Authentication and EJB Providers in Apache SOAP 2.0

Has anyone tried to modify the latest Apache SOAP code to pass the rpcrouter
servlet Basic Authentication information (from HTTPSession) on to the JNDI
initial context in the Stateless Session EJB Provider code (i.e. impersonate
the authenticated http user for EJB calls)? I am thinking about allowing
SOAP users to inherit the EJB deployment descriptor access control setup.
Dan Meany

With the link attached.
Hi Denes, This is a configuration for configuring mod_auth_sspi on Apache 2.2 (and proxy to the EPG) I haven't tried 2.0 but I'm pretty sure it should work in the same way.
Re: NTLM Authentication
Rob..

Similar Messages

Rmi-iiop authentication and EJB

In WL6.1, I have an Ejb with secured methods. The (Swing) client application accesses the Ejb through rmi-iiop using the JDK1.3.1 Orb.
Unfortunately, it seems that the caller identity (which was supplied in the InitialContext lookup) is not propagated
to the server: any call to a secured method
fails with a CORBA NO_PERMISSION Exception.
Using the t3 protocol the program works fine, but that would require the 25Mb weblogic.jar on all clients, which is unattainable for us.
Any ideas how this situation can be corrected?
-Allard Siemelink

Hello Allard,
My only suggestion (and you have probably looked at this already) would be to
use the Verbosetozip utility, refer to http://e-docs.bea.com/wls/docs61////adminguide/utils.html#1117405
for more information.
Kind Regards,
Richard Wallace
Senior Developer Relations Engineer
BEA Support.
Allard Siemelink <[email protected]> wrote:
In WL6.1, I have an Ejb with secured methods. The (Swing) client application
accesses the Ejb through rmi-iiop using the JDK1.3.1 Orb.
Unfortunately, it seems that the caller identity (which was supplied
in the InitialContext lookup) is not propagated
to the server: any call to a secured method
fails with a CORBA NO_PERMISSION Exception.
Using the t3 protocol the program works fine, but that would require
the 25Mb weblogic.jar on all clients, which is unattainable for us.
Any ideas how this situation can be corrected?
-Allard Siemelink

Apache SOAP 2.2 - Weblogic 6.1SP2

Hi,
Has anyone managed to get Apache SOAP working with Weblogic 6x?
I can get everything up and running, but for some reason the classloader
for the web application (ie; the actual Apache SOAP app) doesn't load the
classes in my jar file containing the EJB files, serializers, etc.
Therefore whenever I make a SOAP request I get a server side error reported
via SOAP that some class or another (one of my own ones) cannot be found.
I can cure this by sticking my jar file in the server's classpath - however
this isn't great as it means the JVM's classloader is picking everything up
and I lose the ability to redeploy.
Any ideas? In the absence of any other information it would seem that
Weblogic's classloaders are buggy...
Cheers,
Trev

