Basic Authentication for Non-AD Users

Hello
we are implemented windows integrated single sign on using spnego module and adjusted the login stacks as directed;
Evaluate TicketLogin.Module = SUFFICIENT
SPNEGO mdoule = OPTIONAL
Ceate TicketLoginModule = SUFFICIENT
BasicpasswordLogin Module = REQUISITE
Create Ticket Login Module = REQUISITE
This is tested an all works fine for AD users on the network.
We have also activated the parameter;
ume.usermapping.refsys.mapping.type = attribute
So that we can perform user mapping of AD user id is different from backend sap user id.
However, when Non-AD users, for example internet users or third parties want to access the portal we want them to be challanged by basic username and password authentication.
All we get is page cannot be displayed. (we've made sure IP address / network etc is in place, this worked before implementing spnego)
The security log shows the following error;
#1.#001E680F70D100750000000D0000571E00046EE5C2DB2770#1247833002551#/System/Security/Authentication#sap.com/irj#com.sap.engine.services.security.authentication.logincontext#Guest#0##n/a##b010c47072cb11de8c4c001e680f70d1#SAPEngine_Application_Thread[impl:3]_26##0#0#Info#1#com.sap.engine.services.security.authentication.logincontext#Plain###LOGIN.FAILED
User: N/A
Authentication Stack: ticket
Login Module                                                               Flag        Initialize Login      Commit     Abort      Details
1. com.sap.security.core.server.jaas.EvaluateTicketLoginModule             SUFFICIENT ok          false                 true
2. com.sap.security.core.server.jaas.SPNegoLoginModule                     OPTIONAL    ok          exception             true
Access Denied. No authorization header received.
3. com.sap.security.core.server.jaas.CreateTicketLoginModule               SUFFICIENT ok          false                 true
4. com.sap.engine.services.security.server.jaas.BasicPasswordLoginModule   REQUISITE   ok          false                 false
5. com.sap.security.core.server.jaas.CreateTicketLoginModule               REQUISITE   ok          false                 true       #
What does it mean by no authorisation header?
This is only affecting non-AD users.
what have I missed / done wrong?
cheers

Could you try this one :
Evaluate TicketLogin.Module = SUFFICIENT
SPNEGO mdoule = OPTIONAL
Create TicketLoginModule = SUFFICIENT
BasicpasswordLogin Module = REQUISITE
Create Ticket Login Module = OPTIONAL

Similar Messages

Acrobat 7 requires admin password at every launch for non admin users?

acrobat 7 requires admin password at every launch for non admin users?
any one with a solution or similar problem?
thanks for any help.

I've been avidly following all of the threads regarding this issue...yet none of the solutions have worked for me. I've got 11 Mac users that do not use the Creative Suite..only Acrobat, Quark, etc. I've tried installing and re-installing through both Admin and User accounts, I've tried the AdobeBib XML change, I've tried enabling Root and installing, changing permission on the Acrobat folder, etc. all to no avail. I still get asked for Admin Authentication every time Acrobat and Distiller are opened (except on the Admin account side). This is happening on one particular Mac (G4, 1GB Ram, OS 10.4.3) for both Acrobat Standard 6 and 7 as well. The biggest issue that also happens in tandem with the Acrobat installs is the inability to print from Quark. I get the following error when printing: "The process "pictwpstops" terminated unexpectedly on signal 6." Because of the necessity to print Quark documents, I have uninstalled all Acrobat on the machines until we can get a fix. This resolves the printing problem with Quark. The only option left is to set up all users as Admin accounts - which I really do not want to do. Any other suggestions out there? I've got more information available if needed.

