Form based authentication - users stored in db.

I must use form based authentication and the users are stored in an oracle table.
How can I configure OC4J to get this thing working ?
I have search some days on the internet and came up with nothing ... Oracle seems to be offering so much security options that I don't know what to choose from.
A simple example should be welcome ...
Please help, I'm really getting desperate ...
Thanks a lot in advance !

Hi Partner:
I'm having the some problem as you
configuring a JDBC security.
I yo have found some useful solution please
let me know.
Thank you.
Roger.
[email protected]
[email protected]

Similar Messages

  • FORM based authentication

    Hi,
    I'm using Oracle JDeveloper 9.0.3 with the embedded oc4j. I have configured for simple FORM based authentication by storing username/password in the principals.xml file.
    I am presented with the login form correctly when I try to access a protected resource, but my username/password is always rejected (I'm redirected to the error page after trying to log-in). Can someone pls help??
    The relevant portions of the contents of the deployment descriptor files that I'm using:
    principals.xml
    <principals>
    <groups>
    <group name="securegroup">
    <description>secureusers</description>
    </group>
    </groups>
    <users>
    <user username="testuser" password="test">
    <description>test user </description>
    <group-membership group="securegroup" />
    </user>
    </users>
    </principals>
    web.xml
    <web-app>
    <security-constraint>
    <display-name>Example Security Constraint</display-name>
    <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <!-- Define the context-relative URL(s) to be protected -->
    <url-pattern>*</url-pattern>
    <!-- If you list http methods, only those methods are protected -->
    </web-resource-collection>
    <auth-constraint>
    <!-- Anyone with one of the listed roles may access this area -->
    <role-name>role1</role-name>
    </auth-constraint>
    </security-constraint>
    <!-- Default login configuration uses form-based authentication -->
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Example Form-Based Authentication Area</realm-name>
    <form-login-config>
    <form-login-page>login.jsp</form-login-page>
    <form-error-page>error.jsp</form-error-page>
    </form-login-config>
    </login-config>
    <!-- Security roles referenced by this web application -->
    <security-role>
    <role-name>role1</role-name>
    </security-role>
    </web-app>
    orion-application.xml
    <orion-application>
    <security-role-mapping name="role1">
    <group name="securegroup" />
    </security-role-mapping>
    </orion-application>
    application.xml (stored in my D:\JDeveloper\jdev\MyProj\MyProject\WEB-INF\src\META-INF folder)
    <?xml version = '1.0' encoding = 'windows-1252'?>
    <!DOCTYPE application PUBLIC "-//Sun Microsystems, Inc.//DTD J2EE Application 1.2//EN" "http://java.sun.com/j2ee/dtds/application_1_2.dtd">
    <application>
    <security-role-mapping name="role1">
    <group name="securegroup" />
    </security-role-mapping>
    </application>

    REPOST
    <br><br>
    Keywords: form-login, principals.xml, embedded OC4J, authentication
    <p>
    Please see http://forums.oracle.com/forums/message.jsp?id=1266989
    <p>
    The provided link does not work.<br><br>
    In the application.xml of the OC4j config folder I have comemnted out the: <br> <jazn provider="XML" location="./jazn-data.xml"/>
    and added my roles mappings from web.xml :<br>
         <security-role-mapping name="OES_admin">
              <group name="administrators"/>
         </security-role-mapping>
    <p>
    plus in proncipals.xml have created an entry for my test user:<p>
              <user username="testusr" password="test">
                   <description>Just me</description>
                   <group-membership group="users" />
                   <group-membership group="guests" />
                   <group-membership group="administrators" />
              </user>
    <p>
    And still cannot run Form-authentication from inside jdeveloper .... authentication runs fine when the app is deployed to Tomcat5
    <p>
    Help Please, I'm using jdev 10.1.2.0
    Message was edited by:
    omar71

  • Get user and user-roles in form based authentication

    How do I get user and roles associated with the user in my bean for "form based authentication".
    regards,
    nirvan.

    HttpServletRequest#getUserPrincipal().
    This has nothing to do with JSF. Form based authentication is part of Servlet spec.
    In JSF you can get the HttpServletRequest by ExternalContext#getRequest().

