Authentication with credentials from another domain?

I've got an Apex app that I've built for a volunteer organization, and they have a non-Apex app built by another volunteer -- they are hosted on two different servers, two different domains.
Any hints/tips/ideas ideas on how to (securely) pass credentials from the non-Apex app to the Apex app so Apex is 'automatically authenticated'. I can easily pass the credentials in the URL (yuck) and add a before header process to manipulate the passed credentials and initiate the login process, or customize the authentication -- but I'm having a brain-freeze on how to do it securely.
Any suggestions?

thanks for the replies
scott -- name added to profile
the same user base uses both apps, so the same username (account name) will be registered in both apps-- the username is first assigned in the non-apex app, then manually added to the apex app
if the linking app needs to know the apex password, it will be up to the user to keep the passwords sync'd -- each app (apex and non-apex) has its own credentials store (nothing in common other than the internet)
yes, 'something' during the non-apex app's authentication needs to notify the apex app -- but that authentication is happening on noaccesstotheapexoracleserver.com, so it will need to pass some credentials in order to reliably inform the apex app that it has authenticated the user, or to insert a row in the database that apex is using -- and the only way it can get to that oracle database is through apex -- so it must pass credentials to apex in order to store credentials in the oracle database. or send them through a public page, which would then require some sort of hand-shaking between the apps
so, that's why i'm thinking of a home-grown 'trusted host' type of solution... something like:
<ol>
<li>Non-apex sends session request to apex, passing username and unique session request id
<li>Apex records request id, generates a unique response id, and sends both back to the non-apex app (using a predefined URL, not based on anything from the request -- i.e., it already knows who it should send the response to and can't be tricked to send a response to a spoofing app)
<li>Non-apex app verifies the response against its request record, than sends request id and response id back to Apex app
<li>Apes verifies the request/response pair, and authenticates the user based on the username (account name) passed with the original request.
</ol>
but, before i build this, i'm just wondering if there's something already out there -- and if i do take this approach, where are the holes that i might not be seeing

Similar Messages

Is it advisable or practical to run SQL Agent with Account from another domain?

A SQL Server in domain A needs to mount databases downloaded on a weekly basis to a second SQL Server, in domain B.
Right now, the two domains, which were deliberately separated for security, have no trust.
Currently, a manager of the server in domain A uses credentials in domain B to logon to domain B and do a file copy of the databases, which he then mounts on the server in domain A.
Having noticed that the best way to place a copy of a database onto a remote server is via SQL backup, as opposed to a file copy, because it is five times faster, and suspecting that a SQL restoration
operation might be as much faster than the current file copy from domain B to A, the idea has been floated that the SQL Agent in domain A could schedule a restoration from databases residing on the hard drive of the server in domain B.
Can credentials of an account in domain B be used to drive the SQL Agent on the server in domain A, and if so, does this require the establishment of a trust? I suspect that it would, although
once a user of the server in domain A establishes a connection to a file share in domain those credentials are cached for future use.
Would using an account in domain B to logon the SQL Agent in domain A -- with or without a trust -- cause all the jobs in domain A to fail on the grounds of missing permissions?

Thank you for your prompt reply.
The FTP download seems technically feasible. But, I think, the FTP transfer would not provide the speed our organization has been looking for. We are making do with 100Mbps where we actually
need 1Gbps.
The SSIS proposal is not feasible because a trust between the two domains would not be allowed. In any event, if it were a straight file copy, not a SQL backup, we would not obtain the speed
we seek. You mention, in this context, a 'file copy.' Is this a simple copy from an arbitrary TCP port on Server B to port 445 on server A, or is it a different type of copy, such as that used when a SQL runs a backup job to a network destination?
What do you think of this: in domain B, where the files reside, use the proxy account to run a backup job to the server in domain A. That would give us the speed we need. But that would also
require a trust, wouldn't it? Is there any way to get around the need for the trust? If the backup job could run from server in domain B to the server in domain A, another job could be setup on server in domain A to complete the restore.
When I create the SQL Proxy, do I supply the name of the account in the trusting domain? When I look at the dialog for the creation of the "new proxy account" on a server without trust
connections, I am offered only two GUIDs as candidate proxies. Would that change once I create the trust, and would I be allowed to browse accounts in the trusting domain?
Are you familiar with the dramatic advantage taht a SQL backup job holds over a copy of files from point A to point B? It's something like ten times faster.
Yours,
Bob Hindla.