How set UserName and Password for HTTP Basic Authentication for a servlet

Hi..
How set UserName and Password for HTTP Basic Authentication for a servlet in JBoss server?
Using Tomcat i can do it .(By setting roles in web.xml, and user credintails in tomcat-user.xml).
But i dont know how do it in JBOSS..
I am using Netbeans and Eclipse IDEs.. Can we do it by using them also!?
Thank u

Hi Raj,
You can do this by creating a Login screen for the users and check the authentication of each user in PAI i.e. PROCESS AFTER INPUT.
Store the user information in a database table and check the username and password when the user enters it.
You can display password as *** also. For this double click on input box designed for password and goto Display tab. Select Invisible in the list and check it.
CASE sy-ucomm.
    WHEN 'BACK'.
      LEAVE PROGRAM.
    WHEN <fcode for submit>.
      SELECT SINGLE uname pwd
       FROM <DB table>
       INTO (user, pass)
       WHERE username = user AND
               password = passwd.
      IF sy-subrc = 0.
<Go to next screen for further processing>
      ELSE.
<Display Error message and exit>
      ENDIF.
ENDCASE.
Regards,
Amit
Message was edited by:
        Amit Kumar

Can we add Basic Authentication for Oracle Report 10g?

As we know, Apache supports basic Authentication, and Oracle Report 10g bases on Apache, that means Oracle Report 10g supports Basic Authentication too?
Can anyone tell me the steps on how to configure Basic Authentication for Oracle Report 10g?
Thanks for your help in Advance!
P.S.
I tried to add the following content to the file "httpd.conf" under the directory "E:\OraHome_2\Apache\Apache\conf\" (I installed report under this folder), but it doesn't work well:
<Directory "E:\OraHome_2\Apache\Apache\htdocs">
AuthType Basic
AuthName "Private Documentation Repository"
AuthUserFile "C:\Program Files\Apache Software Foundation\Apache2.2\mypasswd"
Require user yangsun
</Directory>

Answers at your duplicated thread --> Some inter view Questions Please give prefect answer help me

How to allow access to winrs for non-admin user?

I have Windows Server 2012 (and Server 2008, but it is next priority) to monitor it using txwinrm. txwinrm library internally is using WinRS protocol. I have to monitor it using least privileged user, but don't know how to configure access for him.
All I managed to do - is to configure remote Powershell session for my user, but it's look like that winrs and powershell sessions have different security descriptors:
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential Administrator $pwd) -ScriptBlock { 2 + 2}
# gives 4
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential lpu1 $pwd) -ScriptBlock { 2 + 2}
# gives 4
winrs -r:192.168.173.206 -u:Administrator -p:$pwd 'powershell -command "2+2"'
# gives 4
winrs -r:192.168.173.206 -u:lpu1 -p:$pwd 'powershell -command "2+2"'
# Gives Winrs error: Access is denied.
Configuration for my user is following:
(Get-Item WSMan:\localhost\Service\RootSDDL).value
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1141)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
(Get-PSSessionConfiguration -name Microsoft.Powershell).SecurityDescriptorSddl
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1149)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
(In each security descriptor my user is given general access to protected object).
So what security descriptor should I set to make my winrs query work for non-admin user?

Hi Bunyk,
I can not recreate the erroe you posted, and please also post the screenshoot in your convenience.
I tested with a non-domain user but has the local admin permission of the remote computer, and this worked, before running the remote cmdlet in powershell, I also configured the TrustedHosts.
In addition, the access denied could be also caused to the Protocol Filtering on the remote server, for more detailed information, please refer to this thread:
winrs error:access is denied
I hope this helps.

How to set up and test the Basic Authentication for HTTP protocol

Hi,
I tried configuring the password based Basic Authentication for sending xml document using ebMS - HTTP protocol. I set username and password while configuring the transport server for both trading partners. I want to know, is that sufficient for basic authenticaton. When I open the URI http://localhost:7778/b2b/transportServlet, it is not asking any authentication (username/password). Please note that I have not used SSL certificate. Anyone please help me out to configure Basic authentication.

Hi Ramesh,
Thanks for ur response. Could you please tell me where to set the Additional Transport header : authtype-basic#realm=myRealm(in which property file). In enqueue code, I could see the following attributes
queue
msgID
replyToMsgID
from
to
eventName
doctypeName
doctypeRevision
msgType
payload
attachment
subscriber
Is it possible to set username/password in the enqueue attributes?
Do i need to add username/password and Transport header in the input XML and defined that elements in xsd?

SQL tab not working in V2.1 EA1 for non-DBA users -- how to fix?