Hi Trev,
Let's recap here:
1. You are deploying the .war file for Apache SOAP, into WLS 6.1 SP2, right? If
yes, you copied the .war file into the $WL_HOME/config/examples/applications directory,
or something similar, right?
2. It (some class or classes in soap.war) couldn't find the classes for your EJB
so, you "unwarred" it, created a WEB-INF/lib directory, and copied the .jar for
your EJB into that directory. Then you re-jarred the soap.war, right? If so, did
you put a <ejb-ref> element in the web.xml (for soap.war), so it (the SOAP webapp)
would know about the ejb?
The <ejb-ref> should look something like this:
<ejb-ref>
<description></description>
<ejb-ref-name>examples.webservices.security.PhoneBookService</ejb-ref-name>
<ejb-ref-type>Session</ejb-ref-type>
<home>examples.webservices.security.PhoneBookServiceHome</home>
<remote>examples.webservices.security.PhoneBookService</remote>
</ejb-ref>
You'd also need to create a WEB-INF/weblogic.xml file and put something like this
in it:
<reference-descriptor>
<ejb-reference-description>
<ejb-ref-name>examples.webservices.security.PhoneBookService</ejb-ref-name>
<jndi-name>examples.webservices.security.PhoneBookService</jndi-name>
</ejb-reference-description>
</reference-descriptor>
But, I would do any of this because your EJB doesn't have "diddly squat" to do
with Apache SOAP ;-) The Apache SOAP web app is a "standalone" thing, right? You
want to use your EJB "with it", not be part "of it" right? Exactly! So, let's
abandon that route...
3. Next, you tried to turn the Apache SOAP Web Application (.war) into the Apache
SOAP Enterprise Application (.ear). I'm assuming that you created a META-INF/application.xml
that looked something like this:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE application PUBLIC '-//Sun Microsystems, Inc.//DTD J2EE Application
1.2//EN' 'http://java.sun.com/j2ee/dtds/application_1_2.dtd'>
<application>
<display-name>Apache SOAP 2.2</display-name>
<module>
<web>
<web-uri>soap.war</web-uri>
<context-root>/soap</context-root>
</web>
</module>
<module>
<ejb>{name of the .jar for your ejb}</ejb>
</module>
</application>
But, you didn't create the <ejb-ref> stuff in #2 above. Again, I don't think it
makes a lot of sense to put "your EJB" in the "Apache SOAP" Enterprise application
What's going on here (the Apache SOAP code not being able to find your EJB classes)
is "expected behavior" as far as the BEA docs go. Everyone I know (including me!)
that deploys the Apache SOAP web app in WebLogic, creates a .jar that contains
a copy of all the remote (and home) interface classes that the rpcrouter servlet
will call, and puts this in the -classpath used to start WebLogic. That way, it
(the Apache SOAP web app) will be able to find them. I don't put the jar for the
EJB in the -classpath, though. To be honest, I don't use Apache SOAP because it
doesn't support WSDL yet ;-)
Regards,
Mike Wooten
"ts" <[email protected]> wrote:
Hi Mike,
Cheers for the response. I've read the documentation you've linked to
and I
understand how WLS performs class loading.
However, the documentation implies that I could either;
A) Package the SOAP war file together with my EJB jar file in an EAR
file
and deploy, and the SOAP web app would subsequently be able to reference
classes/beans. (Ref: "Although you could deploy the .war and .jar files
separately, deploying them together in an .ear file produces a classloader
arrangement that allows the servlets and JSPs to find the EJB classes.")
B) Simply place my EJB jar file in the WEB-INF\lib subdirectory of the
deployed SOAP web app. (Ref: J2EE specification).
In fact, neither of these work, and I am forced to include the EJB jar
in
the server's classpath.
Surely theres some kind of problem here?
Cheers,
Trev
"Michael Wooten" <[email protected]> wrote in message
news:[email protected]...
Hi Trev,
Technically, this is not so much an issue with the classloader(s) inWLS,
as it
is with J2EE packaging. WLS uses a pretty sophisticated, hierarchicalclass loading
architecture. The main reason for using this approach, was to supportundeploying/redeploying
J2EE components (i.e. Servlets, EJBs) without shutting down the JVM.
What you are encountering is a phenomena where Apache SOAP is deployedas
a Web
Application, with it's own ServletContext and classloader.
See the following links for specifics on class loading and J2EE packagingin WLS:
http://e-docs.bea.com/wls/docs60/programming/packaging.html#1048725
After reading this, you will see why the classloader associated withthe
Apache
SOAP web app, cannot see the classes (i.e. serializer, EJBs, etc.)you are
using
to implement your web service.
Regards,
Mike Wooten
"ts" <[email protected]> wrote:
Hi,
Has anyone managed to get Apache SOAP working with Weblogic 6x?
I can get everything up and running, but for some reason the classloader
for the web application (ie; the actual Apache SOAP app) doesn't load
the
classes in my jar file containing the EJB files, serializers, etc.
Therefore whenever I make a SOAP request I get a server side error
reported
via SOAP that some class or another (one of my own ones) cannot befound.
I can cure this by sticking my jar file in the server's classpath-
however
this isn't great as it means the JVM's classloader is picking everything
up
and I lose the ability to redeploy.
Any ideas? In the absence of any other information it would seem that
Weblogic's classloaders are buggy...
Cheers,
Trev

Tomcat & Apache Soap Installation

I have install the Tomcat successfully and also install the Apache Soap.
But when I tried to do the test (from: http://xml.apache.org/soap/docs/index.html):
Point my browser to:
http://localhost:port/soap/servlet/rpcrouter
there is no expected answer like following appears:
The browser should display the following:
SOAP (RPC|Message) Router
Sorry, I don't speak via HTTP GET- you have to use HTTP POST to talk to me.
the brower only says it cannot find the webpage!
does anyone know the reason? your help is appreciated in advance now!!
Gang

This may be due to the classpath problem. xerces.jar should be first in the classpath. Otherwise for xml related files tomcat goes to jaxp.jar
U read the following document. It'll help u a lot in installing apache soap.
http://www.javaworld.com/javaworld/jw-04-2001/jw-0427-soap.html
-seenu_ch

Apache soap and java

Hi I wanted to know which websites have Apache SOAP webservices which we can write a client for in java and implement

First, it shouldn't matter whether they're running apache or not - that's the point of web services. Second, IBM and Microsoft have UDDI sites that list various web services. One public one I know of is google's. Is this for school?

Apache SOAP 2.2 and WL 6.1

When trying to use Apache SOAP 2.2 with WL Server 6.1, I get the following error
when attempting a call.invoke():
"Unable to resolve namespace 'SOAPSDK3'"
I can successfully make the SOAP call using a stand-alone application (not inside
weblogic). I found the following FAQ which described the same problem for WL
Server 6.1 (beta):
http://xml.apache.org/soap/faq/faq-for-WL6.1beta.html
I have not been able to get a working solution though. The XML Registry was already
setup as described, using the org.apache.xerces.*. I also put xerces.jar in front
of weblogic.jar in the WL Classpath (not sure if this would have any effect).
Originally, I had put XERCES 1.3.1 there and had no problem starting WL, but
got the same error as before - Unable to resolve namespace 'SOAPSDK3'. When I
placed another version of XERCES, namely 1.4.3 - I could not even start WL properly,
it crapped out with a memory exception and quit the JVM. I read on WL docs that
XERCES 1.3.1 is required and you cannot put another version in front of the weblogic.jar,
otherwise you have problems (they were right on that one). Here are the WL docs:
http://e-docs.bea.com/wls/docs61/faq/xml.html
So, I'd be interested to see if you anyone has suggestion as to what I might try.
It appears that I MUST use XERCES 1.3.1, but when I put the in front of weblogic.jar
I don't solve the problem. If you know of anything I might try, please let me
know. Thanks.
Configuration:
WL 6.1 on Windows 2000 - application inside EAR file.
SOAP Client - Apache SOAP 2.2
SOAP Server - MS SOAP Toolkit (ISAPI - VB dll)
Christopher Hurley
Tallán, Inc.
[email protected]
cell 201.739.2194

