Checking if user is logged in to Apex from an alien application

Hi,
I have the following scenario:
In an Apex 3.0 application, there is a link that opens a new window and, using javascript, redirects the user to a servlet (currently running in Tomcat but we may move it to an Oracle AS in the future) in the same server. The URL for the servlet contains some parameters in it, but the user never sees the URL so that should not be an issue. The URL looks like this:
http://server/theservlet/do?username=luis&session=1827376465&action=home
However, obviously this is not 100% secure and it is possible to get to that URL, for instance aborting the redirection and looking at the page source. Malicious users could then tamper with the URL and do malicious things.
One of the parameters I am passing to the servlet is the Apex session ID. One thing that I thought was, in the servlet code, to check who that session belongs to and see if it is the same person trying to access the servlet. I know that I can connect to the DB and check in the Apex views if that session exists and if it is assigned to that user. However, someone with access to the DB could look at the same view and use an existing session to access the servlet as someone else.
Ideally, I should also check the cookie in the user's machine to be completely sure, but I am not sure how to do it...
If anyone can help, or have a better idea on how to implement this "poor man's single sign on", that would be much appreciated!
Thanks,
Luis

...this is not 100% secure and it is possible to get to that URL...Ways to get that URL:
1. Right-click on new page, select view page info
2. Firebug Addon for FireFox
3. Web Developer Addon for Firefox
4. Live Headers Addon for Firefox
5. Wireshark
6. Any web proxy tool
My estimate is that it's about 1% secure.
I'm not sure just reading the cookie is enough either, since those can be spoofed. Are these systems on the same domain (ie, *.oracle.com)? If not, one domain can't access another domain's cookies. If they are on the same domain, the first thing that comes to mind is to set some value in the cookie that is a very strongly encrypted version of the username and the date. You can then use the same algorithm and key in the servlet to decrypt it and verify that it's a valid session for today.
A better long-term strategy would be to look into an Identity Management system. I'm not pushing Oracle's or anything (full disclosure, I work for Oracle), but IDM is the heart of any good security strategy.
Tyler

Similar Messages

Automatically Log In to APEX from another site

Check out this code:
<FORM method="POST" action="http://whatever.com:1234/pls/apex/wwv_flow_custom_auth_std.login">
<input name="p_flow_page" type="hidden" value="104:1">
Username: <input name="p_uname" type="text" value="yourusername"><br>
Password: <input name="p_password" type="password"><br>
<input type="submit" value="Login to APEX">
</FORM>
If you save this code on any website (even on a different server), people can use the form to log into your APEX application.
The problem though, is when you change your Authentication Scheme to something other than the default.
I'm using a custom Auth Scheme, and it works great for normal logins, but it unfortunately breaks the above code. Anyone have any ideas on what to change in the above HTML to fix this?

Scott,
I'm using APEX v3.0.0.00.20
My custom auth scheme uses an Authentication Function that returns a boolean.
Under "Authentication Function" on the Authentication Schemes Page, I have:
return apps.validate_login_bool
which basically checks if the user/pass is in my custom table. No other changes were made to the login page.
The custom auth scheme works (meaning it only lets people log in if they use their user/pass from my custom table), but only if they go to the APEX login page, and manually type their credentials.
If a user uses the HTML form above to login, they are brought to the URL http://whatever.com:1234/pls/apex/wwv_flow_custom_auth_std.login, which shows a pure white page, regardless of whether they use a valid username/password to login.

Not able to log in on Apex from a diferent PC

Hi,
On Friday my instance of Oracle Express XE (4.0) worked fine
On Monday I received a call saying that 'Page not found' appears when users are trying to connect to a specific Apex application. (actually all apps are unavailable, including apex home page)
When I'm starting the application from the server I have no problem, everything works fine.
When I'm moving to another pc within the local network I received 'Page not found'
Server respond to pings ok
I'm not a technical guy, can you please give me some start up actions for debugging.
The Network admin is telling me that nothing has been done over the weeend, and the problem is on the Apex (I don't buy that)
Thank you very much,
Florin

Check you installation documentation to find required ports then ask to you network admin what happened ... or at least add exceptions to only allow required ports.
Please, check if this is the correct doc: http://docs.oracle.com/cd/E17781_01/install.112/e18803.pdf
2.1.2 Windows Firewall Configuration
If you plan to install Oracle Database XE onto a computer running Windows Firewall, which was first introduced in Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, and then connect to it from another computer, check that the firewall has not been configured to block communication from the following incoming ports. These ports are the default ports that Oracle Database XE users
- 1521: Oracle Database Listener
- 2030: Oracle Services for Microsoft Transaction Server
- 8080: Oracle HTTP Transaction Server

Guest user account logged into while away from house/computer!!!