In v2.1 EA 1 the tab to show the SQL script (DDL) in the object browser is not working for non-DBA users. In the prior version, these users would see a message about DBMS_METADATA and then the message would indicate that an "internal generator" would be used to generate the DDL script. After that brief message the DDL would show up as expected. This doesn't seem to be the case in the newest version.
I issued the following two grants to a particular user which worked, but I am reluctant to issue the grants to "PUBLIC".
SQL> grant execute on DBMS_METADATA to XXXXX;
SQL> grant select_catalog_role to XXXXX;
So, my questions are:
1) Will the old functionality (that didn't require these privileges) be added to V2 at some point?
2) What security implications are there for issueing the above grants to PUBLIC?
NOTE: After granting execute on the DBMS_METADATA package, it still didn't work. I left that grant in place and granted SELECT_CATAOG_ROLE, so I can't say for sure that the 1st grant was required.
Edited by: user615070 on Nov 19, 2009 9:30 AM
Edited by: user615070 on Nov 19, 2009 10:06 AM

An OEM account is separate from the database account. You need to use OEM UI to create an OEM account, however, for certain tasks to be done in the databases which OEM is monitoring they will also require separate database accounts within those databases. For example, to view the performance tab in OEM UI, a database account is required.
OEM only has two types of users, i.e. Super Administrator and Administrator, but don't go by the names. You can grant an OEM 'Administrator' account access to specific targets and what they can do within OEM, such as only viewing reports, targets, and so on. For access within a database, the user created need not be a DBA either.
I hope you understand.

I received a notice that there is an update for my Lightroom 5. I have the non-creative cloud version. Is the update available for non-cloud users? It says to download click the link and it takes me to Cloud free trial screen.

I received a notice that there is an update for my Lightroom 5. I have the non-creative cloud version. Is the update available for non-cloud users? It says to download click the link and it takes me to Cloud free trial screen.

It is the same installer. You can run it as 30-days trial (CC version) and decide later for CC or stand-alone. To license as stand-alone, follow this guide.
If you already have the LR6 license key, you can enter it during setup and do not need to follow the guide.

Can I burn photos onto a DVD/CD for non-Mac users?

Can I burn photos onto a DVD/CD for non-Mac users?

You can burn a plain CD/DVD by just dragging the photos there; but, that may or may not be playable by everyone. To be sure that the result would be playable in any computer or CD/DVD player, it would be better to use either one of the apps already on your system - such as iPhoto. I don't use that myself - I use other third party software - but take a look at iPhoto help. And, you could make it more interesting by creating a slideshow - also in iPhoto, or iMovie. To give it the final cool touch, bring it into iDVD to give it a polished look if you'd like. You can burn it then from any of the above.
If you happen to have Toast (an excellent burning app), you could use that as well (that is my preferred way to work). In Toast, you have multiple choices: burn a data CD/DVD for Mac only, for Mac & PC, etc, burn a picture CD, video DVD, etc, etc.

How to hide the page ribbon and quichlaunch for non admin users

HI
1 ) how to hide the ribbon in a page in sharepoint 2010 for non administrator users
2) how to hide quicklaunch also for non admin users
in quick lanuch i want to hide links for all site content also.
i used Document Center Template to create my web application.
adil

HI
i did not get how i use this control
<Sharepoint:SPSecurityTrimmedControl
runat="server"
PermissionsString="FullMask">
2
  <div>
3
    <SharePoint:SPLinkButton
id="idNavLinkViewAll"
runat="server"
NavigateUrl="~site/_layouts/viewlsts.aspx"
Text="<%$Resources:wss,quiklnch_allcontent%>" AccessKey="<%$Resources:wss,quiklnch_allcontent_AK%>"/>
4
  </div>
5
</SharePoint:SPSecurityTrimmedControl>
adil

User Interface Access Customisation for non admin users

Hi,
It is understood that for non-admin users, some features of the Planning Interface is not enabled and this can be controlled by proper access permissions. But, is it possible to extend the customization to provide some additional features in the menu bar for an user?
For example, if View User wants to manage task lists. Is it possible by some sort of customization? Please advise.
Thanks.