Don't know whether below is related to your problem:
https://discussions.apple.com/thread/4831752?tstart=0

Interoperability between apache soap toolkit(client)and ms soap toolkit

Interoperability between apache soap toolkit(client)and ms soap toolkit.Give me an example where i can send and receive a complex data type from apache tomcat in client side to ms soap toolkit on the server side.It is urgent.Plz try to give me a solution as soon as possible.

The toolkits don't have to work together at all. And by the way, you aren't sending the data to the MS toolkit, you're sending it to some MS product that can process the data. Any data that follows the standards should work.

Apache Soap and Sessions?

Hey there,
how can I use Sessions (Session ID in HTTP-Headers or Cookies) in Apache Soap? Have you an example?
Thanks
TW

Please read
http://www.ics.uci.edu/~fielding/talks/webarch_9805/
Although you can't quite always achieve that sort of composability and resilience easily with SOAP, you can learn a little from the principles.
The basic idea of SOAP is that provides a common envelope for some information being exchanged, allowing some degree of delegation and service composition.
For SOAP to work in the intended manner, all the information to achieve any effect is placed inside the message envelope. This allows the SOAP message to be transport agnostic- for example part of the message chain may be http; another may be a direct call between SAX filters.
Putting additional stateful behaviour into one component of such a system, in a manner that is opaque to all the other components, is a really bad idea-you have to add the additional behaviour to all points in between, and lose any benifit you would get from SOAP.
Pete

OC4J and Oracle9i and user defined datatypes over SOAP.

Does OC4J and Oracle9i, that comes with JDeveloper9i-rc, support user defined datatypes over SOAP?
If I invoke the EJB over RMI it is working fine.
But if I try to invoke it over SOAP I get this fault:
500 Internal Server Error: Servlet error: Error building response envelope: java.lang.IllegalArgumentException: No Serializer found to serialize a 'mypackage.myObj' using encoding style 'http://schemas.xmlsoap.org/soap/encoding/'.
I have written the Deployment descripter like this:
<?xml version = '1.0'?>
<isd:service
id="urn:mypackage.EJB2"
type="rpc"
xmlns:isd=" " target="_new">http://xmlns.oracle.com/soap/2001/04/deploy/service"> <isd:provider
id="stateless-ejb-provider"
methods="getData"
scope="Request">
<isd:option key="JNDILocation" value="EJB2"/>
<isd:option key="DeploymentName" value="EJB2"/>
</isd:provider>
<isd:faultListener class="org.apache.soap.server.DOMFaultListener"/>
<isd:mappings>
<isd:map
encodingStyle="http://schemas.xmlsoap.org/soap/encoding" xmlns:x="http://glo2158" qname="x:mypackage.myObj"
javaType="mypackage.myObj"
java2XMLClassName="org.apache.soap.encoding.soapenc.BeanSerializer"
xml2JavaClassName="org.apache.soap.encoding.soapenc.BeanSerializer"/>
</isd:mappings>
</isd:service>

AFAIK this is not possible with the Oracle 8i implementation. This is my main gripe about Oracle's so called objects - you can't define your own constructors, you can't put check constraints on them and you can't use them in triggers.
In other words you can put any old scheisse in an object and you can't populate them with derived or default values.
I'm on a 9i New Features course as I type and I'm hoping to hear that Oracle have added some features to objects that will make them worth using.
regards, APC

What is the diffrence between a javabean and EJB

hi!
what is the diffrence between a javabean and entreprise jvaabeans! i mean which are the uitilization featires of eaxh one !

