Ejb security role & bea implementation

A role has been defined in ejb-jar as following:
<security-role>
<description><![CDATA[Deployer User]]></description>
<role-name>deployer</role-name>
</security-role>
<method-permission>
<description><![CDATA[Deployer Method Permission]]></description>
<role-name>deployer</role-name>
<method>
<description><![CDATA[All method for CCPStateBean]]></description>
<ejb-name>CCPStateBean</ejb-name>
<method-name>*</method-name>
</method>
</method-permission>
If the principal is included in the weblogic-ejb-jar as below, and the jndi lookup
includes the SECURITY_PRINCIPAL (e.g., jzhu), the code works fine.
<security-role-assignment>
<role-name>deployer</role-name>
<principal-name>jzhu</principal-name>
</security-role-assignment>
The problem comes when the principal is not included as above weblogic-ejb-jar
instead a role "deployer" is defined in WLS's, The user ("jzhu") is defined in
the deployer group. And the deployer group belongs to deployer role. The defaultRoleMapper
is enabled. In this scenario, the access failed due to insufficient permission.
Can ejb-jar's role relates to WLS's role. Please advise. THX.
-John

Thanks for the information. It works. I wish bea monitor this newsgroup since this
is not in their document. By the way, the following links clarifies the relationship
between DD and admin console security configuration.
http://edocs.bea.com/wls/docs70/security/cli_apps.html#1090734
-John
"Arjuna Chala" <[email protected]> wrote:
I don't know about "defaultRoleMapper", but this works
<security-role-assignment>
<role-name>deployer</role-name>
<principal-name>deployer</principal-name>
</security-role-assignment>
where <role-name> maps to a ejb-jar role and <principal-name> maps to
a
weblogic group (in this case).
"john" <[email protected]> wrote in message
news:[email protected]..
A role has been defined in ejb-jar as following:
<security-role>
<description><![CDATA[Deployer User]]></description>
<role-name>deployer</role-name>
</security-role>
<method-permission>
<description><![CDATA[Deployer Method Permission]]></description>
<role-name>deployer</role-name>
<method>
<description><![CDATA[All method for CCPStateBean]]></description>
<ejb-name>CCPStateBean</ejb-name>
<method-name>*</method-name>
</method>
</method-permission>
If the principal is included in the weblogic-ejb-jar as below, andthe
jndi lookup
includes the SECURITY_PRINCIPAL (e.g., jzhu), the code works fine.
<security-role-assignment>
<role-name>deployer</role-name>
<principal-name>jzhu</principal-name>
</security-role-assignment>
The problem comes when the principal is not included as aboveweblogic-ejb-jar
instead a role "deployer" is defined in WLS's, The user ("jzhu") isdefined in
the deployer group. And the deployer group belongs to deployer role.The
defaultRoleMapper
is enabled. In this scenario, the access failed due to insufficientpermission.
Can ejb-jar's role relates to WLS's role. Please advise. THX.
-John

Similar Messages

  • Problem mapping LoginModule roles to ejb security roles

    I have "successfully" managed to implement the DBSystemLoginModule. When I run my application I successfully authenticate to the database, the login module successfully retrieves the users roles from the database and adds them to the subject:
    PassiveCallbackHandler cbh = new PassiveCallbackHandler(username, password);
    LoginContext lc = new LoginContext("current-workspace-app", cbh);
    lc.login();
    I then perform a lookup on a bean using the same user:
    Hashtable env = new Hashtable();
    env.put(Context.INITIAL_CONTEXT_FACTORY, "oracle.j2ee.rmi.RMIInitialContextFactory");
    env.put("java.naming.security.principal",username);
    env.put("java.naming.security.credentials",password);
    env.put("java.naming.provider.url", "ormi://localhost:23891/current-workspace-app");
    Context ic = new InitialContext(env);
    final SessionEJBHome sessionEJBHome =
    (SessionEJBHome) PortableRemoteObject.narrow( ic.lookup( "SessionEJB" ), SessionEJBHome.class );
    Finally, I create an instance of the bean and call a method of this bean.
    SessionEJB sessionEJB;
    sessionEJB = sessionEJBHome.create( );
    sessionEJB.testMe( );
    I am expecting (hoping) that the roles retrieved from the database by the login module may be used to authenticate the ejb methods. i.e. if (in ejb-jar.xml) the method "testMe" has a method-permission with role-name of "ABC" then this method may only be accessed if the user is a member of the "ABC" role retrieved from the database by the login module. However I get the message:
    "username is not allowed to call this EJB method"
    When I add a security-role-mapping in orion-ejb-jar.xml mapping the role "ABC" to the group "ABC" (and impliesALL="true") then the method is called successfully. However, if I add a security-role-mapping mapping the role "DEF" to the group "DEF" (which the user is not a member of) the ejb method is (wrongly) called successfully (with implies all="false" the method always fails). In other words there seems to be no mapping of the roles retrieved by the login module to the ejb security roles.
    Can anyone please enlighten me on how I can achieve the mapping of the ejb security roles to the roles obtained from the login module.
    Thanks
    PS I have this problem with JDeveloper 10.1.3 (Developer Preview 10.1.3.0.2.223 and Early Access 10.1.3.0.3.3412)

    Hi Sebastian,
    yes, it is possible to do such mapping. And here how it works:
    1. define security roles in the ejb-jar.xml within the <security-role>. For example:
    <security-role>
         <role-name>test</role-name>
    </security-role>
    2. then you map the roles those roles to server security roles using the <security-role-map> tag of the ejb-j2ee-engine.xml descriptor.
    <security-permission>
       <security-role-map>
          <role-name>test</role-name>
          <server-role-name>myUMErole</server-role-name>
       </security-role-map>
    </security-permission>
    the myUMErole must be defined in the UME!
    Does this answer your question?