Hi,
You can create right click menus, and you can also create links on the tools page. Would any of these help you?
Here is the doc on those subjects:
Creating and Updating MenusAdministrators can create right-click menus and associate them with data forms, enabling users to click rows or columns in data forms and select menu items to:
Launch another application, URL, or business rule, with or without runtime prompts
Move to another data form
Move to Manage Approvals with a predefined scenario and version
The context of the right-click is relayed to the next action: the POV and the Page, the member the user clicked on, the members to the left (for rows), or above (for columns).
When designing data forms, use Other Options to select menus available for Data Form menu item types. As you update applications, update the appropriate menus. For example, if you delete a business rule referenced by a menu, remove it from the menu.
To create, edit, or delete menus:
Select Administration, then Manage, then Menus.
Perform one action:
To create a menu, click Create, enter the menu's name, and click OK.
To change a menu, select it and click Edit.
To delete menus, select them, click Delete, and click OK.>
Specifying Custom ToolsAdministrators can specify custom tools, or links, for users on the Tools page. Users having access to links can click links from the Tools menu to open pages in secondary browser windows.
To specify custom tools:
Select Administration, then Application, then Settings.
For Show, select Advanced Settings.
Click Go.
Select Custom Tools.
For each link:
For Name, enter the displayed link name.
For URL, enter a fully qualified URL, including the http:// prefix
For User Type, select which users can access the link.
Click Save.

Why can't Apple make 'publish changes only' for non .mac users?

The recent iWeb update to 1.1 and the now increasingly obvious differential between .mac and non .mac features has prompted me to post here today.
I can understand comments, passwords and search facilities being a .mac only experience because it requires server side technology. I can also understand that .mac users get enhanced features like slideshows as well.
But why is the fundamentally *basic* option to 'publish the changes only' not available to non .mac users?
I know uploading to .mac uses a different protocol to uploading via FTP, but I don't think it is about that. Obviously the software engine in iWeb 1.1 can now track the pages that have changed, and flag those for uploading. So if the facility to do this is not available with non .mac uploading, is this some form of crippleware? Can any software engineers comment on this or am I talking off the top of my head? [And please mods, don't delete this post - I use the word 'crippleware' in its harshest form, clearly I can still use iWeb to make fantastic websites - I am asking a technical question here.]
Michael
A Trusty Quicksilver G4 Dual 1GHz

OK, from reading this thread:
http://discussions.apple.com/thread.jspa?threadID=486335&tstart=0
There is a pattern: An error occurred while publishing file “/blah/blah", while file "/blah/blah" seems to be random from one person to the next, but they all share one thing and that is communication protocol.
For iWeb to be able to publish changes to .Mac, it has to:
1. identify if the file exists
2. do the following:
2a. if not exists, copy it to .Mac
2b. if exist, do some sort comparison - CRC checksum -
2b1. if checksums match, don't copy
2b2. if checksums don't match copy it to .Mac
At least I think that's what going on, I don't have .Mac so that is best I can think of. Perhaps, some Apple SW engineers can jump in here.
Now, the bad part is iWeb has to (and I'm assuming iWeb uses WebDAV):
1. go thru each file locally
2. crawl its way into .Mac (WebDAV is a slow protocol) to find the the counter part.
3. when it finds a file that matches a client side file, it has to (some how) do checksum on-the-fly across the net work (which is slow and congested)
#3 is I think where it failed, there are many factors here: 1) networks congestion 2) latency 3) protocol overhead 4) checksum calculation time etc...
iWeb eventually times out because any/all of the above.
It's nice that WebDAV can author to the host yada, yada, but it's so SLOOOOOW.
What I would do is for every publishing, I would build a files and their checksums keep it on the host (or local, must be hidden).
For subsequence publishing, I would (use a fast protocol like FTP) download this pre-built files/checksums list. Locally, do a full publishing, making checksum comparison, the result is delta changes; upload only those. Build a new files/checksums list upload that too.
What I mean to say is offload everything that is possible to local machine, bandwidth is PREMIUM!

