Big Security Hole - Seesion ID Anonyous User Registration

Hi,
This is a serious security vulnerability with IdM Anonymous Registration. When a new user is trying to register through IdM on the anonymous user registration, the session id generated has a pattern which can be easily hijacked by attackers to retrieve the data entered in the forms.
The following are the urls which are been generated in different sessions for new user registration.
https://domain.com/idm/user/anonWorkItemEdit.jsp?id=*%23ID%23D728DF8F73C051F4%3A51EF2C64%3A11BE5FE3A73%3A-4596*
https://domain.com/idm/user/anonWorkItemEdit.jsp?id=*%23ID%23D728DF8F73C051F4%3A51EF2C64%3A11BE5FE3A73%3A-4590*
https://domain.com/idm/user/anonWorkItemEdit.jsp?id=*%23ID%23D728DF8F73C051F4%3A51EF2C64%3A11BE5FE3A73%3A-4589*
Please suggest how to over come or generate random Session ids.

Usually this refers to the workflow or workitem id. I think there is no security issue here. It is a standard practice that you invoke a workflow for anonymous registration or any anonymous process. Then in the workflow you have to implement approvals and validations so that no weird user gets an account. Apart from that this should have an entry in AnonymousUserTasks configuration. Any workflow in this configuration file should have strong validations and approvals implemented.

Similar Messages

  • Sudo has a big security hole in 10.5.2

    I noticed that Leopard does NOT require a password when invoking something under sudo if you are in the /etc/sudoers file. This is different than any other *nix I have ever seen. Even Tiger required a password each time sudo was invoked. This opens a pretty big hole in Leopard. All someone has to do is get into your system as a sudoer and all bets are off.

    Sterling Garwood wrote:
    I noticed that Leopard does NOT require a password when invoking something under sudo if you are in the /etc/sudoers file.
    Not on any Leopard that I have seen. A user in the sudoers file must enter his password to use sudo. That 's how it has always been in all version of OS X. If that's not the case on your Mac then something is seriously broken.

  • Potential Security Hole with 802.1x and Voice VLANs?

    I have been looking at 802.1x and Voice VLANs and I can see what I think is a bit of a security hole.
    If a user has no authentication details to gain access via 802.1x - i.e. they have not been given a User ID or the PC doesn't have a certificate etc. If they attach a PC to a switchport that is configured with a Voice VLAN (or disconnect an IP Phone and plug the PC direct into the switchport) they can easily see via packet sniffing the CDP packets that will contain the Voice VLAN ID. They can then easily create a Tagged Virtual NIC (via the NIC utilities or driver etc) with the Voice VLAN 802.1q Tag. Assuming DHCP is enabled for the Voice VLAN they will get assigned an IP address and have access to the IP network. I appreciate the VLAN can be locked down at the Layer-3 level with ACL's so any 'non-voice related' traffic is blocked but in this scenario the user has sucessfully bypassed 802.1x authentication and gain access to the network?
    Has anyone done any research into this potential security hole?
    Thanks
    Andy

    Thanks for the reply. To be honest we would normally deploy some or all of the measures you list but these don't around the issue of being able to easily bypass having to authenticate via 802.1x.
    As I said I think this is a hole but don't see any solutions at the moment except 802.1x on the IP Phone, although at the moment you can't do this with Voice VLANs?
    Andy

  • MS Office secretly connects to my Mac and scans my activity. How??? Security hole? Exploitable by hackers?