Issue using ADSI in powershell to load users from another domain into a group

I am trying to load users into a domain local security group from another domain using ADSI and powershell. For users who have an existing foreign security principal I can load that without issue, but the users who do not have a foreign security principal
I am unable to load.
These work fine, assuming the group domain is fabrikam:
$Group.psbase.invoke("Add",[ADSI]"LDAP://CN=$external_user_sid_who_has_a_FPN,CN=ForeignSecurityPrincipals,DC=fabrikam,DC=com")
$Group.psbase.invoke("Add",[ADSI]"LDAP://$userDN,DC=fabrikam,DC=com")
These does not:
$Group.psbase.invoke("Add",[ADSI]"LDAP://CN=$externaluser_sid_who_does_not_have_a_FPN,CN=ForeignSecurityPrincipals,DC=fabrikam,DC=com")
$Group.psbase.invoke("Add",[ADSI]"LDAP://<SID=$external_user_sid_who_does_not_have_a_FPN>")
$Group.psbase.invoke("Add",[ADSI]"LDAP://<SID=$external_user_hex_sid_who_does_not_have_a_FPN>")
Any help would be greatly appreciated.
Thank you

Thank you for your reply,
I started with that thread and it ultimately recommends using the [ADSI]"LDAP://<SID=$hexsid>, this bind is not working for me. The page it points to for conversion of sid to hexsid is in VBS, but I have used the below powershell to duplicate its function.
$sid = "S-1-5-21-2127521184-1604012920-1887927527-72713"
$parts = $sid.Remove(0,6).Split("-")
foreach ($part in $parts)
$hex = ([Convert]::ToString($part, 16)).ToUpper()
While ($hex.length -lt 8)
$hex = "0" + $hex
for ($i=1; $i -lt 5; $i++)
$reverseEndian = $reverseEndian + $hex.substring($hex.length -2, 2)
$hex = $hex.Remove($hex.length -2, 2)
$hexSid = "0105000000000005" + $reverseEndian
For example SID S-1-5-21-2127521184-1604012920-1887927527-72713 needs
to be turned into raw hex sid 010500000000000515000000A065CF7E784B9B5FE77C8770091C0100 according to that article and
then put in the ADSI bind like this: [ADSI ]"LDAP://<SID=010500000000000515000000A065CF7E784B9B5FE77C8770091C0100>".
When I put that bind in (with an actual sid and not an example sid) I get the following error:
format-default : The following exception occurred while retrieving member "PSComputerName": "There is no such object on
the server.
+ CategoryInfo : NotSpecified: (:) [format-default], ExtendedTypeSystemException
+ FullyQualifiedErrorId : CatchFromBaseGetMember,Microsoft.PowerShell.Commands.FormatDefaultCommand
For users who are on another domain but already have a foreign principal name created, I can add them easily enough by converting their sid to the appropriate foreign principal name format. I haven't yet had any success adding someone who doesn't have a
foreign principal name though, even after trying the solution referenced in the article.
Thank you in advance for any help.

How do I configure OS X Server (Mountain Lion) to deliver mail from another domain to my mailbox?

