. Report just using Desktop Intelligence and about 400 reports
2. there are 4 universe
3. total about 200 users.
4. Using SSO with AD authentification for authorization
There are 2 servers (dev and prd).
I plan using below steps to upgrade (any advice would be useful ^^):
1. First, backup to BIAR file from the boe xi r2 prd servers.
2. Install and upgrade the boe xi r2 in dev server into boe xi 3.1
3. After the boe xi 3.1 is successfully installed in the dev server, this part where i'm still confuse whether using Import Wizard to use the BIAR file in the step one as the source or directly using boe xi r2 CMS as the source (any advice which one is better?) to test whether the report from prd is run and well.
4. Check the data, report and user groups validity after being imported from xi r2 prd server.
5. after all the necessary objects were checked and valid, this step will install and upgrade the boe xi r2 into boe xi 3.1 in the prd server. (need to notify all users about this migration process and the system maybe down meanwhile)
6. after the installation and upgrade is completed in prd server, using the import wizard again to import all the necessary objects from dev server boe xi 3.1 into prd server boe xi 3.1
any help, comment and advice will be useful ^^
Thank you

My responses
1. First, backup to BIAR file from the boe xi r2 prd servers. - ok
2. Install and upgrade the boe xi r2 in dev server into boe xi 3.1 -ok
3. After the boe xi 3.1 is successfully installed in the dev server, this part where i'm still confuse whether using Import Wizard to use the BIAR file in the step one as the source or directly using boe xi r2 CMS as the source (any advice which one is better?) to test whether the report from prd is run and well.
I might be wrong here but my understanding is that XI3.1 schema would be very different. so even when you upgrade your dev server, i am hoping that you will be pointing it to a sperate/new CMS db instance for CMS. Once install is completed you can use import wizard to bring the backup into dev server.
- Please also note that the security features are slightly different in 3.1 so you might need to redefine your security model a bit to take advantage of some new features like access levels etc.
- You would also need to perform the necessary steps to configure SSO
4. Check the data, report and user groups validity after being imported from xi r2 prd server. - ok
5. after all the necessary objects were checked and valid, this step will install and upgrade the boe xi r2 into boe xi 3.1 in the prd server. (need to notify all users about this migration process and the system maybe down meanwhile)
6. after the installation and upgrade is completed in prd server, using the import wizard again to import all the necessary objects from dev server boe xi 3.1 into prd server boe xi 3.1
-- sounds good
any help, comment and advice will be useful ^^
Edited by: ramaks on Dec 7, 2009 8:08 PM

NEEDED : ISE 1.1.3 Posture configuration and Switch Config (ACL, dACL)

hello,
could anyone please post screen capture of ISE posture configuration ( and remediation )
I need urgently a dACL and a redirection ACL that work at least in a mockup lab.
Authentification and authorizations policies not needed.
posture and remediation policies not needed.
The issue is about ACLs (I guess)
Also needed is a valid switch config file, with ACL (if necessary) a the DOT1x ethernet port.
My IOS is 122.55 SE or 52 SE
Thank you by advance.
Best regards.
V.

Hi Venkatesh,
Your the ultimate ISE Guru !!
You're right
Thanks a lot.
See screen captures and Sw config below
aaa new-model
aaa group server radius ISE
server 192.168.6.10 auth-port 1812 acct-port 1813
server 192.168.6.10 auth-port 1645 acct-port 1646
aaa authentication login default local
aaa authentication dot1x default group ISE
aaa authorization network default group ISE
aaa authorization network auth-list group ISE
aaa authorization auth-proxy default group radius
aaa accounting dot1x default start-stop group ISE
aaa server radius dynamic-author
client 192.168.6.10 server-key 123456789
ip dhcp snooping
ip device tracking
dot1x system-auth-control
dot1x critical eapol
interface FastEthernet1/0/1
switchport mode access
ip access-group ACL-ALLOW in
authentication port-control auto
authentication periodic
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
spanning-tree bpduguard enable
ip http server
ip http secure-server
ip access-list extended ACL-ALLOW
permit ip any any
ip access-list extended ACL-POSTURE-REDIRECT
deny   udp any any eq domain
deny   udp any host 192.168.6.10 eq 8905
deny   udp any host 192.168.6.10 eq 8906
deny   tcp any host 192.168.6.10 eq 8443
deny   tcp any host 192.168.6.10 eq 8905
deny   tcp any host 192.168.6.10 eq www
permit ip any any
snmp-server community snmp RO
snmp-server community RO RO
snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart
snmp-server enable traps mac-notification change move threshold
snmp-server host 192.168.6.10 public
snmp-server host 192.168.6.10 version 2c snmp mac-notification
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server dead-criteria time 5 tries 3
radius-server host 192.168.6.10 auth-port 1645 acct-port 1646 key 123456789
radius-server vsa send accounting
radius-server vsa send authentication
V.