    I have a strange problem. All by itself it's not so serious, but it concerns me that it reveals a security hole which can be exploited by hackers.
    I may be over-reacting, so any reassurance or explanation would be appreciated.
    Here's the situation:
    I have a MacBook Pro running OSX 10.6.5. I also have a new MacBook Air also running 10.6.5. I recently used Migration Assistant to move all my applications from the MacBook Pro to the MacBook Air. The migration worked fine with one very troubling exception.
    One of the applications that got migrated was MS Office 2008 (MSWord, Excel, etc.). When I just had my MacBook Pro, MS Office worked fine. Also, now, if my MacBook Pro is turned off and I'm just using my Air, MS Office again works fine.
    HOWEVER...if I have my MacBook Pro open and running MS Office on it, and then I simultaneously open my Air and try to launch MS Office, I get an error message that says
    "Microsoft Office 2008 for Mac cannot start because Microsoft Office is already in use.
    An office program is being used by Apple Mac. Your installation exceeds the number of installations permitted by the license agreement."
    However, if I then "Quit" MS Office on the Pro, and then try to launch it on the Air, I don't get the error message, and it works as normal. The same thing happens if I switch computers -- if it's running on the Air first, then I can't launch it on the Pro. Basically, only one of the computers can run MS Office at any one time.
    Now, the issue about the MS license agreement is not what concerns me -- I guess the version of MS Office I bought back in 2008 was only supposed to be installed on one single computer, and never migrated to a new computer (I eventually plan to use the Air full time and retire the Pro). I'm probably going to get a newer version of MS Office eventually anyway, and also I almost never use both computers at the same time, so I'm not worried about being unable to use MS Office on both computes simultaneously. No, what worries me is this:
    How does MS Office on one computer even know that my other computer is running and has MS Office open?
    I'm not an expert on networks and sharing and connectivity and all that, so excuse me if I use inaccurate terminology, but...:
    Both computers connect via AirPort to a cable modem and thus share the same wifi hotspot to connect to the internet.
    But as far as I can tell, the two computers are not "connected" to each other. In the System Preferences for both computers, in the "Sharing" panel, all File Sharing is off. Also, none of the sharing boxes are checked.
    Neither computer shows the hard drive of the other on its Desktop. If I wanted to, I could use Finder's "Go" menu, choose "Connect to server," then "Browse," then find the other computer, double-click on it, type in the admin password, and then connect the two computers. But I haven't done that, and MS Office is able to see what the other comoputer is doing, even when they aren't connected in any way (as far as I can tell).
    I find this pretty disturbing. How in the world does the MS Office on one computer even know that the other computer exists? Furthermore, how does it know that the other computer is on and running? And lastly and more importantly, how does it know which programs are running on the other computer?
    One extra detail: in order to try to diagnose this odd behavior, I installed a program called "Little Snitch" which monitors all network activity and notifies the user whenever any malware programs or other sneaky behind-the-scens apps try to send data over your connection without your knowledge. Little Snitch seems to work great but when I test the problem after installing it, Little Snitch did not even detect or report that MS Office was doing any surreptitious network snooping. So whatever MS Office is doing, it's doing it pretty sneakily.
    Here is my worry: Could a hacker somehow exploit this capability of MS Office to monitor activity on my computer without my being aware of it? Or could someone re-adapt this snooping code from MS Office for more nefarious purposes?
    Or am I completely misapprehending the situation somehow?
    Any  reassurance or explanation would be greatly appreciated! Thanks.

    But my question is: How does the software do that?
    It scans the local network for computers trying to "share" software that is only supposed to be licensed for one computer. I can't give you a technical answer, I can just tell you that's what it's doing.
    then what's preventing less ethical coders from deploying similar but more sinister malware with the same capability?
    Nothing. Any vendor of any software, from a one person shareware or freeware app to a company the size of Apple, Microsoft or Adobe could sneak in damaging code. Any company that wants to stay in business though would never allow it.
    In a typical software company (particularly larger ones), you have not only the people who write the code, but also system analysts who review the code looking for flaws or anything else that shouldn't be there.
    Now I have the fear that if I'm using a wifi hotspot in a cafe or wherever, someone else with hacking skills on that same hotspot could basically see what I'm doing on my computer, without my knowledge.
    The software to pry (they hope undetected) into other folks' computers on an open network like that has been around for years. That's why you at least need to have your firewall enabled when using a wifi hotspot.

  • Possible Login Screen Security Hole in Lion?

    I think that I have found a glitch in the login screen in Lion that allows a user to hack in to an account without a password! It appears to occur on Macbooks with OS X Lion and here is how to reproduce it:
    Make sure that you account is password-protected and that you require a password 5 seconds after the screen saver/sleep begins. Also, be sure that you have the default "hot corner" settngs and OS X Lion. Lastly, make sure that Finder is on the farthest left icon on your dock and that your screen saver is set to spectrum!
    Close all open windows to see your desktop.
    Now, close you Macbook lid, wait 10 seconds, and open it up. You should see a screen similar to the one shown below, but with your wallpaper & info: 
    Now forcefully (yes, forcefully) restart your Mac by pressing down command, control, and the power button at the same time.
    Wait for your Mac to start up and you should see the same screen you saw (like the image above.)
    Click in the battery/time/wifi signal/etc. area in the top right corner without mousing over the courner.
    Now, mouseover the top right corner of the screen, as it will launch some kind of odd "mission control". From there, ANYONE can control your Mac without seeing your screen. From there, mouse over where you think Finder is on the dock (in the bottom-left corner of the dock) without mousing over and corners of the screen and click it. That SHOULD launch finder on your Mac.
    The login screen should reappear! (Odd, isn't it?)
    Now, mouseover the bottom-left corner and hold esc as soon as the screen turns completely dark. If sucessful, you should see your screensaver show up. While holding esc, move your mouse around towards the bottom-right corner. You should see your cursor over top of the "wheel of doom".
    The screen should flicker and you have hacked in to your account! Funny, isn't it?
    You should see finder over top of your desktop if you located finder correctly in step 7! Cool?
    If you are not sucessful, restart the entire process from step 4 and skip steps 7-8. If it doesn't work out for you after a few attemps, give up! Let's not waste any time on hacking in to an account (unless you are a hacker.)
    Is it just me or can anyone else reproduce this? If it occurs (or not), please list your Macbook's specs and details in a reply.