How do I configure OS X Server (Mountain Lion) to deliver mail from another domain to my mailbox?
I run a personal Server at my office. It's configured under my own domain as server.mydomain.com. It's setup that it properly receives and sends e-mail for mydomain.com. I use my own mailbox [email protected] to get all my personal mail.
I'm looking to add another domain as a secondary way for people to get to my content and information.
I want the same address [email protected] and [email protected] to arrive in the same mailbox at my server.
How do i do that?

it does look like you can add virtual domains in the GUI of Server.app on at least some versions, but I don't have an OS X Server 10.8 version handy to check.
I'd encourage spending some time to learn the command line. In general, the payoff for learning the command line will be worth the effort expended. You're running a mail server here and sooner or later the capabilities of the GUI will fail you. This whether due to a configuration omission in the GUI itself, or due to the need to troubleshoot a malfunctioning mail server, a need to automate one or more of the Postfix-related sequences, or some other IT-related task. Entirely FWIW, of course.
Here's a cut-and-paste of the sequence just used to test the command line access to the Postfix configuration, first fetching the current value, appending example.com as the second domain, then displaying the new value, then restarting the Postfix server. Don't enter the dollar signs; just the postconf command and following. Adjust example.com to match your domain...
$ postconf mydestination
mydestination = $myhostname, localhost.$mydomain, localhost
$ sudo postconf -e 'mydestination = $myhostname, localhost.$mydomain, localhost, example.com'
Password: {your admin password here}
$ postconf mydestination
mydestination = $myhostname, localhost.$mydomain, localhost, example.com
$ sudo postfix reload
The Postfix and Postconf commands work irrespective of the OS X Server version; the tools reference the data files as needed.

I created an apple id with credentials from my credit card... after the details were entered, a transaction of rs 60 was shown on my credit card.. does apple charge to create and apple account

I created an apple id with credentials from my credit card... after the details were entered, a transaction of rs 60 was shown on my credit card.. does apple charge to create and apple account

schunfraulin wrote:
... does apple charge to create and apple account
No.
But it might be this > http://support.apple.com/kb/HT3702

HT4356 can i airprint to my airprint printer remotely, with ipad, from another wifi connection or only when i am within my own network?

can i airprint to my airprint printer remotely, with ipad, from another wifi connection or only when i am within my own network?

Air print, and the normal hp airprint set up requires that the pad and the printer be on the same wifi net work. The 'connecting' is done by your router. That means remote printing wont work with the out of the box stuff. I think you might find some 3rd party apps that do support remote printing, but i have not seen any reports from users that found a really good solution. Print n share reads like it might work, i am sure some users will chime in.

Read group membership for a user object and populate every group with matching user from another domain

I have LON\JSmith in LON domain and DEL\JimSmith in DEL domain
I would like to extract group memberships of LON\JSmith in LON domain and append matching by email (i.e. DEL\JimSmith) user object in every group in LON domain.
for instance
LON\JSmith and DEL\JimSmith is the same person and has same email address [email protected]
LON\JSmith belongs to 3 groups - LON\localadmingroup;LON\univdesktop;LON\globalsurvey
The outcome of the script should be
LON\JSmith; DEL\JimSmith should be in 3 groups - LON\localadmingroup;LON\univdesktop;LON\globalsurvey.
How can i do it?
Navgup

Hi Navgup,
Please refer to the script below, to query users in other domain by specifying the parameter "-Server" in the cmdlet "get-aduser", and also note I haven't tested the script below:
import-module activedirectory
get-adgroupmember "group"|foreach{
$email=(get-aduser $_.samaccountname -properties *).EmailAddress#get the user email
Get-ADUser -filter {EmailAddress -eq $email} -properties * -server DomainB.company.com|select samaccountname, memberof}#filter user name and group with the email in other domain
To get users across domain, please also refer this blog:
Adding/removing members from another forest or domain to groups in Active Directory:
http://blogs.msdn.com/b/adpowershell/archive/2010/01/20/adding-removing-members-from-another-forest-or-domain-to-groups-in-active-directory.aspx?Redirected=true
I hope this helps.