i am seeking for a solution for my problem , in fact i ma trying to implement and develop an application with java that allows a certain range of IP adresses to be connected to a database server in order to extract the suitable data from the server .
let me explain mor ethe suitation , in fact what i am loking for is to use javabeans to grant my application much more consistence and pertinence : si i am asking if it could be possible to use javabeans in my case especially if i am not trying to developp a web application but a cleint /server one allowing some services.
The application is in fact dealing with a stock exchange market and what i am trying to do is to grant particilar registrated customers to have the informations that they need ( portofolio, currency's status, market indicators, .) also drawing some charts decribing rates, variations, and others specefic financial caracterestics .So , if we consider that this application is not a web application ( no HTTP request and no servers like apache or others ) how it is possible to use javabeans and not EJB to build the application? i mean what could be suitable and preferable to rely on and dvelop to ensure a good java application !!
if you need more details to help you find the answer for me don't hesitate to answer me back !!
Someone here gave me that answer
use RMI to code the services and (Updateable) Value Objects to pass the information between tiers.
RMI is an all-java distributed component framework (ie. EJB, CORBA, DCE/RPC, DCOM, etc.), that is very suitable for developing non-containerized multi-tier applications. Refer to the RMI trail in the Java Tutorial as a starting point for coding RMI solutions (http://java.sun.com/docs/books/tutorial/index.html). Under this scenario you would code the database access service as an RMI service (server-side). Client/server communication should be facilitated through the use of JavaBeans/classes that wrap the information being passed (customer information, portfolio details, market information, etc.) - these are refered to as 'Updateable Value Objects' (a design pattern). Graphing and charting would be handled in your client from the information received from the (RMI) server. GUI JavaBeans can be used to provide this functionality as well as other client-side services. There are numerous "shrink-wrapped" components for GUIs available on the market just peruse any Java magazine to find them.
but how comes? how can i do it !! and where can i find more information please about 'Updateable Value Object "
thanks