    jonathan_2005 wrote:
    One of the options in the security panel permits a user to require that a username and password be entered to login once the screen saver locks your account.
    The option is "Require password to wake this computer from sleep or screen saver"
    Although one would assume that the credentials required to wake the computer is the username/password of the account that was being used when the computer went into sleep mode or the screen saver.
    Never assume
    WRONG!!! Anyone with an account on the machine can enter their username/password and wake the computer and voila that user now has control of the machine as the former user. That's right you guessed it HUGE security hole.
    Anyone with a standard user account? Are you quite sure?
    Anyone thinking that they can wake away from their machine and have the screen saver or sleep mode protect their account after a specified period of time is sadly mistaken. Anyone with an account on the machine can enter their own username and password and drop right into your account right where you left off.
    I never think that way. A more secure lock is ensured by using the screen lock feature of the keychain.
    Can you believe this stuff?
    Not sure what stuff you refer to.
    No warning, no release note to tell you of such a poorly designed "security" option.
    Would you believe that anyone can access your computer? Stolen computers are regularly started up without much problem.
    Apple please fix what must have been an oversight or at least tell people about this intentional design BEFORE they find anyone can wake the computer and become you as a user.
    You are writing to other users like yourself here, not Apple.
    I also presume you are new to the Mac world.

  • Can you confirm a security hole in file sharing?

    I have found a very annoying security hole, and I wonder if it is unique to my setup. I have my mini set up with file sharing turned on. It has 5 accounts, one administrator, rest ordinary users. My login for the administrative user on my laptop is the same as on the mini. I have not turned on "Back to my Mac."
    From my laptop I navigate to the mini using either (a) the network panel in finder, (b) the local IP (afp://192.168.0.xxx), or the global IP (afp://64.xxx.xxx.xxx). (My router is set up to forward the appropriate ports to the mini's local IP). I mount the administrative user's home directory under apple file sharing. Now I have full access to these files. I DO NOT SAVE THE PASSWORD IN KEYCHAIN. All this is as it should be.
    Now I eject the administrator disk.
    From now on (until I reboot my laptop), I can mount that same disk without a password!
    Can someone confirm?

    {quote:title=William Lloyd wrote:}This is not a security hole.{quote}
    While I can understand that some may consider Kerberos automagically creating what is essentially a keychain without the users express knowledge or consent a "feature", I definitely consider it a bug and a huge security hole.
    The kerberos ticket should not live longer then the user is actually connected to the machine. Currently, if the user clicks the Disconnect button the Kerberos ticket lives on and any future connections to that server will user that ticket. This is not what users (especially novice to intermediate) would expect. If the user clicks the Disconnect button, then they would expect that they are completely disconnected and any further connections to that server would require authentication. Otherwise they leave their machine wide open, hense the security hole.
    The other thing that makes this so nasty is that if the OS decides not to use kerberos, for whatever reason, the behavior is different. It behaves as the user would expect. Clicking Disconnect does completely disconnect you from the server and any future connections will require authentication. So at a minimum there is a dangerous inconsistency in behavior between when the OS uses Kerberos and when it doesn't. That, at a minimum, should be fixed.

  • IGS: Vulnerability "security hole in level 3"

    Hi!
    We are using SAP ERP 6.0 system with an ingetrated IGS 7.0
    We already changed IGS according to sap note 896400 to the version 7.00 (Patch 15)
    When we run scan on demand we get the following information: 
    A security hole in level 3 was found at server ServerX.
    Vulnerability-Level [highest]: 3
    Vulnerability-Level [highest counted]: 0
    Vulnerability Details
    Date: Sun 10 May 2009  1:26:13 MET
    Vuln: 300803
    Vulnerability: SAPXPG Remote OS Command Execution at sysnr 3
    ToDo: Set up a project to implement access restriction rules to RFC programs
    with the 'secinfo' and 'reginfo' (only available in SAP Netweaver) mechanism
    CertRef: M906071, SAP 30/08
    Tool Reference: proprietary CERT and IPINS scanner
    Comment:
    Counted in: 2009-07
    Monitor:
    Date: Sun 10 May 2009  1:26:17 MET
    Vuln#: 100806
    Vulnerability: External Server Registration is possible at sysnr 3
    ToDo: Secure remote registration of RFC programs (only possible in SAP Basis
    7.00 and later)
    CertRef: M906071
    Tool Reference: proprietary CERT and IPINS scanner
    Comment:
    Counted in: 2009-07
    Monitor:
    Date: Sun 10 May 2009  1:26:17 MET
    Vuln#: 101802
    Vulnerability: IGS HTTP Administration is enabled and this version has
    reported vulnerabilities at sysnr 3
    ToDo: Upgrade to a higher patch level, i.e., for BC-FES-IGS 6.40 Patch Level
    17 or higher and for  BC-FES-IGS 7.00 Patch Level 07 or higher
    CertRef: SAP 34/09
    Tool Reference: proprietary CERT and IPINS scanner
    Comment:
    Counted in: 2009-07
    Monitor:
    End of Vulnerability Details
    Question:
    What we have to do to avoid s security holein level 3?
    Thank you very much!
    regards