How to call a procedure with refcursor from another plsql unit

example I created a pkg with the a procedure that returns a REFCURSOR.
Now I need to call this procedure from another pkg and use the refcursor values in other pkg.
Help please.......
PROCEDURE CustomerSite_Get (p_Registry IN VARCHAR2,
p_CustomerNumber IN VARCHAR2, p_Cursor IN OUT t_cursor);
PROCEDURE CustomerSite_Get (p_Registry IN VARCHAR2,
p_CustomerNumber IN VARCHAR2, p_Cursor IN OUT t_cursor)
IS
-- 0903: Include BillToName
BEGIN
OPEN p_Cursor FOR
     SELECT S.LOCATION CustomerSite, S.SITE_USE_ID CustomerSiteID, C.CUSTOMER_NAME BillToName
     FROM RA_CUSTOMERS C,
RA_ADDRESSES A,
RA_SITE_USES S,
UWA_REGISTRY R,
UWA_REGISTRY_BILL_TO B
     WHERE C.CUSTOMER_ID = A.CUSTOMER_ID
     AND A.ADDRESS_ID = S.ADDRESS_ID
     AND S.SITE_USE_ID = B.SITE_USE_ID
     AND R.REGISTRY_ID = B.REGISTRY_ID
     AND B.TRIP_BILLING != 'N'
     AND R.DELETE_FLAG != 'Y'
          AND R.Registry = p_Registry
          AND R.CUSTOMER_NUM = p_CustomerNumber
     ORDER BY S.LOCATION;
END CustomerSite_Get;
thanks,
Anitha.
Edited by: user521218 on May 6, 2009 1:24 PM

Hi Anitha,
try this,
-- PKG_A
Procedure CustomerSite_Get( p_Registry       IN Varchar2
                          , p_CustomerNumber IN Varchar2
                          , p_Cursor         IN OUT t_cursor) Is
Begin
   PKG_B.CustomerSite_Get( p_Registry
                         , p_CustomerNumber
                         , p_Cursor );
End;
-- PKG_B
Procedure CustomerSite_Get(p_Registry       IN Varchar2
                          ,p_CustomerNumber IN Varchar2
                          ,p_Cursor         IN OUT t_cursor) Is
Begin
   Open p_Cursor For
      SELECT S.LOCATION      CustomerSite
            ,S.SITE_USE_ID   CustomerSiteID
            ,C.CUSTOMER_NAME BillToName
        FROM RA_CUSTOMERS         C
            ,RA_ADDRESSES         A
            ,RA_SITE_USES         S
            ,UWA_REGISTRY         R
            ,UWA_REGISTRY_BILL_TO B
       WHERE C.CUSTOMER_ID = A.CUSTOMER_ID
         AND A.ADDRESS_ID = S.ADDRESS_ID
         AND S.SITE_USE_ID = B.SITE_USE_ID
         AND R.REGISTRY_ID = B.REGISTRY_ID
         AND B.TRIP_BILLING != 'N'
         AND R.DELETE_FLAG != 'Y'
         AND R.Registry = p_Registry
         AND R.CUSTOMER_NUM = p_CustomerNumber
       Order BY S.LOCATION;
End CustomerSite_Get;regards,
Christian Balz

Create stored procedure with table from another schema throws PLS-00201

Oracle 10g. I'm new to procedures, so maybe I'm missing something obvious.
Schema owner ABC has table T2001_WRITEOFF. The SYSDBAs granted SIUD to Some_Update_Role, and granted that role to developer user IJK. User IJK then created a private synonym T2001_WRITEOFF for ABC.T2001_WRITEOFF. This worked with normal SQL DML commands.
When I try to create a simple procedure as follows, it throws PLS-00201 identifier 'T2001_WRITEOFF' must be declared, and points to the 2nd line.
create or replace procedure woof1(
fooname in T2001_WRITEOFF.territory%TYPE, <=== error points here
bardesc IN T2001_WRITEOFF.ind_batch_submit%TYPE) IS
BEGIN
INSERT into T2001_WRITEOFF
VALUES ( fooname, bardesc);
END woof1;
What am I doing wrong?
Thanks
JimR

Hi,
The reason I've heard has to do with knowing when a procedure becomes invalid due to privileges being revoked. Any time a grant to a role is revoked, you would have to check all procedures that depended on that role to know if they were still valid. Even worse, since roles can be granted to other roles, every time a role is revoked from another role, you would have to check all procedures that depended on anything to see if they were still valid.
Oracle 11 behaves the same as earlier versions in this regard, and I don't expect this to change.
This whole thread applies only to AUTHID DEFINER stored procedures (which is the default). If you can make the procedure AUTHID CURRENT_USER, then you can run it with privileges granted through roles. Usually, however, you really want AUTHID DEFINER, and granting the necessary privileges directly to the procedure owner (or to PUBLIC) isn't too hard.