  • Retrieve ejb security roles list

    Hi,
    in a EJB stateless session bean is it possible to retrieve, by EJB context, the list of configured roles related to the current user?
    Thanks in advance.
    bye
    Rob

    Based on the link given here is the xml. This XML already exists in the application and has such structure
    <security-permission>
       <security-role-map>
          <role-name>developer</role-name>
          <server-role-name>role1</server-role-name>
          <server-role-name>role2</server-role-name>
          <server-role-name>role3</server-role-name>
          <server-role-name>role4</server-role-name>
          <server-role-name>role5</server-role-name>
       </security-role-map>
    </security-permission>
    My question is, which of the following annotation will work:
    @RolesAllowed(value=)
    or
    @RolesAllowed(value=)  //currently I am using this.
    Edited by: Arpit Goyal on Feb 27, 2009 4:39 AM

  • EJB security roles

    Hello,
    I am using JDeveloper 3.2.2 to deploy EJBs to an 8.1.7 DB. Could someone point me in the direction of some documentation that would explain the concept of security roles and users for EJB methods? Do the users have to map to real users in the DB or how are they handled etc.
    Thanks in advance,
    - Nik

    Based on the link given here is the xml. This XML already exists in the application and has such structure
    <security-permission>
       <security-role-map>
          <role-name>developer</role-name>
          <server-role-name>role1</server-role-name>
          <server-role-name>role2</server-role-name>
          <server-role-name>role3</server-role-name>
          <server-role-name>role4</server-role-name>
          <server-role-name>role5</server-role-name>
       </security-role-map>
    </security-permission>
    My question is, which of the following annotation will work:
    @RolesAllowed(value=)
    or
    @RolesAllowed(value=)  //currently I am using this.
    Edited by: Arpit Goyal on Feb 27, 2009 4:39 AM

  • Warning: EJB  referenced an unknown security role?

    Hello,
    I get a weird error from WL 5.1 (SP6), using the default WLPropertyRealm.
    In the EJB I have the following check:
    if (ctx.isCallerInRole("ConspiratorRole"))
    System.out.println ("the user is in the ConspiratorRole role");
    At run time, I get the following warning in the WL window:
    Fri Nov 10 12:56:58 EST 2000:<I>
    <EJB JAR deployment D:/weblogic/myserver/myBean.jar>
    Warning: EJB "unu" referenced an unknown security role
    However:
    - the role IS defined (see ejb-jar.xml)
    - has an associated principal (see weblogic-ejb-jar.xml)
    - there is a principal defined in weblogic.properties
    - this principal (and this role) is actually used in practice to access the
    bean. Which works.
    So why the warning?
    Any hint appreciated,
    Thanks.
    ejb-jar.xml:
    <assembly-descriptor>
    <security-role>
    <description>description of the ConspiratorRole</description>
    <role-name>ConspiratorRole</role-name>
    </security-role>
    </assembly-descriptor>
    weblogic-ejb-jar.xml:
    <weblogic-ejb-jar>
    <security-role-assignment>
    <role-name>ConspiratorRole</role-name>
    <principal-name>Conspirator</principal-name>
    </security-role-assignment>
    </weblogic-ejb-jar>

    You should not reference the role link in you code.The role link is used to
    connect the role name in you code to the
    role name in your deployment descripment. Only if this link is set up as you
    have done below, will the isCallerInRole return true.
    - Sri
    Alf wrote:
    I reviewed older postings and found indications of what appears to be a bug
    in WL: that isCallerInRole always return false for role names but returns
    correct values if the role names are linked with a reference in
    <security-role-ref>. So, according to the DTD at
    http://edocs.bea.com/wle/dd/ddref.htm#1038338 I added the following in
    ejb-jar.xml:
    <ejb-jar>
    <enterprise-beans>
    <session>
    <security-role-ref>
    <role-name>ConspiratorRole</role-name>
    <role-link>ConspiratorRoleLink</role-link>
    </security-role-ref>
    and added 2 lines in the bean to test the both the role and the reference
    if (ctx.isCallerInRole("ConspiratorRole"))
    System.out.println ("the user is in the ConspiratorRole role");
    if (ctx.isCallerInRole("ConspiratorRoleLink"))
    System.out.println ("the user is in the ConspiratorRoleLink
    role");
    The unexpected result was a NullPointerException at
    weblogic.ejb.internal.BaseEJBContext.isCallerInRole(BaseEJBContext.java:665)
    Can anyone shed some light? Thanks.
    "Alf" <alf> wrote in message news:[email protected]...
    Hello,
    I get a weird error from WL 5.1 (SP6), using the default WLPropertyRealm.
    In the EJB I have the following check:
    if (ctx.isCallerInRole("ConspiratorRole"))
    System.out.println ("the user is in the ConspiratorRole role");
    At run time, I get the following warning in the WL window:
    Fri Nov 10 12:56:58 EST 2000:<I>
    <EJB JAR deployment D:/weblogic/myserver/myBean.jar>
    Warning: EJB "unu" referenced an unknown security role
    However:
    - the role IS defined (see ejb-jar.xml)
    - has an associated principal (see weblogic-ejb-jar.xml)
    - there is a principal defined in weblogic.properties
    - this principal (and this role) is actually used in practice to accessthe
    bean. Which works.
    So why the warning?
    Any hint appreciated,
    Thanks.
    ejb-jar.xml:
    <assembly-descriptor>
    <security-role>
    <description>description of the ConspiratorRole</description>
    <role-name>ConspiratorRole</role-name>
    </security-role>
    </assembly-descriptor>
    weblogic-ejb-jar.xml:
    <weblogic-ejb-jar>
    <security-role-assignment>
    <role-name>ConspiratorRole</role-name>
    <principal-name>Conspirator</principal-name>
    </security-role-assignment>
    </weblogic-ejb-jar>