    Do you solved tye probllem below. ???  Can you help me.
    I have the same problem.
    What the format of secinfo, reginfo and what value to to profile gw/reg_no_conn_info ??
    Thanks,
    Vulnerability Details
    Date: Sun 10 May 2009 1:26:13 MET
    Vuln: 300803
    Vulnerability: SAPXPG Remote OS Command Execution at sysnr 3
    ToDo: Set up a project to implement access restriction rules to RFC programs
    with the 'secinfo' and 'reginfo' (only available in SAP Netweaver) mechanism
    CertRef: M906071, SAP 30/08
    Tool Reference: proprietary CERT and IPINS scanner
    Comment:
    Counted in: 2009-07
    Monitor:

  • IGS: Vulnerability (security hole in level 3 was found)

    Hi!
    We are using SAP ERP 6.0 system with an ingetrated IGS 7.0
    We already changed IGS according to sap note 896400 to the version 7.00 (Patch 15)
    When we run scan on demand we get the following information: 
    A security hole in level 3 was found at server ServerX.
    Vulnerability-Level [highest]: 3
    Vulnerability-Level [highest counted]: 0
    Vulnerability Details
    Date: Sun 10 May 2009  1:26:13 MET
    Vuln: 300803
    Vulnerability: SAPXPG Remote OS Command Execution at sysnr 3
    ToDo: Set up a project to implement access restriction rules to RFC programs
    with the 'secinfo' and 'reginfo' (only available in SAP Netweaver) mechanism
    CertRef: M906071, SAP 30/08
    Tool Reference: proprietary CERT and IPINS scanner
    Comment:
    Counted in: 2009-07
    Monitor:
    Date: Sun 10 May 2009  1:26:17 MET
    Vuln#: 100806
    Vulnerability: External Server Registration is possible at sysnr 3
    ToDo: Secure remote registration of RFC programs (only possible in SAP Basis
    7.00 and later)
    CertRef: M906071
    Tool Reference: proprietary CERT and IPINS scanner
    Comment:
    Counted in: 2009-07
    Monitor:
    Date: Sun 10 May 2009  1:26:17 MET
    Vuln#: 101802
    Vulnerability: IGS HTTP Administration is enabled and this version has
    reported vulnerabilities at sysnr 3
    ToDo: Upgrade to a higher patch level, i.e., for BC-FES-IGS 6.40 Patch Level
    17 or higher and for  BC-FES-IGS 7.00 Patch Level 07 or higher
    CertRef: SAP 34/09
    Tool Reference: proprietary CERT and IPINS scanner
    Comment:
    Counted in: 2009-07
    Monitor:
    End of Vulnerability Details
    Question:
    What we have to do to avoid s security holein level 3?
    Thank you very much!
    regards

    Do you solved tye probllem below. ???  Can you help me.
    I have the same problem.
    What the format of secinfo, reginfo and what value to to profile gw/reg_no_conn_info ??
    Thanks,
    Vulnerability Details
    Date: Sun 10 May 2009 1:26:13 MET
    Vuln: 300803
    Vulnerability: SAPXPG Remote OS Command Execution at sysnr 3
    ToDo: Set up a project to implement access restriction rules to RFC programs
    with the 'secinfo' and 'reginfo' (only available in SAP Netweaver) mechanism
    CertRef: M906071, SAP 30/08
    Tool Reference: proprietary CERT and IPINS scanner
    Comment:
    Counted in: 2009-07
    Monitor:

  • HUGE SECURITY HOLE IN LOGIN FROM SCREEN SAVER

    One of the options in the security panel permits a user to require that a username and password be entered to login once the screen saver locks your account.
    The option is "Require password to wake this computer from sleep or screen saver"
    Although one would assume that the credentials required to wake the computer is the username/password of the account that was being used when the computer went into sleep mode or the screen saver. WRONG!!! Anyone with an account on the machine can enter their username/password and wake the computer and voila that user now has control of the machine as the former user. That's right you guessed it HUGE security hole.
    Anyone thinking that they can wake away from their machine and have the screen saver or sleep mode protect their account after a specified period of time is sadly mistaken. Anyone with an account on the machine can enter their own username and password and drop right into your account right where you left off.
    Can you believe this stuff? No warning, no release note to tell you of such a poorly designed "security" option.
    Apple please fix what must have been an oversight or at least tell people about this intentional design BEFORE they find anyone can wake the computer and become you as a user.
    Thanks,
    JH