Cisco Prime NCS integration with ACS 5.1

Hello,
We've an issue with authorization on NCS system. NCS successfully integrated witch ACS, but there is a problem with one user. All users have equivalent rights under root. There is shell profile with all possible tasks (exported from NCS server) configured on ACS. All users exept this one (unlucky one:)) authorizes successfully. In ACS logs, authentification and authorization status for this user is passed and all attributes (policy, profile, AV-pairs e.t.c.) is the same as for another users. This 'unlucky' user gets a following message:
There is surely no browser or network issue. Tried from different PCs with same result. There is no any local info related to this username on the NCS server. When i change one charecter in the username on his ACS account, everything works well. What could be a possible reason of this behaivour? Thanks!
Our ACS v
Version 5.1.0.44.X
And NCS
Version : 1.1.2.X

this question should be moved to the Security > AAA forums as this sounds more like an ACS issue than NCS.
HTH,
Steve
Please remember to rate useful posts, and mark questions as answered

Application Express 4.1 Grouping prohibitations use

Hello everyone,
I am a student from Holland and I have to work with Apex for my school. I've been working with apex for about a month now. I think it's a great program development environment.
Here's the thing I've been going a little crazy about, I could not find it anywhere, and some tutorials that I did find useful seem to be outdated(not sure about this, it just looks that way).
So now I have no choice but then to ask the community for help.
My problem:
I can make groups and users in Apex. I've put some users in a group called: 'Leveranciers'. I want users that are in 'Leveranciers' to be blocked
from certain pages in the application (they may not access all the pages, only certain pages).
But I can't find out how to do this, I can't find a way in Apex to make this happen. I don't know where I should look. I tried a lot with security but I just can't figure it out.
I'm sure this should be possible in Apex.
Thank you for reading! I really hope you can help me.
Yours truly,
Milad

938118 wrote:
I am a student from Holland and I have to work with Apex for my school. I've been working with apex for about a month now. I think it's a great program development environment.
Here's the thing I've been going a little crazy about, I could not find it anywhere, and some tutorials that I did find useful seem to be outdated(not sure about this, it just looks that way).
So now I have no choice but then to ask the community for help.
My problem:
I can make groups and users in Apex.Using built-in APEX users/groups/authentication?
I've put some users in a group called: 'Leveranciers'. I want users that are in 'Leveranciers' to be blocked
from certain pages in the application (they may not access all the pages, only certain pages).
But I can't find out how to do this, I can't find a way in Apex to make this happen. I don't know where I should look. I tried a lot with security but I just can't figure it out.
I'm sure this should be possible in Apex.Create an Authorization Scheme based on the <tt>APEX_UTIL.CURRENT_USER_IN_GROUP</tt> API function and apply it to the restricted pages.

Secure XE DB field data

I have a table in which I need to secure/encrypt the data for one field (salary). The DB is 10G XE, so my options are limited to just what we can create around this free version.
Ideally, I want to hand off the APEX development and maintenance to someone who should not see this detail, but who will need to access all of the DB using SQL Developer as well as the APEX gui.. in their duties as administrator/developer.
Right now, the detail is protected within the Apex application by Apex groups and Authorization Scheme's - so only those in the correct group can view the field once logged in. There are currently no DB ID's or Groups created outside of those that come with the DB or that are created during the Apex install.
Any direction you can provide to protect this field from prying eyes thru Apex or via SQL Developer (like) external DB Mgmt tools?
Thanks,
Rich

Hello,
About the best you're going to be able to do in that scenario is use the DBMS_CRYPTO package (http://download.oracle.com/docs/cd/B19306_01/appdev.102/b14258/d_crypto.htm) to encrypt the field before storing it, using a key (with salt) and decrypt it on the fly when you need to display it etc. Use a packaged routine to perform the encrypt/decrypt process and then make sure you wrap the package so that the source code (i.e. the key/salt you've used) can't be easily determined.
Of course...if the people you give the DB to have DBA privileges, it then becomes pretty easy to defeat this protection (almost trivial infact), so you can only protect yourself so far.
Some of the other database editions/features etc make this sort of protection much easier/safer (but that's why you pay for those options..).
Hope this helps,
John.
Blog: http://jes.blogs.shellprompt.net
Work: http://www.apex-evangelists.com
Author of Pro Application Express: http://tinyurl.com/3gu7cd
REWARDS: Please remember to mark helpful or correct posts on the forum, not just for my answers but for everyone!