  • Configure security-role and method permission for EJB 3.0 using Jdev 11g

    The EJB 3.0 session bean created by Jdev 11g EJB wizard does not have ejb-jar.xml. Where and how can security-role and method permission for the EJB be configured?
    For example,
    <assembly-descriptor>
    <security-role>
    <role-name>managers</role-name>
    </security-role>
    <method-permission>
    <role-name>managers</role-name>
    <method>
    <ejb-name>Employees</ejb-name>
    <method-name>setSalary</method-name>
    <method-params>
    <method-param>java.lang.Long</method-param>
    </method-params>
    </method>
    </method-permission>
    </assembly-descriptor>

    user516954,
    By default annotations are used. However, you can create a new descriptor and that will take presidence over any declared annotation.
    --Ric                                                                                                                                                                                                                                                                                                                               

  • Weblogic security role

    Hi,
    I have a need to restrict access for certain users in WL will be OBIEE admins so they don't need access to the WL console but do need access to EM specifically coreapplication to deploy a new .rpd
    Ive tried an tire but just cant get a role to allow such specific access can any one shed some light. Any role i have created or configured allows access to em but then doesn't allow access to coreapplication from what I can see only the administrator role has the privillage.

    Chandramohan V <[email protected]> writes:
    Hai,
    I am chandramohan. I very new to Weblogic. I want some sample code for EJB Security(Basic level).There are samples in the kit and on dev2dev.bea.com
    andy

  • J2EE, get all security roles

    On a J2EE application server (preferable from in a Servlet, but EJB is also fine), how do I get an array or list of all security roles?
    I want to present the user who creates for example a forum topic to define which roles can view it.

    On a J2EE application server (preferable from in a
    Servlet, but EJB is also fine), how do I get an array
    or list of all security roles?
    I want to present the user who creates for example a
    forum topic to define which roles can view it.Short answer: You cant, because there is no such functionality mandated by either the servlet or the ejb specs.
    Long answer: You can, but it will be particular to the registry implementation you use, and will also mandate some naming scheme to map between for example ldap groups and authentication roles.
    Br - J

  • How to use security roles in Weblogic server?

    Hello Gurus,
    I am new to Weblogic server and I am trying to investigate how to make
    use of security roles in weblogic server (5.1.0). Can anyone point me
    to some documentation. Specifically, I am looking for instance level,
    and method level security and how to use it.
    Thanks for taking your time to read this e-mail.
    Thank You all in advance,
    Hari.

    You should read the security information in the Servlet 2.2 specification
    that WL 5.1 implements:
    http://java.sun.com/products/servlet/download.html
    Chapter 11 deals with declarative and programmatic security, and includes a
    section on roles:
    11.4 Roles
    A role is an abstract logical grouping of users that is defined by the
    Application Developer or
    Assembler. When the application is deployed, these roles are mapped by a
    Deployer to security
    identities, such as principals or groups, in the runtime environment.
    A servlet container enforces declarative or programmatic security for the
    principal associated with
    an incoming request based on the security attributes of that calling
    principal. For example,
    1. When a deployer has mapped a security role to a user group in the
    operational environment. The
    user group to which the calling principal belongs is retrieved from its
    security attributes. If the
    principal's user group matches the user group in the operational environment
    that the security
    role has been mapped to, the principal is in the security role.
    2. When a deployer has mapped a security role to a principal name in a
    security policy domain, the
    principal name of the calling principal is retrieved from its security
    attributes. If the principal is
    the same as the principal to which the security role was mapped, the calling
    principal is in the
    security role.
    Cameron Purdy
    http://www.tangosol.com
    "Hari" <[email protected]> wrote in message
    news:[email protected]..
    Hello Gurus,
    I am new to Weblogic server and I am trying to investigate how to make
    use of security roles in weblogic server (5.1.0). Can anyone point me
    to some documentation. Specifically, I am looking for instance level,
    and method level security and how to use it.
    Thanks for taking your time to read this e-mail.
    Thank You all in advance,
    Hari.

  • Security-role and security-role-assignment not working in WL7.0

    Hello all..
    Some EJB components that worked fine in WebLogic 6.1 no longer work in
    WL7.0. It has to do with the security-role and security-role-assignment
    descriptor elements no longer allowing anonymous users to be included in the
    authorization for a bean.
    For example, in WL6.1 placing these items in ejb-jar.xml:
    <assembly-descriptor>
    <security-role>
    <role-name>Employees</role-name>
    </security-role>
    <method-permission>
    <role-name>Employees</role-name>
    <method>
    <ejb-name>CustomerEJB</ejb-name>
    <method-name>*</method-name>
    </method>
    </method-permission>
    and mapping WebLogic default users to this role in weblogic-ejb-jar.xml:
    <security-role-assignment>
    <role-name>Employees</role-name>
    <principal-name>guest</principal-name>
    <principal-name>system</principal-name>
    </security-role-assignment>
    worked fine for clients creating their context using a simple
    InitialContext() constructor without specifying SECURITY_PRINCIPAL or
    SECURITY_CREDENTIALS. These users were basically "guest" to WebLogic, and
    the security-role-assignment element above told WebLogic that "guest" was in
    the Employees role for purposes of this EJB archive.
    Worked in WL6.1, no longer works in WL7.0. Client receives typical
    permission exception:
    java.rmi.AccessException: Security violation: insufficient permission to
    access method 'create'
    If I explicity connect as "system" things are fine, or I can create a new
    user in the default realm in WebLogic, put a matching <principal-name>
    element in the section above, and connect as that user. Note that if I leave
    off the <security-role> section completely, or set the required role name to
    "everyone", the anonymous access works fine. Apparently the anonymous user
    is a member of "everyone" behind the scenes even though "everyone" does not
    appear in the realm list of groups or roles.
    So, my question boils down to this: Is there a "magic" username in WL7 like
    "guest" was in WL6.1 that can be mapped to the required role name, or must
    every client connection use a true weblogic-created user with appropriate
    role assignments used to map it to the required role name.
    -Greg
    P.S. Note that none of the EJB examples provided with WL used
    <security-role>..
    Check out my WebLogic 6.1 Workbook for O'Reilly EJB Third Edition
    www.amazon.com/exec/obidos/ASIN/1931822468 or www.titan-books.com