    jonathan_2005 wrote:
    One of the options in the security panel permits a user to require that a username and password be entered to login once the screen saver locks your account.
    The option is "Require password to wake this computer from sleep or screen saver"
    Although one would assume that the credentials required to wake the computer is the username/password of the account that was being used when the computer went into sleep mode or the screen saver.
    Never assume
    WRONG!!! Anyone with an account on the machine can enter their username/password and wake the computer and voila that user now has control of the machine as the former user. That's right you guessed it HUGE security hole.
    Anyone with a standard user account? Are you quite sure?
    Anyone thinking that they can wake away from their machine and have the screen saver or sleep mode protect their account after a specified period of time is sadly mistaken. Anyone with an account on the machine can enter their own username and password and drop right into your account right where you left off.
    I never think that way. A more secure lock is ensured by using the screen lock feature of the keychain.
    Can you believe this stuff?
    Not sure what stuff you refer to.
    No warning, no release note to tell you of such a poorly designed "security" option.
    Would you believe that anyone can access your computer? Stolen computers are regularly started up without much problem.
    Apple please fix what must have been an oversight or at least tell people about this intentional design BEFORE they find anyone can wake the computer and become you as a user.
    You are writing to other users like yourself here, not Apple.
    I also presume you are new to the Mac world.

  • Facing issue on request submission from Self user registration with workflow.

    HI Everyone,
    We have a use case where in User Registration process has a two stage workflow.
    In the first stage approver(Common admin) would open the request and approve it updating the organization to which the user belongs to and the the work flow should be routed to the selected organization admin in the second stage based on the org selected in the first level of approval.
    For this we have devloped a workflow and applied the same and now facing the issue once the request moves to Second level for approval.
    Request gets failed.
    Below is the exception found on clicking Request status from Track Requests.
    Can you kindly let me know any possible resolution to resolve this.