Warning: I am not a tech-pro!
Okay, I have a 2011 Mac Book Pro running OS X LION 10.75 (11G63) unsure what those last numbers mean but they were there so I thought perhaps it might be helpful to add them.
Recently I moved into a granny flat and pay $10 a week to use their unlimited internet wifi. I log into my wifi through this device called a WiFi Repeater? It's plugged into the wall in my unit, as I warned I am not incredibly tech savvy so I am only guessing when I say I suppose this extends the main wifi signal from the actual home owners upstairs big modem? Any who.... A few times I have seen in the Finder Memu ot says 'Shared' and under that 'Wendys PC' (Wendy is the homeowner) then if you click on it it tries to connect but won't or there is a 'Connect As' option which brings up a little screen saying - connect as wendy, which requires a password or connect as guest which doesn't look like it requires a password- I'm not certain because I've never tried to connect any further, I only pressed that initial connect button when I had mentioned to Wendy I could see her PC & she asked me to press connect & prove I could not in fact connect (I'm starting to despise the word 'connect' since having to type this post about connection). So... We just kind of let it go. It did really worry me that Wendy (who worked in the tech field for years in particular with an Internet provider, could possibly connect to my computer and nosey through all my files- and to be honest, that would not actually suprise me. She is incredibly 'inquisitive'... And that's putting it mildly. I do have a password on my Mac Book Pro but I don't think that would be that hard to break through/hack if you have the knowledge/software. And yes, I do have confidential files on there! Banking/business/private photos (I'm trying to lose weight so take one nude photo per day to do a time lapse of myself in a year or two- obviously for myself not for others eyes lol and I would literally die in the *** if someone ever saw these). So basically I have good reason to protect my privacy. As does everyone! Anyway my first question is - Could she log in and how could I tell if she had? Now, the second part of this ridiculously long question (my apologies) is I was logged into my personal account all last night & this morning. As I stated- it IS password protected. The user account is not. Before I went out (and I can't actually recall if I closed the lid or not when I rushed out today... Usually I do but maybe I didnt... Whatevs) So, I get home and activate the screen by moving my finger on the touch pad and lo & behold I'm straight away looking at a totally different screen? It took me a few seconds to realise why my desktop looked completely different with none of my files etc... It was - as you've probably guessed- because I was in fact in the guest user account. Now, I didn't even have to click ON 'Guest User' as I normally have to. When you turn my Mac on it always comes up with - 'My Full Name' (one account login) and then 'Guest User' (the second account login option).... So you HAVE to choose which one you want! But my screen was straight away logged into the Guest Users desktop! I did NOT do this guys! So, of course now I'm extremely concerned that either she, her husband or their son whom is visiting for the weekend - have either a) logged in remotely on one of their computers or b) have come into my home and tried logging in & then forgot to log out of the guest account. I want to know if there is any way to find out what they did, what they opened if they did, how to stop it from both happening at all or if my suspicions are in fact happeninh AGAIN And I guess on a more personal, less tech involved note - how would you all deal with such a situation? Let it go? Or be upfront about the fears/concerns I am experiencing since moving in just over a month ago. AND most importantly - IS there any other reason -other than someone physically logging into my guest user account & failing/forgetting to log back out so that when I got home & activated my screen I was actually looking at the guest user desktop's account instead of the Mail application screen in the 'My Full Name' password protected user account where I had actually left it before rushing out.... Like, is there ANY other possibly explanation for my user account being logged into when I'd left it on my own account t before I left that doesn't include someone in the house hacking/breaking into/snooping through my Mac? Also- you should understand that when I leave my Mac for just a few minutes I have it set up so that the computer screen 'sleeps' (I'm assuming that's the correct term) so that if for instance -exactly like this morning- I have to rush out and don't want to/don't have time to save work/quit applications/shut down etc... I can walk away leaving the laptop as is knowing within a few minutes the screen saver comes up (and if that's ledr for long enough it goes into sleep mode) and no one can actually enter my private account without my password. I feel safe knowing that.
Sorry.... I FELT safe.
I'm truly sorry for how long-winded this question has become, I simply wanted to give anyone possibly willing to help me sort out this issue, as much information as possible. I think I have actually only posted here once before (I find these sort of forums quite intimidating) and I often see people getting bashed for not providing enough information. So, I'm pretty sure I'll get picked on for too many words if anything!!?! Lol
Thank you, in advance for your help!
Olivia;-).