    Below are the screen shots for PFCG:

  • How can I know the security role of the logged in user

    When you design an enterprise bean or Web component, you should always think about the kinds of users who will access the component. For example, an Account enterprise bean might be accessed by customers, bank tellers, and branch managers. Each of these user categories is called a security role, an abstract logical grouping of users that is defined by the person who assembles the application. When an application is deployed, the deployer will map the roles to security identities in the operational environment.
    But wondering when I log into my application with some user name and password (specified in my Oracle database),wondering how this works with the security role I created .How does J2EE know the security role of the logged in user.
    Thanks
    Manohar

    shet wrote:
    role at run time.
    When I login say as "manju" and password as "money" then how does it know that this user belongs to this security role.Is that the j2ee administrator has to say that user manju has this this security role.Programmitically how does it really work.I am confusedThe j2ee implementation assigns the roles using the JAAS module you have configured for your application on your application server. different JAAS modules get roles in different ways. many allow a single static role to be assigned using a config file. if using a database, often there will be configuration to specify additional database fields which specify the role for a given username.
    At runtime, a developer can test roles using methods like EJBContext.isCallerInRole().

  • Redirecting user to acustom page depending on security role after glassfish

    Hi,
    I have a JSF application using glassfish authentication mechanism. I'm planning to use a jdbc realm and form based authentication (I'm using a jsp page to get username and password) . I have 3 different user roles (student, admin and staff)
    However I cannot find how to redirect a user to a different page (Ex: staff report page if the logged in user is in the security role staff). I have configured sun-web.xml and web.xml to map the roles and groups. The problem is after authentication the user is always redirected back to the home page, which is the login page. I understand this is how the glassfish authentication works by default. But is there a way to navigate the user to a different page depending on his role.
    I'm new to EJB security. Please help me on this subject. Thanks a lot in advance.

    Check this blog post, which provides an alternate solution (You can choose the best possible solution based on your use-case).
    http://andrejusb.blogspot.com/2007/10/security-in-oracle-adf-and-automatic.html
    Thanks,
    Navaneeth

  • Security role with alias KeystoreAdministrator does not exist.