ESS on ITS

Hi,
I am part of a SAP HR Implementation (my SAP ERP 2004). Without going for Enterprise Portal, how do we go about implementing SAP ESS on ITS. Is there any alternative to SAP EP for developing a Web FrontEnd (GUI) for ESS?
Regards,
Shobhit

Hi,
Thanks Raja. I have got some more concerns.
There are licensed ESS users which have to be mapped to the SAP R/3 User Licenses. In case of Enterprise Portal, We use predefined Business Packages that has got all the standard functionalities that SAP ESS has got. Additionally we can develop Portal Content as per the client requirements. But in case we are goin for ESS without EP, lot of authentification and authorization work has to be done.
Could someone also provide me with a case study of a ESS Implementation on the ITS Server using mySAP ERP.
It is also important to note that ESS licenses are required for all the employees of an organisation. (Say 10000 in my case) whereas SAP User licenses are limited. (Say 300 in my case).
Please share your inputs.
Regards,
Shobhit

Custom / DatabaseLoginModule in JDeveloper 11g

Hello,
first many thanks to Frank Nimphius providing us with some information about Authentification and Authorization in the ADF Code Corner.
But please can you give us some information how to use/configure a custom LoginModule (DBSystemLoginModule and DBTableLoginModule) in Jdeveloper 11g.
It's a little bit frustrating that we have this discussion in 10.1.3 and now with 11g again. There are again only out-of-the-box support for XML and LDAP and nothing about the most common way of database login.
There are many enterprises didn't use LDAP today (explicit if there are some older Forms-Applications in the environment) and for applications with user-self-registration like shops you have to use a DBTableLogin.
So please can you provide us with some more information about how to do /configue such login variants in 11g?
Thanks and best regards
Torsten von Osten
Edited by: ostent on Oct 27, 2008 11:29 AM

Hi,
I agree that it is kind of a step back that with WebLogic Server the integration of custom LoginModules has changed. I started a little side project of mine (as my manager would call it) to build an WLS authentication provider for the DBTableLoginModule. Once I am done with this, a simple JAR file is all you need to get the DBTable LoginModule functionality back to work.
Frank

Required Images path in Database level.

Hello All,
               Merry Christmas :-) Well i am here just for knowledge update about finding images path in my database. Since i unable to find by googling so i felt to take some help here.
Kindly find below details of my database and apex version.
BANNER
Oracle Database 11g Enterprise Edition Release 11.2.0.3.0 - 64bit Production
PL/SQL Release 11.2.0.3.0 - Production
CORE    11.2.0.3.0      Production
TNS for Linux: Version 11.2.0.3.0 - Production
NLSRTL Version 11.2.0.3.0 - Production
Apex Version: 4.2.3.00.08
I can find my path set by me in Dads.conf file but i wanted to know as -- Is it possible to look for image path in any table or view in DB level ?
Opinions are highly appreciated.
Thanks ,
Nitesh pareek.

FOR WINDOWS
# ============================================================================
#                     mod_plsql DAD Configuration File
# ============================================================================
# 1. Please refer to dads.README for a description of this file
# ============================================================================
# Note: This file should typically be included in your plsql.conf file with
# the "include" directive.
# Hint: You can look at some sample DADs in the dads.README file
# ============================================================================
Alias /i/ "E:\Oracle\Apache\Apache\Apache\images/"
<Location /pls/apex>
Order deny,allow
PlsqlDocumentPath docs
AllowOverride None
PlsqlDocumentProcedure      wwv_flow_file_manager.process_download
PlsqlDatabaseConnectString DOMAIN:1521:orcl ServiceNameFormat
PlsqlNLSLanguage            AMERICAN_AMERICA.AL32UTF8
PlsqlAuthenticationMode     Basic
SetHandler                  pls_handler
PlsqlDocumentTablename      wwv_flow_file_objects$
PlsqlDatabaseUsername       APEX_PUBLIC_USER
PlsqlDefaultPage            apex
PlsqlDatabasePassword       mis01
PlsqlRequestValidationFunction wwv_flow_epg_include_modules.authorize
Allow from all
</Location>
FOR LINUX
Apex Setup
cd /d02/oracle/db/Oracle_WT1/instances/instance1/config/OHS/ohs1/mod_plsql
cp dads.conf dads.conf.org
vi dads.conf
add
Alias /i/ "/d02/oracle/db/Oracle_WT1/instances/instance1/config/OHS/ohs1/htdocs/images/"
<Location /pls/apex>
Order deny,allow
PlsqlDocumentPath docs
AllowOverride None
PlsqlDocumentProcedure      wwv_flow_file_manager.process_download
PlsqlDatabaseConnectString DOMAIN:1521:orcl.DOMAIN.com ServiceNameFormat
PlsqlNLSLanguage            AMERICAN_AMERICA.AL32UTF8
PlsqlAuthenticationMode     Basic
SetHandler                  pls_handler
PlsqlDocumentTablename      wwv_flow_file_objects$
PlsqlDatabaseUsername       APEX_PUBLIC_USER
PlsqlDefaultPage            apex
PlsqlDatabasePassword       apex
PlsqlRequestValidationFunction wwv_flow_epg_include_modules.authorize
Allow from all
</Location>
All images in workspace stored in wwv_flow_file_objects$ table

Apex authentification vs. authorization

Similar Messages

Maybe you are looking for