People Picker can resolve users and security group from another domain but no validation for groups

Dear all,
Here is the scenario of our issue:
We are migrating from Domain A to Domain B and in Domain A we currently have a SharePoint 2013 on which we want to set permissions for users and groups that have already migrated to Domain B.
A bi-directional trust exist between the two domains and all applications relying on trust and resolving IDs from on domain to another are working fine (Windows RDS for instance)
The "bug" that we have is when using the PeoplePicker, it can resolve without any issue a user account in Domain A or B, and a security group (type global, I haven't tried local or universal yet) from domain A or B. But for the security groups
only (it works well for users), when I click on "Save" to validate the add of the group to the site permissions, I have the following error:
I have seen a lot of similar issues on the web but no answer so far that work :(
Example: https://social.technet.microsoft.com/forums/sharepoint/en-US/74e8d14b-a0f4-4e21-8cfa-b1a937247160/cant-provision-security-to-old-domain-users
If you have any question that could help you to understand it, do not hesitate.
Thanks a lot in advance for your help ! :)

Can you give the snippet from the ULS log where you're seeing this error?
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Oracle Database XE - apex on Windows 7 - Problem with Connection from another Windows 7 Computer

Hello,
I started with Oracle Database XE 11g, with apex, did the upgrade to Apex 4.2.6 and started in developing a small Application.
I wanted to Connect to my Computer A (with Database runing on it) from another Windows 7 Computer B.
So I put in in Firefox: //A:8080/apex but I only received a timeout.
Of course on both Computers there is a windows-Firewall running, so I stopped on both Systems the Firewall, but its the same still.
In the windows explorer running on Computer B , I can see the data of Computer A and both Computers are in the same home-net-group. (sorry for my poor english).
Is there anyone who cann tell me how to get the Connection running ?
Maybe I didn't see the info about this in the manuals, if it is there, please give me a hint.
many thanks
Wilhelm Kästner Salzburg

Hi,
Check if this helps
https://docs.oracle.com/cd/E17781_01/install.112/e18803/toc.htm#XEINW127
Regards,
Jari

Query with Tables from another Database

Hi.
I have a problem with a Query that executes a stored procedure that inserts data in a Table from another DataBase. The problem is when I try to execute a Query with the data related of that table using the user parameters of SBO ('[%0]'....'[%3]'). I use the following parameters for reference to the Table:
"....FROM [-BDName-].[dbo].[-TableName-] T1..... "
Any suggestions? Thanks a lot....
(Suggestions in English or Spanish)

None

Issue with Results from Another Query (Error on Null value)

Hi All,
We have a WebI report using "Result from Another Query" option of BO XI R3.1. The report was running fine till recently the dimension object using result from another query had a null value. Report suddenly throwed error as the query filters are invalid.
Is there a way to make this filter optional if no data/null value is there ? Because we need those null values in report as well.
Thank you for your time.
Thanks & Regards
LN

Hi Vivek,
It was not directly solved but I applied alternate logic to over come the issue.
Here's what I did to overcome:
I used a sub query in place of the whole result from another query.
For Ex:
Dim1 inlist result from another query1
I made it as
Dim1 inlist (Dim0)
where Conditions.
Here Dim0 is the object which we use for Result from another query and Conditions will be the necessary filter conditions to arrive proper Dim0. Make sure proper context is formed for the sub query.
Even though it resolved my problem, It introduces an new issue. It causes increase in query run time when huge set of data is returned from sub query.
Please let me know if i haven't explained clearly.
Hi Aris_BO,
Sorry for not responding earlier. The logic would probably make more queries null & not null. Thats why I was not advised to use it.
Thanks
LN