    i have a error trying to start  the java engine of a Solution Manager 4.0 SR2 on AIX with ibm jdk SR9
    the next log is about the std_server0.out
    i do not how to create the alias because i can not connect using Visual Administrator because the server not start
    stdout/stderr redirect
    node name   : server0
    pid         : 995354
    system name : SMS
    system nr.  : 00
    started at  : Wed Aug 13 18:26:36 2008
    [Thr  1] Wed Aug 13 18:26:37 2008
    [Thr  1] MtxInit: -2 0 0
    <?xml version="1.0" ?>
    <verbosegc version="200708_30">
    SAP J2EE Engine Version 7.00   PatchLevel 108458.44 is starting...
    Loading: LogManager ... 2643 ms.
    Loading: PoolManager ... 2 ms.
    Loading: ApplicationThreadManager ... 837 ms.
    Loading: ThreadManager ... 54 ms.
    Loading: IpVerificationManager ... 12 ms.
    Loading: ClassLoaderManager ... 14 ms.
    Loading: ClusterManager ... 226 ms.
    Loading: LockingManager ... 68 ms.
    Loading: ConfigurationManager ... 86617 ms.
    Loading: LicensingManager ... 28 ms.
    Loading: CacheManager ... 159 ms.
    Loading: ServiceManager ...
    Loading services.:
      Service cross started. (75 ms).
      Service memory started. (98 ms).
      Service runtimeinfo started. (115 ms).
      Service trex.service started. (87 ms).
      Service file started. (156 ms).
      Service timeout started. (159 ms).
      Service userstore started. (19 ms).
      Service jmx_notification started. (78431 ms).
      Service p4 started. (188119 ms).
      Service classpath_resolver started. (63 ms).
    <af type="nursery" id="1" timestamp="Wed Aug 13 18:32:05 2008" intervalms="0.000">
      <minimum requested_bytes="48" />
      <time exclusiveaccessms="1.635" />
      <nursery freebytes="0" totalbytes="209715200" percent="0" />
      <tenured freebytes="1724342296" totalbytes="1728053248" percent="99" >
        <soa freebytes="1637940248" totalbytes="1641651200" percent="99" />
        <loa freebytes="86402048" totalbytes="86402048" percent="100" />
      </tenured>
      <gc type="scavenger" id="1" totalid="1" intervalms="0.000">
        <flipped objectcount="253990" bytes="19242624" />
        <tenured objectcount="0" bytes="0" />
        <refs_cleared soft="644" weak="1" phantom="0" />
        <finalization objectsqueued="1363" />
        <scavenger tiltratio="50" />
        <nursery freebytes="190330424" totalbytes="209715200" percent="90" tenureage="10" />
        <tenured freebytes="1724342296" totalbytes="1728053248" percent="99" >
          <soa freebytes="1637940248" totalbytes="1641651200" percent="99" />
          <loa freebytes="86402048" totalbytes="86402048" percent="100" />
        </tenured>
        <time totalms="107.395" />
      </gc>
      <nursery freebytes="190328376" totalbytes="209715200" percent="90" />
      <tenured freebytes="1724342296" totalbytes="1728053248" percent="99" >
        <soa freebytes="1637940248" totalbytes="1641651200" percent="99" />
        <loa freebytes="86402048" totalbytes="86402048" percent="100" />
      </tenured>
      <time totalms="110.754" />
    </af>
      Service deploy started. (4055 ms).
      Service bimmrdeployer started. (7 ms).
      Service MigrationService started. (70 ms).
      Service log_configurator started. (194277 ms).
      Service locking started. (8 ms).
      Service http started. (295 ms).
      Service naming started. (626 ms).
      Service failover started. (112 ms).
      Service appclient started. (140 ms).
      Service javamail started. (218 ms).
      Service ts started. (220 ms).
      Service jmsconnector started. (207 ms).
      Service licensing started. (22 ms).
      Service connector started. (212 ms).
      Service configuration started. (32 ms).
      Service iiop started. (316 ms).
      Service webservices started. (706 ms).
      Service dbpool started. (25283 ms).
    <af type="nursery" id="2" timestamp="Wed Aug 13 18:33:36 2008" intervalms="91291.585">
      <minimum requested_bytes="768" />
      <time exclusiveaccessms="0.302" />
      <nursery freebytes="0" totalbytes="209715200" percent="0" />
      <tenured freebytes="1723791376" totalbytes="1728053248" percent="99" >
        <soa freebytes="1637389328" totalbytes="1641651200" percent="99" />
        <loa freebytes="86402048" totalbytes="86402048" percent="100" />
      </tenured>
      <gc type="scavenger" id="2" totalid="2" intervalms="91293.279">
        <flipped objectcount="353647" bytes="28752016" />
        <tenured objectcount="0" bytes="0" />
        <refs_cleared soft="1056" weak="0" phantom="0" />
        <finalization objectsqueued="2858" />
        <scavenger tiltratio="50" />
        <nursery freebytes="180516672" totalbytes="209715200" percent="86" tenureage="11" />
        <tenured freebytes="1723791376" totalbytes="1728053248" percent="99" >
          <soa freebytes="1637389328" totalbytes="1641651200" percent="99" />
          <loa freebytes="86402048" totalbytes="86402048" percent="100" />
        </tenured>
        <time totalms="90.892" />
      </gc>
      <nursery freebytes="180514624" totalbytes="209715200" percent="86" />
      <tenured freebytes="1723791376" totalbytes="1728053248" percent="99" >
        <soa freebytes="1637389328" totalbytes="1641651200" percent="99" />
        <loa freebytes="86402048" totalbytes="86402048" percent="100" />
      </tenured>
      <time totalms="92.831" />
    </af>
      Service com.sap.security.core.ume.service started. (64165 ms).
      Service tcdisdic~srv started. (815 ms).
      Service security started. (911 ms).
      Service classload started. (43 ms).
      Service applocking started. (132 ms).
      Service shell started. (216 ms).
      Service tceCATTPingservice started. (21 ms).
      Service telnet started. (60 ms).
    Aug 13, 2008 6:33:40 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [service_ssl] and user [null] not generated; Consequences: keystore view [service_ssl] is not created for user [null]; Countermeasures:see log for details
    Aug 13, 2008 6:33:40 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [TrustedCAs] and user [null] not generated; Consequences: keystore view [TrustedCAs] is not created for user [null]; Countermeasures:see log for details
      Service webdynpro started. (699 ms).
      Service keystore started. (952 ms).
      Service ssl started. (56 ms).
    Aug 13, 2008 6:33:40 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [TicketKeystore] and user [null] not generated; Consequences: keystore view [TicketKeystore] is not created for user [null]; Countermeasures:see log for details
      Service ejb started. (1367 ms).
    Aug 13, 2008 6:33:40 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [securestorage] and user [null] not generated; Consequences: keystore view [securestorage] is not created for user [null]; Countermeasures:see log for details
      Service tcseccertrevoc~service started. (286 ms).
      Service tcsecsecurestorage~service started. (379 ms).
    Aug 13, 2008 6:33:41 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [securestorage] and user [null] not generated; Consequences: keystore view [securestorage] is not created for user [null]; Countermeasures:see log for details
      Service servlet_jsp started. (1783 ms).
    Aug 13, 2008 6:33:41 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [securestorage] and user [null] not generated; Consequences: keystore view [securestorage] is not created for user [null]; Countermeasures:see log for details
      Timed out services:
      Service com.adobe~DataManagerService > hard reference to service jmx.
      Service com.adobe~TrustManagerService > hard reference to service jmx.
      Service cafumrelgroupsimp > hard reference to service cafummetadataimp.
      Service com.adobe~PDFManipulation > hard reference to service jmx.
      Service adminadapter > hard reference to service jmx.
      Service pmi > hard reference to service tcsecdestinations~service.
      Service jms_provider > hard reference to service jmx.
      Service sld > service sld start method invoked.
      Service jmx > service jmx start method invoked.
      Service rfcengine > hard reference to service jmx.
      Service tcsecsaml~service > hard reference to service adminadapter.
      Service com.adobe~LicenseService > hard reference to service basicadmin.
      Service com.adobe~DocumentServicesConfiguration > hard reference to service basicadmin.
      Service tcsmdserver~service > hard reference to service jmx.
      Service com.adobe~DocumentServicesDestProtoService > hard reference to service jmx.
      Service cafummetadataimp > service cafummetadataimp start method invoked.
      Service tcsecvsiservice > hard reference to service tcsecdestinationsservice.
      Service tcsecdestinationsservice > service tcsecdestinationsservice start method invoked.
      Service dsr > hard reference to service security.
      Service monitor > hard reference to service jmx.
      Service cafruntimeconnectivityimpl > service cafruntimeconnectivityimpl start method invoked.
      Service tclmctcconfsservice_sda > hard reference to service jmx.
      Service CUL > hard reference to service jmx.
      Service tc.monitoring.logviewer > hard reference to service jmx.
      Service apptracing > hard reference to service jmx.
      Service com.adobe~XMLFormService > hard reference to service jmx.
      Service tcsecwssecservice > service tcsecwssecservice start method invoked.
      Service com.adobe~FontManagerService > hard reference to service jmx.
      Service com.adobe~DocumentServicesLicenseSupportService > hard reference to service jmx.
      Service com.adobe~DocumentServicesBinaries2 > hard reference to service jmx.
      Service basicadmin > hard reference to service jmx.
    [Framework -> criticalShutdown] 3 core services have timed out [adminadapter; jmx; basicadmin].
    Aug 13, 2008 6:33:53 PM             com.sap.engine.core.Framework [Thread[Thread-1,5,main]] Fatal: Critical shutdown was invoked. Reason is: 3 core services have timed out [adminadapter; jmx; basicadmin].
    </verbosegc>