    Error log :
    IAM-2050126 : Invalid outcome com.oracle.bpel.client.BPELFault: faultName: {{http://schemas.oracle.com/bpel/extension}runtimeFault} messageType: {{http://schemas.oracle.com/bpel/extension}RuntimeFaultMessage} parts: {{ summary=<summary>oracle/iam/platform/OIMClient</summary> ,detail=<detail>java.lang.NoClassDefFoundError: oracle/iam/platform/OIMClient
    at orabpel.approvalprocess.ExecLetBxExe0.execute(ExecLetBxExe0.java:195)
    at com.collaxa.cube.engine.ext.bpel.common.wmp.BPELxExecWMP.__executeStatements(BPELxExecWMP.java:47) 
    at com.collaxa.cube.engine.ext.bpel.common.wmp.BaseBPELActivityWMP.perform(BaseBPELActivityWMP.java:173) 
    at com.collaxa.cube.engine.CubeEngine.performActivity(CubeEngine.java:2718)
    at com.collaxa.cube.engine.CubeEngine._handleWorkItem(CubeEngine.java:1197)
    at com.collaxa.cube.engine.CubeEngine.handleWorkItem(CubeEngine.java:1100)
    at com.collaxa.cube.engine.dispatch.message.instance.PerformMessageHandler.handleLocal(PerformMessageHandler.java:76) 
    at com.collaxa.cube.engine.dispatch.DispatchHelper.handleLocalMessage(DispatchHelper.java:251) 
    at com.collaxa.cube.engine.dispatch.DispatchHelper.sendMemory(DispatchHelper.java:330) 
    at com.collaxa.cube.engine.CubeEngine.endRequest(CubeEngine.java:4652)
    at com.collaxa.cube.engine.CubeEngine.endRequest(CubeEngine.java:4583)
    at com.collaxa.cube.engine.CubeEngine._createAndInvoke(CubeEngine.java:714)
    at com.collaxa.cube.engine.CubeEngineSecurityManager$2.run(CubeEngineSecurityManager.java:101) 
    at java.security.AccessController.doPrivileged(Native Method)
    at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:324)
    at oracle.security.jps.internal.jaas.AccActionExecutor.execute(AccActionExecutor.java:74) 
    at oracle.security.jps.internal.jaas.AbstractSubjectSecurity$ActionExecutorWrapper.execute(AbstractSubjectSecurity.java:242) 
    at oracle.security.jps.internal.jaas.CascadeActionExecutor$SubjectPrivilegedExceptionAction.run(CascadeActionExecutor.java:83) 
    at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363) 
    at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:146) 
    at weblogic.security.Security.runAs(Security.java:61)
    at oracle.security.jps.wls.jaas.WlsActionExecutor.execute(WlsActionExecutor.java:51) 
    at oracle.security.jps.internal.jaas.CascadeActionExecutor.execute(CascadeActionExecutor.java:56) 
    at oracle.security.jps.internal.jaas.AbstractSubjectSecurity$ActionExecutorWrapper.execute(AbstractSubjectSecurity.java:242) 
    at com.collaxa.cube.engine.CubeEngineSecurityManager.performActionAsSubject(CubeEngineSecurityManager.java:79) 
    at com.collaxa.cube.engine.CubeEngine.createAndInvoke(CubeEngine.java:555)
    at com.collaxa.cube.engine.delivery.DeliveryService.handleInvoke(DeliveryService.java:531) 
    at com.collaxa.cube.engine.ejb.impl.CubeDeliveryBean.handleInvoke(CubeDeliveryBean.java:319) 
    at sun.reflect.GeneratedMethodAccessor4136.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:606)
    at com.bea.core.repackaged.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:310) 
    at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182) 
    at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149) 
    at com.oracle.pitchfork.intercept.MethodInvocationInvocationContext.proceed(MethodInvocationInvocationContext.java:103) 
    at oracle.security.jps.ee.ejb.JpsAbsInterceptor$1.run(JpsAbsInterceptor.java:113) 
    at java.security.AccessController.doPrivileged(Native Method)
    at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:324)
    at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:460) 
    at oracle.security.jps.ee.ejb.JpsAbsInterceptor.runJaasMode(JpsAbsInterceptor.java:100) 
    at oracle.security.jps.ee.ejb.JpsAbsInterceptor.intercept(JpsAbsInterceptor.java:154) 
    at oracle.security.jps.ee.ejb.JpsInterceptor.intercept(JpsInterceptor.java:113) 
    at sun.reflect.GeneratedMethodAccessor1077.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:606)
    at com.bea.core.repackaged.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:310) 
    at com.oracle.pitchfork.intercept.JeeInterceptorInterceptor.invoke(JeeInterceptorInterceptor.java:68) 
    at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171) 
    at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131) 
    at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119) 
    at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171) 
    at com.oracle.pitchfork.spi.MethodInvocationVisitorImpl.visit(MethodInvocationVisitorImpl.java:34) 
    at weblogic.ejb.container.injection.EnvironmentInterceptorCallbackImpl.callback(EnvironmentInterceptorCallbackImpl.java:54) 
    at com.oracle.pitchfork.spi.EnvironmentInterceptor.invoke(EnvironmentInterceptor.java:42) 
    at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171) 
    at com.bea.core.repackaged.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:89) 
    at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171) 
    at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:131) 
    at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:119) 
    at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171) 
    at com.bea.core.repackaged.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204) 
    at com.sun.proxy.$Proxy330.handleInvoke(Unknown Source)
    at com.collaxa.cube.engine.ejb.impl.bpel.BPELDeliveryBean_5k948i_ICubeDeliveryLocalBeanImpl.__WL_invoke(Unknown Source)
    at weblogic.ejb.container.internal.SessionLocalMethodInvoker.invoke(SessionLocalMethodInvoker.java:39) 
    at com.collaxa.cube.engine.ejb.impl.bpel.BPELDeliveryBean_5k948i_ICubeDeliveryLocalBeanImpl.handleInvoke(Unknown Source)
    at com.collaxa.cube.engine.dispatch.message.invoke.InvokeInstanceMessageHandler.handle(InvokeInstanceMessageHandler.java:30) 
    at com.collaxa.cube.engine.dispatch.DispatchHelper.handleMessage(DispatchHelper.java:141) 
    at com.collaxa.cube.engine.dispatch.BaseDispatchTask.process(BaseDispatchTask.java:89) 
    at com.collaxa.cube.engine.dispatch.BaseDispatchTask.run(BaseDispatchTask.java:65) 
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615) 
    at com.collaxa.cube.engine.dispatch.Dispatcher$ContextCapturingThreadFactory$2.run(Dispatcher.java:933) 
    at java.lang.Thread.run(Thread.java:745) </detail> ,code=<code>java.lang.NoClassDefFoundError</code>} cause: {oracle/iam/platform/OIMClient} received from SOA for the request id 214.