How to get ADF authentication and authorization working on server

I am having an issue with deployment & ADF authentication and authorization.
From the below testing results, you can see that I am unable to log in when I have deployed my app to my standalone server with both ADF security authentication and authorization turned on. I have included web.xml, jazn-data.xml and the page/server error I am receiving.
When making an attempt to log in I get the following results:
Running Locally with ADF Authentication:                                           Works Fine
Running Locally with ADF Authentication & Authorization:         Works Fine
Deployed to server with ADF Authentication:                                    Works Fine
Deployed to server with ADF Authentication & Authorization: Doesn’t Work
What I have already tried: Removed all anonymous grants, using the same database credentials as the app user, deploying app twice (on the redeploy not including the login credentials & app policies at the application properties). Various modifications to web.xml e.g. welcomefilelist etc
JDeveloper Version: 11.1.2.4
Server Web Logic: 10.3.6
Server ADF: 11.1.1.16
Page Error when trying to log in:
Error 401--Unauthorized
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
10.4.2 401 Unauthorized
The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.46) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity MAY include relevant diagnostic information. HTTP access authentication is explained in section 11.
Server error when trying to log in:
Servlet failed with Exception oracle.adf.controller.security.AuthorizationException: ADFC-0619: Authorization check failed: 'wpd.mobility.view.pageDefs.homePagePageDef' 'VIEW'.
at oracle.adf.controller.internal.security.AuthorizationEnforcer.handleFailure(AuthorizationEnforcer.java:182)
        at oracle.adf.controller.internal.security.AuthorizationEnforcer.internalCheckPermission(AuthorizationEnforcer.java:162)
        at oracle.adf.controller.internal.security.AuthorizationEnforcer.checkPermission(AuthorizationEnforcer.java:116)
        at oracle.adfinternal.controller.state.ControllerState.checkPermission(ControllerState.java:663)
        at oracle.adfinternal.controller.state.ControllerState.initializeUrl(ControllerState.java:700)
        at oracle.adfinternal.controller.state.ControllerState.synchronizeStatePart2(ControllerState.java:531)
        at oracle.adfinternal.controller.application.SyncNavigationStateListener.afterPhase(SyncNavigationStateListener.java:59)
        at oracle.adfinternal.controller.lifecycle.ADFLifecycleImpl$PagePhaseListenerWrapper.afterPhase(ADFLifecycleImpl.java:530)
        at oracle.adfinternal.controller.lifecycle.LifecycleImpl.internalDispatchAfterEvent(LifecycleImpl.java:120)
        at oracle.adfinternal.controller.lifecycle.LifecycleImpl.dispatchAfterPagePhaseEvent(LifecycleImpl.java:168)
        at oracle.adfinternal.controller.faces.lifecycle.ADFPhaseListener$PhaseInvokerImpl.dispatchAfterPagePhaseEvent(ADFPhaseListener.java:131)
        at oracle.adfinternal.controller.faces.lifecycle.ADFPhaseListener.afterPhase(ADFPhaseListener.java:74)
        at oracle.adfinternal.controller.faces.lifecycle.ADFLifecyclePhaseListener.afterPhase(ADFLifecyclePhaseListener.java:53)
        at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._executePhase(LifecycleImpl.java:447)
        at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:202)
        at javax.faces.webapp.FacesServlet.service(FacesServlet.java:508)
        at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
        at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
        at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
        at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
        at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
        at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:205)
        at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
        at oracle.adfinternal.view.faces.webapp.rich.RegistrationFilter.doFilter(RegistrationFilter.java:125)
        at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
        at oracle.adfinternal.view.faces.activedata.AdsFilter.doFilter(AdsFilter.java:60)
        at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
        at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl._doFilterImpl(TrinidadFilterImpl.java:293)
        at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl.doFilter(TrinidadFilterImpl.java:199)
        at org.apache.myfaces.trinidad.webapp.TrinidadFilter.doFilter(TrinidadFilter.java:92)
        at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
        at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
        at java.security.AccessController.doPrivileged(Native Method)
        at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
        at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
        at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
        at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
        at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
        at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
        at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
        at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
        at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
        at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
        at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
        at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
        at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
        at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
        at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
        at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
        at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
Web.xml
<?xml version = '1.0' encoding = 'windows-1252'?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
         version="2.5">
<context-param>
    <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
    <param-value>client</param-value>
</context-param>
<context-param>
    <param-name>javax.faces.PARTIAL_STATE_SAVING</param-name>
    <param-value>false</param-value>
</context-param>
<context-param>
    <description>If this parameter is true, there will be an automatic check of the modification date of your JSPs, and saved state will be discarded when JSP's change. It will also automatically check if your skinning css files have changed without you having to restart the server. This makes development easier, but adds overhead. For this reason this parameter should be set to false when your application is deployed.</description>
    <param-name>org.apache.myfaces.trinidad.CHECK_FILE_MODIFICATION</param-name>
    <param-value>false</param-value>
</context-param>
<context-param>
    <description>Whether the 'Generated by...' comment at the bottom of ADF Faces HTML pages should contain version number information.</description>
    <param-name>oracle.adf.view.rich.versionString.HIDDEN</param-name>
    <param-value>false</param-value>
</context-param>
<context-param>
    <description>Security precaution to prevent clickjacking: bust frames if the ancestor window domain(protocol, host, and port) and the frame domain are different. Another options for this parameter are always and never.</description>
    <param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
    <param-value>differentOrigin</param-value>
</context-param>
<context-param>
    <param-name>javax.faces.FACELETS_SKIP_XML_INSTRUCTIONS</param-name>
    <param-value>true</param-value>
</context-param>
<context-param>
    <param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>
    <param-value>true</param-value>
</context-param>
<context-param>
    <param-name>javax.faces.FACELETS_DECORATORS</param-name>
    <param-value>oracle.adfinternal.view.faces.facelets.rich.AdfTagDecorator</param-value>
</context-param>
<context-param>
    <param-name>javax.faces.FACELETS_RESOURCE_RESOLVER</param-name>
    <param-value>oracle.adfinternal.view.faces.facelets.rich.AdfFaceletsResourceResolver</param-value>
</context-param>
<filter>
    <filter-name>JpsFilter</filter-name>