Update table with select from another table

Hallo,
I'd like to update table b with codes from a mapping table a.
a has:
town_id, town_code, town_name
b has town_code, town_id, town_population, town_zip_code,...
Table a has all the details - town_id, town_code and town_name and acts as the mapping between town_id and town_code
In table b, town_code is null. I want to update the column b.town_code with town_code from table a where a.town_id = b.town_id.
How will the update query look like?
I tried
UPDATE B SET town_code = (SELECT A.town_code FROM A,B WHERE A.town_id=B.town_id)
and I get the error 'single-row subquery returns more than one row'
Will appreciate your assistance

This is what I did.
First, I created and populated the TOWN_INFO table:
CREATE TABLE "TOWN_INFO"
(     "TOWN_ID" NUMBER,
     "TOWN_CODE" NUMBER,
     "E_MAIL" CHAR(15 BYTE)
Table Created.
insert all
into TOWN_INFO (TOWN_ID, E_MAIL) values (3024,'[email protected]')
into TOWN_INFO (TOWN_ID, E_MAIL) values (3040,'[email protected]')
into TOWN_INFO (TOWN_ID, E_MAIL) values (3052,'[email protected]')
into TOWN_INFO (TOWN_ID, E_MAIL) values (3065,'[email protected]')
into TOWN_INFO (TOWN_ID, E_MAIL) values (3066,'[email protected]')
select * from dual
5 rows created.
The following creates and populates the mapping table:
CREATE TABLE "TOWN_MAPP"
(     "TOWN_CODE" NUMBER,
     "TOWN_ID" VARCHAR2(255 BYTE),
     "TOWN_NAME" CHAR(6 BYTE)
insert all
into TOWN_MAPP (TOWN_ID,TOWN_CODE, TOWN_NAME) values (3024,'1001','TOWN_1')
into TOWN_MAPP (TOWN_ID,TOWN_CODE, TOWN_NAME) values (3040,'1003','TOWN_3')
into TOWN_MAPP (TOWN_ID,TOWN_CODE, TOWN_NAME) values (3052,'1002','TOWN_2')
into TOWN_MAPP (TOWN_ID,TOWN_CODE, TOWN_NAME) values (3065,'1004','TOWN_4')
into TOWN_MAPP (TOWN_ID,TOWN_CODE, TOWN_NAME) values (3066,'1006','TOWN_6')
into TOWN_MAPP (TOWN_ID,TOWN_CODE, TOWN_NAME) values (3088,'1007','TOWN_7')
into TOWN_MAPP (TOWN_ID,TOWN_CODE, TOWN_NAME) values (3020,'1009','TOWN_9')
select * from dual
7 rows created.
And now the update query:
UPDATE TOWN_INFO
SET TOWN_CODE=(SELECT B.TOWN_CODE FROM TOWN_MAPP B, TOWN_INFO C
WHERE B.TOWN_ID=B.TOWN_ID)
SET TOWN_CODE=(SELECT B.TOWN_CODE FROM TOWN_MAPP B, TOWN_INFO C
ERROR at line 2:
ORA-01427: single-row subquery returns more than one row
Thanx in advance
Edited by: user9954260 on Apr 13, 2010 7:40 AM
Edited by: user9954260 on Apr 13, 2010 7:44 AM

Populating table with data from another table with fewer columns

Hi,
I have 2 tables:
Table 1:
Column 1
Column 2
Column 3
Table 2:
Column 1
Column 2
I want to populate Table 1 with all the data from Table 2, and populate Column 3 of Table 1 with numbers from a sequence. Is there a SQL stmt to do this? If not, what is the best way to do it in PL/SQL?
Thank you
Shailan

CREATE SEQUENCE t1_seq
START WITH 1
INCREMENT BY 1
CACHE 100;
INSERT INTO t1( col1, col2, col3 )
SELECT col1, col2, t2_seq.nextval
FROM t2Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC

Authentication with credentials from another domain?

Similar Messages

Maybe you are looking for