NetworkManager applet doesn't prompt for VPN secret for non-root user

I'm using NetworkManager in GNOME DE. When logged in as non-root user, I'm unable to connect to a vpnc profile.
* As non-root, I am able to add/remove/alter/connect to WiFi network profiles with no trouble.
* As non-root, I am also able to add/remove/alter vpnc profiles.
* However, the VPN group key and VPN user password do not appear to store properly when adding/editing the profile as non-root. I can enter them, but when I bring the dialog back up, they are always blank. Even so, I can see an entry for vpnc in the Gnome keyring.
* When I slide the on/off switch to try to connect with the vpn profile, there is no prompt for the VPN group key or password. The switch just slides back to Off immediately and I can see the text 'authentication required' flash briefly where it shows the connection status. After that flashes, the connection status is back to 'Not connected'. No error message displays.
* If I sign in as root, there are no problems. The VPN 'secrets' will save properly in the dialog, and also if I leave them blank, I'm prompted for them when I activate the connection.
* Creating the connection as 'root' is not an option, as this doesn't appear in profile list when signing on as non-root.
Any ideas on where to look or what to check? As mentioned above, non-root can maintain WiFi connections through NetworkManager just fine, so the problem appears localized to VPN 'secrets'. Also other applications (i.e. Evolution) have no trouble in dealing with authentication.
I do have polkit installed:
extra/polkit 0.110-2 [installed]
Application development toolkit for controlling system-wide privileges
extra/polkit-kde 0.99.0-2
Daemon providing a polkit authentication UI for KDE
extra/polkit-qt 0.103.0-2
A library that allows developers to access PolicyKit API with a nice Qt-style API
community/polkit-gnome 0.105-1 [installed]
PolicyKit integration for the GNOME desktop

Update/more information on this...
My typical/preferred setup for my VPNs is to save the VPN group key, but to be prompted for my VPN user password on each connect. So, this is how I was trying to setup in the applet. Interestingly, I have found that if I save BOTH of the 'secrets' to the keyring, then I can connect!
The behavior is still as above in the dialog -- both secrets are blank if I edit the connection, although they are present in the Gnome keyring. As long as they are BOTH there, I can connect fine. But, if I have either of them set to 'Always Ask', then I am not prompted for them and the connection fails.
Although I can work with this, I would certainly still like to figure out what is going on and fix it, as it does bother me that it works that way:
* Why can't the dialog redisplay my secrets when I edit a connection as non-root?
* Why doesn't Always Ask work to prompt me for secrets when running as non-root?
Any ideas? I've used the Gnome/NetworkManager/vpnc combination on other desktops (this is my first Arch), and I have never seen anything like this.