    <filter-class>oracle.security.jps.ee.http.JpsFilter</filter-class>
</filter>
<filter>
    <filter-name>trinidad</filter-name>
    <filter-class>org.apache.myfaces.trinidad.webapp.TrinidadFilter</filter-class>
</filter>
<filter>
    <filter-name>adfBindings</filter-name>
    <filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>JpsFilter</filter-name>
    <url-pattern>/*</url-pattern>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>INCLUDE</dispatcher>
</filter-mapping>
<filter-mapping>
    <filter-name>trinidad</filter-name>
    <servlet-name>Faces Servlet</servlet-name>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
    <dispatcher>ERROR</dispatcher>
</filter-mapping>
<filter-mapping>
    <filter-name>adfBindings</filter-name>
    <servlet-name>Faces Servlet</servlet-name>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>
<filter-mapping>
    <filter-name>adfBindings</filter-name>
    <servlet-name>adfAuthentication</servlet-name>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>REQUEST</dispatcher>
</filter-mapping>
<listener>
    <listener-class>oracle.adf.mbean.share.connection.ADFConnectionLifeCycleCallBack</listener-class>
</listener>
<listener>
    <listener-class>oracle.adf.mbean.share.config.ADFConfigLifeCycleCallBack</listener-class>
</listener>
<listener>
    <listener-class>oracle.bc4j.mbean.BC4JConfigLifeCycleCallBack</listener-class>
</listener>
<servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet>
    <servlet-name>resources</servlet-name>
    <servlet-class>org.apache.myfaces.trinidad.webapp.ResourceServlet</servlet-class>
</servlet>
<servlet>
    <servlet-name>BIGRAPHSERVLET</servlet-name>
    <servlet-class>oracle.adf.view.faces.bi.webapp.GraphServlet</servlet-class>
</servlet>
<servlet>
    <servlet-name>BIGAUGESERVLET</servlet-name>
    <servlet-class>oracle.adf.view.faces.bi.webapp.GaugeServlet</servlet-class>
</servlet>
<servlet>
    <servlet-name>MapProxyServlet</servlet-name>
    <servlet-class>oracle.adf.view.faces.bi.webapp.MapProxyServlet</servlet-class>
</servlet>
<servlet>
    <servlet-name>adfAuthentication</servlet-name>
    <servlet-class>oracle.adf.share.security.authentication.AuthenticationServlet</servlet-class>
    <init-param>
      <param-name>success_url</param-name>
      <param-value>/faces/Pages/homePage.jspx</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>resources</servlet-name>
    <url-pattern>/adf/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>resources</servlet-name>
    <url-pattern>/afr/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>BIGRAPHSERVLET</servlet-name>
    <url-pattern>/servlet/GraphServlet/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>BIGAUGESERVLET</servlet-name>
    <url-pattern>/servlet/GaugeServlet/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>MapProxyServlet</servlet-name>
    <url-pattern>/mapproxy/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>resources</servlet-name>
    <url-pattern>/bi/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
    <servlet-name>adfAuthentication</servlet-name>
    <url-pattern>/adfAuthentication</url-pattern>
</servlet-mapping>
<mime-mapping>
    <extension>swf</extension>
    <mime-type>application/x-shockwave-flash</mime-type>
</mime-mapping>
<mime-mapping>
    <extension>amf</extension>
    <mime-type>application/x-amf</mime-type>
</mime-mapping>
<security-constraint>
    <web-resource-collection>
      <web-resource-name>test</web-resource-name>
      <url-pattern>/faces/pages/*.</url-pattern>
      <url-pattern>/faces/*.</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>valid-users</role-name>
    </auth-constraint>
</security-constraint>
<security-constraint>
    <web-resource-collection>
      <web-resource-name>adfAuthentication</web-resource-name>
      <url-pattern>/adfAuthentication</url-pattern>
    </web-resource-collection>
    <auth-constraint>
      <role-name>valid-users</role-name>
    </auth-constraint>
</security-constraint>
<login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
      <form-login-page>/login.html</form-login-page>
      <form-error-page>/error.html</form-error-page>
    </form-login-config>
</login-config>
<security-role>
    <role-name>valid-users</role-name>
</security-role>
</web-app>
Jazn-data.xml
<?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?>
<jazn-data xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/jazn-data.xsd">
<jazn-realm default="jazn.com">
    <realm>
      <name>jazn.com</name>
      <users>
        <user>
          <name>*****</name>
          <display-name>*******</display-name>
          <description>******</description>
          <credentials>********<credentials>
        </user>
      </users>
      <roles>
        <role>
          <name>support</name>
          <display-name>support</display-name>
          <members>
            <member>
              <type>user</type>
              <name>mobile</name>
            </member>
          </members>
        </role>
      </roles>
    </realm>
</jazn-realm>
<policy-store>
    <applications>
      <application>
        <name> myapp </name>
        <app-roles>
          <app-role>
            <name>mob_mobile_support</name>
            <class>oracle.security.jps.service.policystore.ApplicationRole</class>
            <display-name>mob_mobile_support</display-name>
            <description>support role</description>
            <members>
              <member>
                <name>mobile</name>
                <class>oracle.security.jps.internal.core.principals.JpsXmlUserImpl</class>
              </member>
            </members>
          </app-role>
        </app-roles>
        <jazn-policy>
          <grant>
            <grantee>
              <principals>
                <principal>
                  <name>SUPPORT</name>
                  <class>oracle.security.jps.internal.core.principals.JpsXmlEnterpriseRoleImpl</class>
                </principal>
              </principals>
            </grantee>
            <permissions>
              <permission>
                <class>oracle.adf.share.security.authorization.RegionPermission</class>
                <name> myapp.view.pageDefs.*</name>
                <actions>view</actions>
              </permission>
            </permissions>
          </grant>
          <grant>
            <grantee>
              <principals>
                <principal>
                  <name>mob_mobile_support</name>
                  <class>oracle.security.jps.service.policystore.ApplicationRole</class>
                </principal>
              </principals>
            </grantee>
            <permissions>
              <permission>
                <class>oracle.adf.share.security.authorization.RegionPermission</class>
                <name> myapp.view.pageDefs.addapplicationPageDef</name>
                <actions>view</actions>
              </permission>
              <permission>
                <class>oracle.adf.share.security.authorization.RegionPermission</class>
                <name>Pages.addappmsgtypPageDef</name>
                <actions>view</actions>
              </permission>
              <permission>
                <class>oracle.adf.share.security.authorization.RegionPermission</class>
                <name>Pages.addoperationPageDef</name>
                <actions>view</actions>
              </permission>
              <permission>
                <class>oracle.adf.share.security.authorization.RegionPermission</class>
                <name> myapp.view.pageDefs.homePagePageDef</name>
                <actions>view</actions>
              </permission>
              <permission>
                <class>oracle.adf.share.security.authorization.RegionPermission</class>
                <name> myapp.view.pageDefs.loggingSearchPageDef</name>
                <actions>view</actions>
              </permission>
              <permission>
                <class>oracle.adf.share.security.authorization.RegionPermission</class>
                <name>myapp.view.pageDefs.workHistoryPageDef</name>
                <actions>view</actions>
              </permission>
            </permissions>
          </grant>
        </jazn-policy>
      </application>
    </applications>
</policy-store>
</jazn-data>