  • User Registration Forbidden Error

    I followed*Automating User Registration* section in John Edward Scott and Scott Spendolini's book Pro Oracle Application Express and receive a Forbidden error:
    >
    FORBIDDEN
    You don't have permission to access pls/apexcfp8/confirm.oca_sec.verify_user on this server
    >
    I did grant execute to apex_public_user (i.e., grant execute on oca_sec to apex_public_user)
    I am running APEX 3.2 , Oracle 10g (0.2.0.4.0) database, and 10.1.2.0.0 Oracle HTTP Server.
    Can someone please assists?
    Robert
    http://apexjscss.blogspot.com

    Jari,
    My DBA reverted back the changes and commented out as you suggested but it still doesn't work.
    The current configuration has the following:
    PlsqlRequestValidationFunction wwv_flow_epg_include_moduels.authorize
    How do I modify it so it will allow my procedure to fire?
    The documentation states:
    >
    3.1.1 Defining the PlsqlRequestValidationFunction Directive in mod_plsql
    mod_plsql provides a DAD parameter directive called PlsqlRequestValidationFunction which enables you to allow or disallow further processing of a requested procedure. This is useful for implementing tight security for your PL/SQL application by blocking package/procedure calls which should not be allowed to run from the DAD.
    The function defined by this parameter must have the following prototype:
    boolean function_name (procedure_name IN varchar2)
    When invoked, the argument 'procedure_name' will contain the name of the procedure that the request is trying to run.
    For example, if all the PL/SQL application procedures that can be called from a browser are inside the package "mypkg", then a simple implementation of this function can be as shown in Example 3-1:
    Example 3-1 Implementation of Request Validation Function to Block Procedures
    boolean my_validation_check (procedure_name varchar2)
    is
    begin
    if (upper(procedure_name) like upper('myschema.mypkg%')) then
    return TRUE;
    else
    return FALSE;
    end if;
    end;
    >
    How do I implement this? Please help.
    Thank you.
    Best Regards,
    Robert
    http://apexjscss.blogspot.com
    Edited by: sect55 on Oct 18, 2010 10:29 AM

  • Disable preferences option to temporarily save documents (security hole?)

    Hi Adobe Community,
    we have a project where we want to use Adobe Acrobat X as Scan-Software for secure content. With the help of a predefined action, the scan gets directly encrypted.
    The problem that we have with this approach, is that there is a preference option that allows to temporarily save the document in regular time periods (1-99 minutes). If this option can be activated by the end-user, there may be secure content on the hard drive of the PC without encryption. This would be a security hole - therefore the question:
    Can this preference be deactivated by default from the central IT. Effectively, only 2 workstations in a special secure area need to have this special configuration.
    Thanks & Best Regards
    Kristian

    Simple answer - no. Users can always access their preferences.

  • SQ02 Infoset - security hole - authority

    Hi,
    I have heard, that SQ02 (creating Infosets) has several security holes (regarding authorizations). Does anybody know about it and could specify these holes?
    Thanks
    Markus

    HI,
    When u create an infoset, you attach user group to the infoset. In user group, you specify multiple users that can have access to your infoset and query.
    So these multiple users can have access to ur infoset and then can change the code.
    But if you restrict the authorisation to users and not allow them to change or create queries using ur infoset.
    object S_QUERY Revokes authorization to change or create queries for a specific user.
    Hope this will help u.
    Reward points if its helpful
    Thanks,
    Vijay

  • SQ02 Infoset - security hole

    Hi,
    I have heard, that SQ02 (creating Infosets) has several security holes (regarding authority). Does anybody know about it and could specify these holes?
    Thanks
    Markus