    i have a error trying to start  the java engine of a Solution Manager 4.0 SR2 on AIX with ibm jdk SR9
    the next log is about the std_server0.out
    i do not how to create the alias because i can not connect using Visual Administrator because the server not start
    stdout/stderr redirect
    node name   : server0
    pid         : 995354
    system name : SMS
    system nr.  : 00
    started at  : Wed Aug 13 18:26:36 2008
    [Thr  1] Wed Aug 13 18:26:37 2008
    [Thr  1] MtxInit: -2 0 0
    <?xml version="1.0" ?>
    <verbosegc version="200708_30">
    SAP J2EE Engine Version 7.00   PatchLevel 108458.44 is starting...
    Loading: LogManager ... 2643 ms.
    Loading: PoolManager ... 2 ms.
    Loading: ApplicationThreadManager ... 837 ms.
    Loading: ThreadManager ... 54 ms.
    Loading: IpVerificationManager ... 12 ms.
    Loading: ClassLoaderManager ... 14 ms.
    Loading: ClusterManager ... 226 ms.
    Loading: LockingManager ... 68 ms.
    Loading: ConfigurationManager ... 86617 ms.
    Loading: LicensingManager ... 28 ms.
    Loading: CacheManager ... 159 ms.
    Loading: ServiceManager ...
    Loading services.:
      Service cross started. (75 ms).
      Service memory started. (98 ms).
      Service runtimeinfo started. (115 ms).
      Service trex.service started. (87 ms).
      Service file started. (156 ms).
      Service timeout started. (159 ms).
      Service userstore started. (19 ms).
      Service jmx_notification started. (78431 ms).
      Service p4 started. (188119 ms).
      Service classpath_resolver started. (63 ms).
    <af type="nursery" id="1" timestamp="Wed Aug 13 18:32:05 2008" intervalms="0.000">
      <minimum requested_bytes="48" />
      <time exclusiveaccessms="1.635" />
      <nursery freebytes="0" totalbytes="209715200" percent="0" />
      <tenured freebytes="1724342296" totalbytes="1728053248" percent="99" >
        <soa freebytes="1637940248" totalbytes="1641651200" percent="99" />
        <loa freebytes="86402048" totalbytes="86402048" percent="100" />
      </tenured>
      <gc type="scavenger" id="1" totalid="1" intervalms="0.000">
        <flipped objectcount="253990" bytes="19242624" />
        <tenured objectcount="0" bytes="0" />
        <refs_cleared soft="644" weak="1" phantom="0" />
        <finalization objectsqueued="1363" />
        <scavenger tiltratio="50" />
        <nursery freebytes="190330424" totalbytes="209715200" percent="90" tenureage="10" />
        <tenured freebytes="1724342296" totalbytes="1728053248" percent="99" >
          <soa freebytes="1637940248" totalbytes="1641651200" percent="99" />
          <loa freebytes="86402048" totalbytes="86402048" percent="100" />
        </tenured>
        <time totalms="107.395" />
      </gc>
      <nursery freebytes="190328376" totalbytes="209715200" percent="90" />
      <tenured freebytes="1724342296" totalbytes="1728053248" percent="99" >
        <soa freebytes="1637940248" totalbytes="1641651200" percent="99" />
        <loa freebytes="86402048" totalbytes="86402048" percent="100" />
      </tenured>
      <time totalms="110.754" />
    </af>
      Service deploy started. (4055 ms).
      Service bimmrdeployer started. (7 ms).
      Service MigrationService started. (70 ms).
      Service log_configurator started. (194277 ms).
      Service locking started. (8 ms).
      Service http started. (295 ms).
      Service naming started. (626 ms).
      Service failover started. (112 ms).
      Service appclient started. (140 ms).
      Service javamail started. (218 ms).
      Service ts started. (220 ms).
      Service jmsconnector started. (207 ms).
      Service licensing started. (22 ms).
      Service connector started. (212 ms).
      Service configuration started. (32 ms).
      Service iiop started. (316 ms).
      Service webservices started. (706 ms).
      Service dbpool started. (25283 ms).
    <af type="nursery" id="2" timestamp="Wed Aug 13 18:33:36 2008" intervalms="91291.585">
      <minimum requested_bytes="768" />
      <time exclusiveaccessms="0.302" />
      <nursery freebytes="0" totalbytes="209715200" percent="0" />
      <tenured freebytes="1723791376" totalbytes="1728053248" percent="99" >
        <soa freebytes="1637389328" totalbytes="1641651200" percent="99" />
        <loa freebytes="86402048" totalbytes="86402048" percent="100" />
      </tenured>
      <gc type="scavenger" id="2" totalid="2" intervalms="91293.279">
        <flipped objectcount="353647" bytes="28752016" />
        <tenured objectcount="0" bytes="0" />
        <refs_cleared soft="1056" weak="0" phantom="0" />
        <finalization objectsqueued="2858" />
        <scavenger tiltratio="50" />
        <nursery freebytes="180516672" totalbytes="209715200" percent="86" tenureage="11" />
        <tenured freebytes="1723791376" totalbytes="1728053248" percent="99" >
          <soa freebytes="1637389328" totalbytes="1641651200" percent="99" />
          <loa freebytes="86402048" totalbytes="86402048" percent="100" />
        </tenured>
        <time totalms="90.892" />
      </gc>
      <nursery freebytes="180514624" totalbytes="209715200" percent="86" />
      <tenured freebytes="1723791376" totalbytes="1728053248" percent="99" >