Authentication Delays / Slow Authentication for Open Directory Users

I'm experiencing delays when authenticating Open Directory users and it absolutely has me at my wit's end.
The problem is quite simple: any time an Open Directory user authenticates his password there is a delay of at least 5-10 seconds. This goes for clients that are bound to the directory server and also authenticating locally on the server. Here are some examples:
* On the server, there is a several second delay on the Login Window screen when trying to log in using an Open Directory account. Logging in as a local user is instantaneous.
* In Workgroup manager, authenticating as the Directory Administrator takes several seconds.
* On a remote computer, sharing the screen using an Open Directory user take several seconds and again, a local user is instantaneous. Screen sharing takes particularly long and often temporarily shows a sheet saying it has lost the connection with the server while authenticating.
* Connecting with AFP takes several seconds when using an Open Directory login
* On a client computer, unlocking the screen after sleep or screen saver takes several seconds for Open Directory users
* Connecting with SSH does NOT exhibit the behavior
In addition to all of this, I've seen periodic random unexplainable freezes for several seconds on client computers that are bound to the directory even when logged in as a local user account (and with no other users logged in.) For example, launching applications often results in a freeze. After unbinding the computer from the directory the problem goes away entirely.
The history of the problem:
Used Tiger Server for over a year = no problems
Clean install of Leopard Server 10.5.0 back in October = no problems
Update to Leopard Server 10.5.1 = no problems
Then, all of the sudden one day several weeks back I started having problems. The server had been up for a few weeks. I didn't install any updates. I didn't change any configuration. Literally the only thing that I had done recently was unplug the Apple Cinema Display and keyboard+mouse that was connected to the server. Then I started having problems so I plugged the display, keyboard and mouse back in to troubleshoot it. I cleared the directory services caches on my server and clients and rebooted the Airport Base Station that's serving as my router and eventually the problem went away. I wish I could tell you which of those things resolved the problem but I have no idea. It was fine for a couple more weeks (and incidentally I once again unplugged the display, keyboard and mouse from the server). Then last week I started having problems again and this time no amount of rebooting, cache clearing, rebinding, troubleshooting using information in these forums or anything else will fix the problem. I only mention the display/keyboard/mouse thing because it's literally the only thing I changed around the time the problems started happening. I truly don't think it has anything to do with it.
So in desperation I backed up and did a clean install today. Here's the process I used:
0. Erase the disk
1. Install Leopard Server 10.5.0 from the install DVD
2. In the setup assistant, use the Advanced Configuration option but I didn't enable any services. Set up network settings and host name of myserver.mydomain.private.
3. Reboot
4. Use Software Update to update to 10.5.1 and Security Update 2007-009 v1.1
5. Reboot
6. Configure DNS (see below for detailed configuration)
7. Reboot
8. Change role to Open Directory Master
9. Reboot
... and the problem is still there. Simply logging into the server GUI with the Directory Administrator account has the delay. Authenticating in Workgroup Manager has the delay. I haven't even bothered to set up AFP or any other users yet. I'm truly at my wit's end and I'm ready to chuck the server out the window.
I've done a lot of googling and searching of these forums looking for answers. All of the responses seem to point to a problem with DNS or with the Kerberos realm. I believe all of my setup is correct. Here it is:
== Basic Configuration ==
OS: Mac OS X Server 10.5.1 (9B18) with Security Update 2007-009 v.1.1
Services Enabled:
DNS
Open Directory
(All other services are not yet enabled)
== DNS Setup ==
Primary Zone: mydomain.private.
Allows zone transfer: no
Nameservers: ns.mydomain.private.
myserver (Machine) 10.0.22.201
ns (Alias) myserver.mydomain.private.
Reverse Zone: 22.0.10.in-addr.arpa.
10.0.22.201 (Reverse Mapping) myserver.mydomain.private.
Accept recursive queries from the following networks:
localnets
Forwarder IP Addresses:
208.67.222.222
208.67.220.220
== Open Directory Setup ==
Role: Open Directory Master
LDAP Search Base: dc=myserver,dc=mydomain,dc=private
Kerberos Realm: myserver.mydomain.private
== Network Configuration ==
Configure: Manually
IP Address: 10.0.22.201
Subnet Mask: 255.255.255.0
Router: 10.0.22.1
DNS Server: 127.0.0.1
Search Domains: mydomain.private
== Other Stuff ==
Using 'changeip -checkhostname' verifies that the hostname and DNS hostname are both myserver.mydomain.private.
I set the realm to myserver.mydomain.private (though the default was myserver.local) based on the advice of another poster to this forum. Kerberos.app reveals something interesting: the kdc and admin servers are both myserver.local and the domains are .local and local. I tried changing all instances of 'local' to 'mydomain.private' to see if that would solve the problem. No luck.
I verified on a client that 'host myserver' and 'host 10.0.22.201' return proper DNS and reverse DNS resolutions.
Hopefully one of the gurus out there will be able to help me out.
Thanks,
jeff