Ouch.
Not easily. You could try data recovery software... maybe SubRosaSoft's File Salvage or the like.

How to check users are logged in SBO

Hi Experts,
Is there a way to check 'active' users are logged in SBO?
Thanks in advance,
Chief

Hi,
Actually there is no standard way to find out the logged User, there is a Work Around it is.
One way of checking is to goto
Administration -> License -> License Administrator on the Left side of the User list... If any user name is in Gray in Color then it means that user has logged on.
Hope this Information Helps you Out.
Regards,
Shreyas

How to check whether User is alreadylogged in or not

Hi..I want to check whether Particular User is already logged in or not ?? I had userid,password and status in my database.
If anybody shows me how to implement it ??
Reggards
Chintan

If you want to prevent multiple logins happening, use a profile on the database server that limits a login to a set number of simultaneous connections.
If you just ant to check which users are logged in, the v$session table will have that information.
Justin
Distributed Database Consulting, Inc.
http://www.ddbcinc.com/askDDBC

Network users cannot log in to server

I have set up a new server from scratch on a new Macmini. In the main, it works absolutely fine. Users can log into the sever from client device as registered user and can share the screen with no problem.
The users are set up as local network users and are in a local group and a network group. I set them up using Workgroup manager after setting up Open directory. All users cn be seen from OD and WM. However, they cannot log in to the server directly - only the server adminstrator can do that. Home drives etc are all set up fine.
Any help will be greatly appreciated.
F

Administrators always have access, you may have blocked Network Users from having access using Workgroup Manager 10.8.
Open Workgroup Manager 10.8
Authenticate to the local directory as an administrator.
Go to the machines section and select the server where users cannot log in.
Click the preferences icon to see the preferences for that computer set through WM 10.8
From the overview choose Login.
Choose the Access tab and set Manage: to Never.
Message was edited by: Mark23

What's the best way to check whether a user is logged in or not?

I have a question about basic session handling.
I'm running Tomcat 5.0.30 and have a web application where users can register with a username and password, and then log into a "member site".
What is the best way of making sure that a user actually has logged in or not?
What I've done in previous applications I've made is that I've just put a simple variable into the users session after he has successfully entered his password (i.e. Boolean loggedIn=true). Then I just test if this flag is true to grant him access to the member site. Is that a smart way of doing it?
Are there any libraries I can use which handles sessions for me in a secure way?
All comments and suggestions are appreciated!

Maintain a flag using session attributes it to one when the user is logs in set it to value.... and change set it zero or invalidate that session... when the user is logged out...
use something like this while user had logged in
session.setAttribute("flag",<unique_number>);
for checking whether the user had logged in or not...
if(Integer.parseInt(session.getAttribute("flag").toString())=!<unique_number>){
out.println("The session had expired");
out.close();
}

How to check ,how many users are logged in and logged out in oracle ebs 11i/R12.

Hi Experts,
Kindly let me know
how to check ,how many users are logged in and logged out in oracle ebs 11i/R12.
Also, in the database level too ,Do we need to write any trigger for this?
Thanks in advance.

Hi,
How to check ,how many users are logged in and logged out in oracle ebs 11i/R12.
Please check the following links:
Oracle EBS - Number of Users logged into EBS / Oracle Applications currently
List all users currently logged in on Oracle EBS
Also see forum Search:
Forum Search: Logged In EBS User
Also, in the database level too
Please see:
https://forums.oracle.com/message/9225094#9225094
Do we need to write any trigger for this?
Yes you may, But I personally suggest you not to do so as it may affect performance.
Thanks &
Best Regards,

Checking delete datafile's log from oracle i.e. deleted from root user.

Can any body help me finding the log for checking any trace for datafiles that are deleted from root user in hp-ux server ( and the sys log has alredy been modified by root user ).
So is there is any way to check through database or server level to check the trace of deleted datafiles files log.

user13390258 wrote:
Thanks, In our project we are using finace 7 application and as it does't support hot backup so we are doing cold backup of database. Through HP RSM software. And we do not have RMAN backup also. Actually i am not geeting proof to show that file has been deleted from ROOT user.I don't know what a "finace 7" application is, but your assertion that it doesn't support a hot backup makes no sense. A backup of the database, and how it is accomplished, should be of no concern to the app.
As for your statement "we don not have RMAN backup also" ... well, it looks like now you are seeing the cost of that decision. One would hope that once you get through this crisis you would take it upon yourself to institute proper database backups, because - as the dBA - your first and most important job is to insure the security of the database. I never depend on any backup scheme anyone else claims to have in place. If they want to do something they claim will backup the database, fine. But I know that when the excrement hits the ventilation system, it's MY butt on the line to recover the database, so I am d*** well going to be taking rman backups.