        <soa freebytes="1637389328" totalbytes="1641651200" percent="99" />
        <loa freebytes="86402048" totalbytes="86402048" percent="100" />
      </tenured>
      <time totalms="92.831" />
    </af>
      Service com.sap.security.core.ume.service started. (64165 ms).
      Service tcdisdic~srv started. (815 ms).
      Service security started. (911 ms).
      Service classload started. (43 ms).
      Service applocking started. (132 ms).
      Service shell started. (216 ms).
      Service tceCATTPingservice started. (21 ms).
      Service telnet started. (60 ms).
    Aug 13, 2008 6:33:40 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [service_ssl] and user [null] not generated; Consequences: keystore view [service_ssl] is not created for user [null]; Countermeasures:see log for details
    Aug 13, 2008 6:33:40 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [TrustedCAs] and user [null] not generated; Consequences: keystore view [TrustedCAs] is not created for user [null]; Countermeasures:see log for details
      Service webdynpro started. (699 ms).
      Service keystore started. (952 ms).
      Service ssl started. (56 ms).
    Aug 13, 2008 6:33:40 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [TicketKeystore] and user [null] not generated; Consequences: keystore view [TicketKeystore] is not created for user [null]; Countermeasures:see log for details
      Service ejb started. (1367 ms).
    Aug 13, 2008 6:33:40 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [securestorage] and user [null] not generated; Consequences: keystore view [securestorage] is not created for user [null]; Countermeasures:see log for details
      Service tcseccertrevoc~service started. (286 ms).
      Service tcsecsecurestorage~service started. (379 ms).
    Aug 13, 2008 6:33:41 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [securestorage] and user [null] not generated; Consequences: keystore view [securestorage] is not created for user [null]; Countermeasures:see log for details
      Service servlet_jsp started. (1783 ms).
    Aug 13, 2008 6:33:41 PM          com.sap.engine.services.keystore [Thread[_keystore_managed_system_thread_,10,SAPEngine_System_Thread[impl:5]_Group]] Fatal: Source: com.sap.engine.services.security.exceptions.BaseSecurityException: Security role with alias KeystoreAdministrator does not exist.; Description: system user based security support for view [securestorage] and user [null] not generated; Consequences: keystore view [securestorage] is not created for user [null]; Countermeasures:see log for details
      Timed out services:
      Service com.adobe~DataManagerService > hard reference to service jmx.
      Service com.adobe~TrustManagerService > hard reference to service jmx.
      Service cafumrelgroupsimp > hard reference to service cafummetadataimp.
      Service com.adobe~PDFManipulation > hard reference to service jmx.
      Service adminadapter > hard reference to service jmx.
      Service pmi > hard reference to service tcsecdestinations~service.
      Service jms_provider > hard reference to service jmx.
      Service sld > service sld start method invoked.
      Service jmx > service jmx start method invoked.
      Service rfcengine > hard reference to service jmx.
      Service tcsecsaml~service > hard reference to service adminadapter.
      Service com.adobe~LicenseService > hard reference to service basicadmin.
      Service com.adobe~DocumentServicesConfiguration > hard reference to service basicadmin.
      Service tcsmdserver~service > hard reference to service jmx.
      Service com.adobe~DocumentServicesDestProtoService > hard reference to service jmx.
      Service cafummetadataimp > service cafummetadataimp start method invoked.
      Service tcsecvsiservice > hard reference to service tcsecdestinationsservice.
      Service tcsecdestinationsservice > service tcsecdestinationsservice start method invoked.
      Service dsr > hard reference to service security.
      Service monitor > hard reference to service jmx.
      Service cafruntimeconnectivityimpl > service cafruntimeconnectivityimpl start method invoked.
      Service tclmctcconfsservice_sda > hard reference to service jmx.
      Service CUL > hard reference to service jmx.
      Service tc.monitoring.logviewer > hard reference to service jmx.
      Service apptracing > hard reference to service jmx.
      Service com.adobe~XMLFormService > hard reference to service jmx.
      Service tcsecwssecservice > service tcsecwssecservice start method invoked.
      Service com.adobe~FontManagerService > hard reference to service jmx.
      Service com.adobe~DocumentServicesLicenseSupportService > hard reference to service jmx.
      Service com.adobe~DocumentServicesBinaries2 > hard reference to service jmx.
      Service basicadmin > hard reference to service jmx.
    [Framework -> criticalShutdown] 3 core services have timed out [adminadapter; jmx; basicadmin].
    Aug 13, 2008 6:33:53 PM             com.sap.engine.core.Framework [Thread[Thread-1,5,main]] Fatal: Critical shutdown was invoked. Reason is: 3 core services have timed out [adminadapter; jmx; basicadmin].
    </verbosegc>