I gathered together some log information for when I try to authenticate user 'diradmin' in Workgroup Manager. You can see from the log messages that this authentication took 4 seconds. There's an interesting error message in slapd.log (see below) but it doesn't say what it's looking for in the keytab that it's not finding. Grr! I've provided a listing of the principles in my keytab. I haven't monkeyed around with it at all -- this is just what resulted from promoting the server to an Open Directory Master.
== kdc.log ==
Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](debug): handling authdata
Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](debug): handling authdata
Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](debug): .. .. ok
Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](debug): .. .. ok
Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) fe80::216:cbff:fea5:f3ce: ISSUE: authtime 1199060508, etypes {rep=16 tkt=16 ses=16}, [email protected] for krbtgt/[email protected]
Dec 30 18:21:48 myserver.mydomain.private krb5kdc[79](info): AS_REQ (7 etypes {18 17 16 23 1 3 2}) fe80::216:cbff:fea5:f3ce: ISSUE: authtime 1199060508, etypes {rep=16 tkt=16 ses=16}, [email protected] for krbtgt/[email protected]
Dec 30 18:21:52 myserver.mydomain.private krb5kdc[79](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) fe80::216:cbff:fea5:f3ce: ISSUE: authtime 1199060508, etypes {rep=16 tkt=16 ses=16}, [email protected] for ldap/[email protected]
Dec 30 18:21:52 myserver.mydomain.private krb5kdc[79](info): TGS_REQ (7 etypes {18 17 16 23 1 3 2}) fe80::216:cbff:fea5:f3ce: ISSUE: authtime 1199060508, etypes {rep=16 tkt=16 ses=16}, [email protected] for ldap/[email protected]
== slapd.log ==
Dec 30 18:21:48 myserver slapd[36]: <= bdbsubstringcandidates: (authAuthority) index_param failed (18)
Dec 30 18:21:52 myserver slapd[36]: SASL [conn=20] Failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No principal in keytab matches desired name)
== sudo klist -k ==
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
3 afpserver/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4 D0DDB570D64ED88C5D06A78A34B7167C
3 afpserver/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4 D0DDB570D64ED88C5D06A78A34B7167C
3 afpserver/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4 D0DDB570D64ED88C5D06A78A34B7167C
3 cifs/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB 570D64ED88C5D06A78A34B7167C
3 cifs/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB 570D64ED88C5D06A78A34B7167C
3 cifs/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB 570D64ED88C5D06A78A34B7167C
3 vnc/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB5 70D64ED88C5D06A78A34B7167C
3 vnc/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB5 70D64ED88C5D06A78A34B7167C
3 vnc/LKDC:SHA1.D711BEA4D0DDB570D64ED88C5D06A78A34B7167C@LKDC:SHA1.D711BEA4D0DDB5 70D64ED88C5D06A78A34B7167C
3 cifs/[email protected]
3 cifs/[email protected]
3 cifs/[email protected]
3 ldap/[email protected]
3 ldap/[email protected]
3 ldap/[email protected]
3 xgrid/[email protected]
3 xgrid/[email protected]
3 xgrid/[email protected]
3 vpn/[email protected]
3 vpn/[email protected]
3 vpn/[email protected]
3 ipp/[email protected]
3 ipp/[email protected]
3 ipp/[email protected]
3 xmpp/[email protected]
3 xmpp/[email protected]
3 xmpp/[email protected]
3 XMPP/[email protected]
3 XMPP/[email protected]
3 XMPP/[email protected]
3 host/[email protected]
3 host/[email protected]
3 host/[email protected]
3 smtp/[email protected]
3 smtp/[email protected]
3 smtp/[email protected]
3 nfs/[email protected]
3 nfs/[email protected]
3 nfs/[email protected]
3 http/[email protected]
3 http/[email protected]
3 http/[email protected]
3 HTTP/[email protected]
3 HTTP/[email protected]
3 HTTP/[email protected]
3 pop/[email protected]
3 pop/[email protected]
3 pop/[email protected]
3 imap/[email protected]
3 imap/[email protected]
3 imap/[email protected]
3 ftp/[email protected]
3 ftp/[email protected]
3 ftp/[email protected]
3 afpserver/[email protected]
3 afpserver/[email protected]
3 afpserver/[email protected]

HTTP Basic authentication for proxy service and its wsdl?

Hello:
For some reasons I needed to configure the HTTP basic authentication on a proxy service at OSB 11g. Everything was OK until I realized that, additionally to the authentication when calling the service, the OSB also asks for credentials when I try to get that proxy wsdl file.
My requirements are to secure the proxy service when is called only, not when retrieving the wsdl.
Is this possible to configure on OSB / WLS? How?
Greetings!
Edited by: user4483647 on 02-sep-2010 12:59
Edited by: user4483647 on 02-sep-2010 13:25

If I'm not wrong, Basic authentication is Transport level feature. So passing User/Password in SOAPHeader doesn't make sense. SOAP message can only be sent when you have a HTTP Connection open. During opening of HTTP connection User/Password is required for basic authentication.
http://www.student.nada.kth.se/~d95-cro/j2eetutorial14/doc/Security7.html#wp156943
Edited by: mneelapu on Apr 2, 2009 2:09 PM

Basic Authentication for Non-AD Users

Similar Messages

Maybe you are looking for