Help - auto check user is logged in?

Hello,
I have a servlet that validates a users id and password and creates a session userid variable.
I want to add logic to other servlets to verify the user is logged in, if not kick them to a login page.
What is the best way to check in a servlet?
Can I use a bean to return true or false?
How do the more experienced java web programmers do it?
Thanks for the help.
Frank

No code required. There is a whole section in the Servlet spec about this.
You specify that certain urls (or patterns) are only for certain roles. You specifiy the login mechanism (BASIC, FORM, DIGEST).
Then you assign the role to users and groups and off you go.
All safely within web.xml - no code required.

To check the users logged in to system.

Hi Team
I had an ECC6.0 with windows environment, some users have logged via sapgui, and some users are logged through portal, Its fine.
Now i need to find the no of users logged into the system i.e the gui and portal users,
I know the gui users can find out through al08,
How to find the web or portal users
Is there any meathod to check, Please advice me on this.
Regards,
Bhaskar.T

In OS level, go to the directory usr/sap/<SID>/<INSTANCE>/j2ee/admin
You will see go.bat (windows) or go (unix). Execute these to start the visual administrator.
Also, read through the following for more information.
http://help.sap.com/saphelp_nw04/helpdata/EN/39/83682615cd4f8197d0612529f2165f/frameset.htm
Regards,
Jazz

WSUS scheduling auto reboot check since no user is logged on.

is there any way of stopping windows updates reboots when no user is logged on ?
started adding servers to update via WSUS and reboot when no user is logged on.
and logging off non active sessions is some sort of security requirement.
so.....
thanks

You can change your WSUS download type for those servers with client side targeting.
Change it to the download but do not restart option. Then set it to whichever works best for you.
Probably Option 2 or 4.
Notify for download and notify for install. This option notifies a logged-on administrative user before you download and install the updates.
Auto download and notify for install. This option automatically begins downloading updates and then notifies a logged-on administrative user before installing the updates. By default, this option is selected.
Auto download and schedule the install. This option automatically begins downloading updates and then installs the updates on the day and time that you specify.
Allow local admin to choose setting. This option lets local administrators to use Automatic Updates in Control Panel to select a configuration option. For example, they can choose a scheduled installation time. Local administrators cannot
disable Automatic Updates.
http://technet.microsoft.com/en-us/library/hh852346.aspx#BKMK_ConfigureAU

SAPJSF user cannot log-on to the User Management Engine.

We have a newly installed PI 7.0 system.
SLDCHECK is succussful but if we go to the http://hostname:50100/sld - we are redirected to http://hostname:50100/logon/logonServlet?redirectURL=%2Fwebdynpro%2Fdispatcher%2Fsap.com%2Ftc%7Esld%7Ewd%7Emain%2FMain
When we check the default.trc file, we see the error: User "SAPJSF" is the communication user for the connection between User Management Engine and the ABAP backend system SIDCLNTxyz. This user cannot log-on to the User Management Engine.
The SAPJSF user is not locked in SU01. This user is used by the JCO providers to connect to the gateway service.
We opened Visual Administrator and navigated to Server0 -> Services -> UM Provider
We changed the password property at ume.r3.connection.master.passwd
We then restarted the ABAP and J2EE engine. But we still see this error.
Any help to solve this issue is appreciate.
Jay Malla

Hi,
Please, refer the link below. It says you cannot logon with SAPJSF user to J2EE engine for security reasons.
http://help.sap.com/saphelp_nw2004s/helpdata/en/4e/225b42eeb66255e10000000a155106/frameset.htm
Thanks
R.Murali

How to check SSO user from database?

Hi:
I've posted this topic in Forms forum:
How to check SSO user from database?
then as I've been told, it's better to post it here, so ...... here is the question:
I'm writing a "before delete trigger" to insert into log table before delete. Is there a way that I know from database the current SSO user when SSO users share one database user?
Just like in Oracle Application Express there is v('APP_USER') to know the current user.
Saad,

End users are manipulating data through Oracle Forms(and SSO through portal) and the thing I need is to trace the SSO username from database without modifying forms, I mean purely from database taking into consideration that SSO users are sharing one database user. Is it possible?
Saad,

Checking if user is logged in to Apex from an alien application

Similar Messages

Maybe you are looking for