    Hi
    Steps on how to proceed to create a Query:
    ADHOC QUERY
    A query can be created to extract information from master records  i.e  Infotypes.  For example, by creating a query , the data relating to an employee contained in various Infotypes can be extracted.
    Proceedure :  
    Decide on  the various Infotypes we  want to make the query.  Decide on the area where we  want to query  i.e  Global area or Standard area.  Standard area is client specific and globel area will include all clients.
    Menu : HR – PM – Admn -  Information System -  Adhoc Query
    Select area standard and select the  user group already created
    Creation of new query  :  
    TC SQ03  -  Select Environment – Select Standard Area -  Enter  --  If new user group is to be created, enter name of the user group, click on create and enter necessary information and  exit after saving
    TC SQ02  -  Enter name of the Infoset – Create – enter name of Infoset -  Data source -- >  Table join by basis table – give name of table e.g  pa0000 -  Enter -  Click on insert table if we  want to include more tables – give name of table one by one and after finishing,  place cursor on the joining lines and right click to delete unwanted relationships  - check  - and go back  - field groups  -  include all table fields  - click on generate button   -  go out
    TC SQ03  -  Select user group  -   eg.  Payroll
    Infoset  - Enter name of newly created Infoset 
    Assign users and Infosets  -  Assign infosets  -  put tick on payroll  - save and go back
    TC  PAAH  -  Expand the nodes and put tick on relevant fields depending upon necessity
    Save the query  by giving the same name as infoset for easyness..
    Use
    The InfoSet Query is designed for reporting on data stored in flat tables. It is particularly useful for reporting on joins for master data and joins for ODS objects.
    Prerequisites
    You must take the following steps before you can create Infoset queries:
    ·        Set up Roles for the InfoSet Query
    ·        Process Classic InfoSets and Assign Roles
    Procedure
    Define the InfoSet Query
           1.      Call the Query Builder. There are various ways of doing this:
    To call the Query Builder from the corresponding role menu or from the BEx Browser, double-click on the InfoSet Query entry in the menu that is created when you set up a role.
    Developers and testers of Classic InfoSets are able to call up the Query Builder directly from the Classic InfoSet overview in the Administrator Workbench.
    If several Classic InfoSets are assigned to a role, and one of them has been identified as a standard Classic InfoSet, this Classic InfoSet is used as a template when the query is called up. To change the template, choose Create New Query – Classic InfoSet Selection. Any of the Classic InfoSets that are assigned to the role can be the new template.
           2.      Define your query. The procedure is similar to the procedure for defining queries in the BEx Analyzer.
    Transfer individual fields from the field groups you have selected in the Classic InfoSet into the preview. To do this, use the drag and drop function, or highlight the relevant fields in the field list.
    Use either of these two methods to select any fields you want to use as filters. These fields are displayed in the Selections area of the screen (top right).
    When you are preparing the query, only example data is displayed in the Preview. When you choose the Output or Refresh function, the actual results are displayed on the same screen.
           3.      Execute the query.
           4.      Choose from the following options:
    Ad hoc reporting
    You do not want to save the query for later. Save the Query Builder without saving.
    Reusable queries
    You want to save the query, because you want to work on it later, or use it as a template. Use either the Save or the Save as function to save the query.
    In addition to the Classic InfoSets that you assigned to the role, you are also able to use the query as a template. It is not possible, however, to access the query from other roles.
    After you save the query, a second dialog box appears, asking you if you want to save the query as a separate menu entry within the role. If you choose this option, you are able to start the query directly from the user menu or from the BEx Browser. It is also possible to use the Role Maintenance transaction (PFCG) to save this kind of role entry.
    Choose Menu ® Refresh to display the query.
    If you want to change or delete the saved query, use the Edit function from the context menu in the BEx Browser to call the maintenance tool for InfoSet Queries with this query as a template.
    InfoSet Query on the Web
    It is possible to publish each InfoSet Query on the Web. There are the following display options:
    ·        MiniALV for creating MiniApps in the SAP Workplace
    ·        MidiALV without selection options
    ·        MidiALV with selection options
    Both the MiniALV and the MidiALV allow you to switch between various selection/layout variants. The publishing screen for the data is adjusted individually using URL parameters.
    The following prerequisites are necessary for security reasons:
    Releasing the query for the Web
    Specifying an authorization group for the corresponding Classic InfoSet
    Call up transaction RSQ02 InfoSet: Entry, and choose Go to ® Additional Functions ® Web Administration of Queries. Make the corresponding entries.
    Reward all helpfull answers
    Regards
    Pavan

  • User registration and editing posts

    Hi everyone,
    I have a site that people can register on and post there information.
    I am using php and mysql.
    I want people to be able to EDIT their information they posted but ONLY their information, noone elses.
    the user registration works great and they are able to add their information.
    Basically this is for a car club site, and car clubs can register and post their city state, chapter, and web address etc.
    but alot of the people are messing up when they try to post their info and I am not sure how to give the poster the ability to edit their OWN information, if someone could help me out with this or point me in the right direction that would be great!
    Thanks
    Dave

    Hi Dave,
    what a coincidence : I´ve just published a new tutorial called "Protecting your application: Update my Account", and it explains the steps to make it a secure procedure:
    http://www.guenter-schenk.com/tutorials/tutorial.php?id=8
    Cheers,
    Günter Schenk
    Adobe Community Expert, Dreamweaver

Maybe you are looking for

  • How can I import an old iMovie from '09 to '11?

    PLEASE! I've been trying FOREVER to try to get this imovie project that I was working on to import to my new updates iMovie application because my school reimages our computers every year so I saved it to a harddrive but when I tried to open it, it j

  • Syncing error - Please Help!

    I have an iPod touch that I'm trying to put music on from my itunes. When I try to sync music to it, an error message pops up(Ipod cannot sync - unknown error - 13019). The advice I got was to deselect "sync" under music, but I'm afraid it will delet

  • HT1338 Time Machine - local backups

    I have a 2TB Time Machine connected to one Macbook with a 750GB hard drive... Since Time Machine setup, the local Macbook drive seems to have been completly consumed... Could this be due to "local" backup images on the Macbook?  How do I clean it up?

  • Applications Stack

    I have had OS X Leopard on my computer since it was released, and for a while I had all of my apps in dedicated stacks. Recently I was cleaning up my computer and discovered DragThing and started using that instead, until it was suggested that I remo

  • Fn:replace JSTL tag trick for replacing carrige returns....how?

    Hi I have some <textarea> input that I would like to format for display. My question is: How can I use fn:replace tag to replace carriage returns to so that formatted input looks like exactly as entered in by user? Doing string.replaceAll("\r\n|\n","