Read Frank's article http://www.oracle.com/technetwork/issue-archive/2012/12-jan/o12adf-1364748.html
Then you have to check if the user use use to login are defined in the stand alone server. If you server is running in production mode there is no automatic user or role migration. You have to to this by yourself.
Once you have check that the users are present, you have to check if the enterprise roles are mapped to the corresponding application roles.
Timo

Authentication and Authorization question.

Hi All,
I require your help in getting validated my understanding on Authentication and Authorization. This is wrt to WebLogic Server and WebLogic Portal.
Authentication.
1. The custom authentication provider can authenticate(user and group) against any datastore(LDAP OR DB). The LoginModule is a kind of blockbox and it can return true/false depending on authentication.
2. The end result of this process is true/false.
Authorization.
1. The custom authorization providers can authorize the authenticated user based on role. All these entities ie(user,group,role) can be either in LDAP OR DB.
2. The end result of this process is true/false.
Role mapping.
1. The custom role mapper can put all the roles that a user belongs and returns all Role. This can happen agaist LDAP OR DB.
2. The end result is list of roles for a user.
Security policy configuration.
Is it mandatory that a user/group/role should be existing in WebLogic Server LDAP server(OR Portal LDAP server) to create these policies and authorization rules. What i mean by is that can user,group,role can exist in application specific database and still can be used for creatiing security policies??
Thanks,
Prashanth Bhat.

The Security Providers are useful/can be used for developing a standard j2ee application , which will be deployed as standard j2ee application.
The DA means Delegated Administrator, which is way how portal components are restricted to different types of administrators.
The VE means Visitor Entitlemens, which is way how portal components are restricted to end users.
My question is whether thess(DAs and VEs) can also be put
our datastore for access rights??
Thanks,
Prashanth Bhat.

Invocation of SOAP Sender Adapter using Apache SOAP

Hi,
I'm trying to invoke the XI SOAP Sender Adapter using the Apache SOAP API. It seems that my message header is missing a few parameters (see exception below). Does anybody know which to set?
Regards,
Heiko
==========
Exception:
<?xml version='1.0'?>

<SOAP:Envelope xmlns:SOAP='http://schemas.xmlsoap.org/soap/envelope/'>
<SOAP:Body>
    <SOAP:Fault>
      <faultcode>SOAP:Server</faultcode>
      <faultstring>Server Error</faultstring>
      <detail>
        <s:SystemError xmlns:s='http://sap.com/xi/WebService/xi2.0'>
          <context>XIAdapter</context>
          <code>Exception</code>
          <text><![CDATA[
com.sap.aii.af.mp.module.ModuleException
     at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:502)
     at com.sap.aii.af.mp.module.ModuleLocalLocalObjectImpl3.process(ModuleLocalLocalObjectImpl3.java:103)
     at com.sap.aii.af.mp.ejb.ModuleProcessorBean.process(ModuleProcessorBean.java:227)
     at com.sap.aii.af.mp.processor.ModuleProcessorLocalLocalObjectImpl0.process(ModuleProcessorLocalLocalObjectImpl0.java:103)
     at com.sap.aii.af.mp.soap.web.MessageServlet.callModuleProcessor(MessageServlet.java:162)
     at com.sap.aii.af.mp.soap.web.MessageServlet.doPost(MessageServlet.java:507)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:392)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:345)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:323)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:865)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:240)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:92)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:148)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:37)
     at com.sap.engine.core.cluster.impl6.session.UnorderedChannel$MessageRunner.run(UnorderedChannel.java:71)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged1(Native Method)
     at java.security.AccessController.doPrivileged(AccessController.java:321)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:95)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:159)
Caused by: java.lang.Exception: Bubble configuration error: parameter 'XI.InterfaceNamespace' is missing
     at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.getParaRequired(XISOAPAdapterBean.java:895)
     at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.createDefaultMessageHeader(XISOAPAdapterBean.java:942)
     at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.setup(XISOAPAdapterBean.java:214)
     at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:496)
     ... 22 more
          ]]></text>
        </s:SystemError>
      </detail>
    </SOAP:Fault>
</SOAP:Body>
</SOAP:Envelope>

Hi Heiko,
You are missing the Namespace Parameter in the sender soap adapter configuration in XI3.0
Thanks
Prasad

Linkage Error when using Apache SOAP 2.2 with Weblogic 6.1

Has anyone seen this error before? Apparently I've got some incompatible versions of xerces being loaded. I tried putting different versions of xerces.jar in the front of my classpath, and creating an XML Registry to point to org.apache.xerces.jaxp..., but I always get the same error message.
D:\soap>java -classpath "/soap-2_2/lib/soap.jar;activation.jar;mail.jar;xerces.jar;." org.apache.soap.server.Servic
eManagerClient http://localhost:8001/App/servlet/rpcrouter list
Ouch, the call failed:
Fault Code = SOAP-ENV:Server.Exception:
Fault String = loader constraints violated when linking org/xml/sax/InputSource class

Has anyone seen this error before? Apparently I've got some incompatible versions of xerces being loaded. I tried putting different versions of xerces.jar in the front of my classpath, and creating an XML Registry to point to org.apache.xerces.jaxp..., but I always get the same error message.
D:\soap>java -classpath "/soap-2_2/lib/soap.jar;activation.jar;mail.jar;xerces.jar;." org.apache.soap.server.Servic
eManagerClient http://localhost:8001/App/servlet/rpcrouter list
Ouch, the call failed:
Fault Code = SOAP-ENV:Server.Exception:
Fault String = loader constraints violated when linking org/xml/sax/InputSource class

Value type and 500 Internal Server Error (SOAP)