  • Advice needed: what does your company log for SAP security role changes?

    My client has a situation where for many years, they never logged changes to SAP security roles.  By that I mean, they never logged even basic details, like who requested a change, tested it, approved it, and what changed!!  Sadly their ticketing system is terrible, completely free-form text and not even searchable. 
    Does anyone here use Word docs, Excel sheets, or some other way to capture security role change details?   What details do you capture?  What about Projects, that involve dozens of changes and testing over several months?
    I plan to recommend, at least, they need to use a unique# (a ticket#, or whatever) for every change and update the same in PFCG role desc tab, plus in CTS description of transports... but what about other details, since they have a bad ticketing system?  I spoke with internal audit and change Mgmnt "manager" about it, and they are clueless and will not make recommendations.  It's really weird but they will get into big trouble eventually without any logs for security changes!

    Does anyone here use Word docs, Excel sheets, or some other way to capture security role change details? What details do you capture? What about Projects, that involve dozens of changes and testing over several months?
    I have questions:
    a) Do you want to make things straight
    b) Do you want to implement a versioning mechanism
    c) You cannot implement anything technical, but you`re asking about best "paper" practise?
    The mentioned scenarios can be well maintained if you use SAP GRC Solutions 10 (Business Role Management)
    Task Based, Approvals, Risk Analysis, SOD and role generation and maintenance in a structured way (Business Role Management). Workflow based, staged process with approvals.
    PFCG transaction usage will be curtailed to minimum if implemented fully.
    Do we really want to do things "outside" PFCG?
    @all:
    a) do you guys use custom approval workflows for roles?
    b) how tight your processes are? how much paperwork, workflow, tickets, requests and incidents you have to go through to change a role?
    c) who is a friend of GRC here, raise your hand
    Cheers Otto
    p.s.: very interesting discussion, I would like to learn something here about how it works out there in the wild

  • Using weblogic security roles in authentication: weblogic 9

    Hi All,
    I am trying to create a simple application which uses declarative authorization configured in web.xml. I use the simple form based authentication. While trying to deploy my application, I get the error:
    weblogic.management.DeploymentException: [HTTP:101168]The security-role-assignment references an invalid security-role: LTVORole.
    But I have defined the role LTVORole in weblogic using the administrator console.
    below are the details of what I have done:
    Web.xml:
    ========
    <?xml version='1.0' encoding='UTF-8'?>
    <j2ee:web-app xmlns:j2ee="http://java.sun.com/xml/ns/j2ee">
      <j2ee:welcome-file-list>
        <j2ee:welcome-file>login.jsp</j2ee:welcome-file>
        <j2ee:welcome-file>index.html</j2ee:welcome-file>
        <j2ee:welcome-file>index.htm</j2ee:welcome-file>
      </j2ee:welcome-file-list>
      <j2ee:login-config>
        <j2ee:auth-method>FORM</j2ee:auth-method>
        <j2ee:form-login-config>
          <j2ee:form-login-page>/login.jsp</j2ee:form-login-page>
          <j2ee:form-error-page>/error.jsp</j2ee:form-error-page>
        </j2ee:form-login-config>
      </j2ee:login-config>
    <security-constraint>
      <display-name>checkAccountConstraint</display-name>
    <web-resource-collection>
      <web-resource-name>checkAccountCollection</web-resource-name>
            <url-pattern>test.jsp</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
      </web-resource-collection>
      <auth-constraint>
            <role-name>LTVORole</role-name>
      </auth-constraint>
      </security-constraint>
    </j2ee:web-app>Weblogic.xml
    ===========
    <?xml version="1.0" encoding="UTF-8"?>
    <ns:weblogic-web-app xmlns:ns="http://www.bea.com/ns/weblogic/90">
      <security-role-assignment>
        <role-name>LTVORole</role-name>
       <externally-defined/>
      </security-role-assignment>
    </ns:weblogic-web-app>I have created the role in weblogic in the menu
    security realms > myrealm > roles and policies > Global Roles > roles > LTVORole
    Is it the right way to define a role?
    Please help me find where I am going wrong.
    Thanking you all in advance,
    Gireesh

    Hi All,
    I am trying to create a simple application which uses declarative authorization configured in web.xml. I use the simple form based authentication. While trying to deploy my application, I get the error:
    weblogic.management.DeploymentException: [HTTP:101168]The security-role-assignment references an invalid security-role: LTVORole.
    But I have defined the role LTVORole in weblogic using the administrator console.
    below are the details of what I have done:
    Web.xml:
    ========
    <?xml version='1.0' encoding='UTF-8'?>
    <j2ee:web-app xmlns:j2ee="http://java.sun.com/xml/ns/j2ee">
      <j2ee:welcome-file-list>
        <j2ee:welcome-file>login.jsp</j2ee:welcome-file>
        <j2ee:welcome-file>index.html</j2ee:welcome-file>
        <j2ee:welcome-file>index.htm</j2ee:welcome-file>
      </j2ee:welcome-file-list>
      <j2ee:login-config>
        <j2ee:auth-method>FORM</j2ee:auth-method>
        <j2ee:form-login-config>
          <j2ee:form-login-page>/login.jsp</j2ee:form-login-page>
          <j2ee:form-error-page>/error.jsp</j2ee:form-error-page>
        </j2ee:form-login-config>
      </j2ee:login-config>
    <security-constraint>
      <display-name>checkAccountConstraint</display-name>
    <web-resource-collection>
      <web-resource-name>checkAccountCollection</web-resource-name>
            <url-pattern>test.jsp</url-pattern>
            <http-method>GET</http-method>
            <http-method>POST</http-method>
      </web-resource-collection>
      <auth-constraint>
            <role-name>LTVORole</role-name>
      </auth-constraint>
      </security-constraint>
    </j2ee:web-app>Weblogic.xml
    ===========
    <?xml version="1.0" encoding="UTF-8"?>
    <ns:weblogic-web-app xmlns:ns="http://www.bea.com/ns/weblogic/90">
      <security-role-assignment>
        <role-name>LTVORole</role-name>
       <externally-defined/>
      </security-role-assignment>
    </ns:weblogic-web-app>I have created the role in weblogic in the menu
    security realms > myrealm > roles and policies > Global Roles > roles > LTVORole
    Is it the right way to define a role?
    Please help me find where I am going wrong.
    Thanking you all in advance,
    Gireesh

Maybe you are looking for

  • SAP R/3 4.6C installation on HP-UX 11.31

    Hi Export We have the old system based IBM server with HA environment, Cluster software is HACMP. Now, the goal is: Migrate the SAP R/3 4.6C system to HP hardware. Hardware:  HP rx6600 & rx8640 server with MC/SG (cluster software); DB& SAP R3 version

  • Connecting database to Servlets

    Hi i am trying to connect MySql to a simple servlet program. The MySql server gets started and the tables and data are retrievable, and the servlet is compiled, but unable to run the servlet in the browser. I get a blank page when i run the program i

  • How can I use the iPhone GPS without a contract?

    Is there any way? Call me crazy, but I want GPS and I already have a cellphone that I'm not interested in replacing. Would it be possible to go and get an iPhone and use the GPS without paying for a plan? I already use AT&T, but what don't want is to

  • Where does iCal store its calendars?

    If I want to back up an iCal calendar onto something like a USB flashdrive where would I find it?  Since I am not using Lion, I do not have iCloud capability.

  • Reports with prompt fails after migration

    Post Author: vrivero CA Forum: WebIntelligence Reporting Hi everybody!I have developed some reports and afterwards I have migrated them to another Business Objects XI R2 server, in order to use them under InfoView.The problem is that the reports that