Hi,
I'm try to generate, by jdeveloper10g, an Oracle J2EE WebService, on an Oracle Application Server 10g.
One method that i want to publish as web service should return a class, DBVarWS, created by me. This class has a public default constructor, every private fields has its get and set methods, and so on. Jdeveloper creates and deploys the WS without problem. The other methods of the ws work, but this one generate an Error 500:
java.lang.StackOverflowError
     at org.apache.soap.util.xml.XMLJavaMappingRegistry.queryElementType_(XMLJavaMappingRegistry.java:220)
     at org.apache.soap.encoding.SOAPMappingRegistry.queryElementType_(SOAPMappingRegistry.java:593)
     at org.apache.soap.util.xml.XMLJavaMappingRegistry.queryElementType(XMLJavaMappingRegistry.java:235)
     at org.apache.soap.encoding.soapenc.SoapEncUtils.generateStructureHeader(SoapEncUtils.java:130)
     at org.apache.soap.encoding.soapenc.SoapEncUtils.generateStructureHeader(SoapEncUtils.java:117)
     at org.apache.soap.encoding.soapenc.BeanSerializer.marshall(BeanSerializer.java:88)
     at org.apache.soap.encoding.soapenc.ParameterSerializer.marshall(ParameterSerializer.java:108)
     at org.apache.soap.util.xml.XMLJavaMappingRegistry.marshall(XMLJavaMappingRegistry.java:292)
     at org.apache.soap.encoding.soapenc.BeanSerializer.marshall(BeanSerializer.java:133)
     at org.apache.soap.encoding.soapenc.ParameterSerializer.marshall(ParameterSerializer.java:108)
     at org.apache.soap.util.xml.XMLJavaMappingRegistry.marshall(XMLJavaMappingRegistry.java:292)
     at org.apache.soap.encoding.soapenc.BeanSerializer.marshall(BeanSerializer.java:133)
     at org.apache.soap.encoding.soapenc.ParameterSerializer.marshall(ParameterSerializer.java:108)
     at org.apache.soap.util.xml.XMLJavaMappingRegistry.marshall(XMLJavaMappingRegistry.java:292)
     at org.apache.soap.encoding.soapenc.BeanSerializer.marshall(BeanSerializer.java:133)
     ...and fade out, the same lines for 12 pages..
Does anybody see where is my mistake??
Below i copy the source code of the class that (i suppose) generates the problem..
thanks a lot
Mauro
DBVarWS.java
package ims.gui.dbConnectionWStoPublish;
* <code>DBVar</code> contains the data you need to identify and retreive a
* monitorable variable from the database of IMS.
* When you log in the IMS, the application retreive a list of monitorable variable,
* and store a DBVar object for every monitorable var.
* DBVar does not contain the value of the variable: it is used to make the request
* to the database to retreive that value(s).
public class DBVarWS
private String name;
private String session;
private int ta;
private int instance;
private String type;
private String[] token;//"where" "time_ins" ">" etc
//the var is been selected by the user?
private boolean selected;
* Creates a DBVar with the specified name
* @param _name Name of the variable
public DBVarWS(String _name)
name=_name;
selected=false;
token=new String[20];
for(int i=0;i<20;i++) token=null;
public DBVarWS()
token=new String[20];
* Creates a DBVar with the specified name,session,ta,instance and type
* @param _name Name of the variable
* @param _session Session of the varible
* @param _ta Target Address of the variable
* @param _type Datatype of the the variable value: integer, double, etc
public DBVarWS(String name,String session, int ta, int instance, String _type)
name=_name;
session=_session;
ta=_ta;
instance=_instance;
type=_type;
selected=false;
token=new String[20];
for(int i=0;i<20;i++) token[i]=null;
* Return this DBVar object
public DBVarWS getDBVar()
return this;
* Return the DBVar name
* @webmethod
public String getName()
return name;
* Return the DBVar session
* @webmethod
public String getSession()
return session;
* Return the DBVar target address
* @webmethod
public int getTa()
return ta;
* Return the DBVar instance
* @webmethod
public int getInstance()
return instance;
* Return the DBVar value type
* @webmethod
public String getType()
return type;
* Return the DBVar selected flag
* @webmethod
public boolean getSelected()
return selected;
* @webmethod
public String[] getToken()
return token;
* Set the name of the DBVar
* @webmethod
public void setName(String _name)
name=_name;
System.out.println("name = "+_name);
* Set the name of the DBVar
* @webmethod
public void setSession(String _s) { session=_s; }
* Set the targeta address of the DBVar
* @webmethod
public void setTa(int _ta) { ta=_ta; }
* Set the instance of the DBVar
* @webmethod
public void setInstance(int _inst) { instance=_inst; }
* Set the type of the DBVar value
* @webmethod
public void setType(String _type) { type=_type; }
* Set the selected flag of the DBVar.
* Selected is true when the DBVar has been selected by the user
* to be retreived from the database
* @webmethod
public void setSelected(boolean _c) { selected=_c; }
* @webmethod
public void setToken(String[] _token)
token=_token;

Ok the problem is solved, it was about webutil, I had a problem of path and concerning jacob.jar in the configuration files default.env of midtier
If this can help someone
Christophe

Authentication and EJB Providers in Apache SOAP 2.0

Similar Messages

Maybe you are looking for