  • Faces context not found (Form based authentication)

    <security-constraint>
    <display-name>Example Security Constraint</display-name>
    <web-resource-collection>
    <web-resource-name>Protected Area</web-resource-name>
    <url-pattern>/jsp/WorkingZone.jsp</url-pattern>
    <http-method>GET</http-method>
    <http-method>POST</http-method>
    </web-resource-collection>
    <auth-constraint>
    <role-name>manager</role-name>
    </auth-constraint>
    </security-constraint>
    <login-config>
    <auth-method>FORM</auth-method>
    <realm-name>Example Form-Based Authentication Area</realm-name>
    <form-login-config>
    <form-login-page>/Login/login.jsp</form-login-page>
    <form-error-page>/Login/error.jsp</form-error-page>
    </form-login-config>
    </login-config>
    when i tried to login with valid user the the url shows
    http://localhost:8080/FormAuth/jsp/WorkingZone.jsp
    how to append faces context automatically.
    I am not finding for this faces context.
    Plz suggest me a solution soon.
    Thanks
    Raghavendra Pattar

    The FacesContext is created by FacesServlet which is
    definied in the web.xml with an url-pattern.
    If you just follow the url-pattern of this
    FacesServlet, usually /faces/ or *.faces, or *.jsf,
    then the FacesContext will be created.Hi balu,
    this is the web.xml that i am using
    <?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="2.4" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
    <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>server</param-value>
      </context-param>
    <context-param>
        <param-name>javax.faces.CONFIG_FILES</param-name>
        <param-value>/WEB-INF/navigation.xml,/WEB-INF/managed-beans.xml</param-value>
      </context-param>
    <context-param>
        <param-name>com.sun.faces.validateXml</param-name>
        <param-value>true</param-value>
      </context-param>
    <context-param>
        <param-name>com.sun.faces.verifyObjects</param-name>
        <param-value>false</param-value>
      </context-param>
    <filter>
        <filter-name>UploadFilter</filter-name>
        <filter-class>com.sun.rave.web.ui.util.UploadFilter</filter-class>
        <init-param>
          <description>
              The maximum allowed upload size in bytes.  If this is set
              to a negative value, there is no maximum.  The default
              value is 1000000.
            </description>
          <param-name>maxSize</param-name>
          <param-value>1000000</param-value>
        </init-param>
        <init-param>
          <description>
              The size (in bytes) of an uploaded file which, if it is
              exceeded, will cause the file to be written directly to
              disk instead of stored in memory.  Files smaller than or
              equal to this size will be stored in memory.  The default
              value is 4096.
            </description>
          <param-name>sizeThreshold</param-name>
          <param-value>4096</param-value>
        </init-param>
      </filter>
    <filter-mapping>
        <filter-name>UploadFilter</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
      </filter-mapping>
    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
      </servlet>
    <servlet>
        <servlet-name>ThemeServlet</servlet-name>
        <servlet-class>com.sun.rave.web.ui.theme.ThemeServlet</servlet-class>
      </servlet>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>/faces/*</url-pattern>
      </servlet-mapping>
    <servlet-mapping>
        <servlet-name>ThemeServlet</servlet-name>
        <url-pattern>/theme/*</url-pattern>
      </servlet-mapping>
    <welcome-file-list>
        <welcome-file></welcome-file>
         </welcome-file-list>
    <jsp-config>
        <jsp-property-group>
          <url-pattern>*.jspf</url-pattern>
          <is-xml>true</is-xml>
        </jsp-property-group>
      </jsp-config>
    <security-constraint>
        <display-name>Example Security Constraint</display-name>
        <web-resource-collection>
          <web-resource-name>Protected Area</web-resource-name>
          <url-pattern>/secure/*</url-pattern>
            <http-method>GET</http-method>
          <http-method>POST</http-method>
        </web-resource-collection>
        <auth-constraint>
          <role-name>manager</role-name>
        </auth-constraint>
      </security-constraint>
      <!-- Default a login configuration that uses form-based authentication -->
      <login-config>
        <auth-method>FORM</auth-method>
        <realm-name>Example Form-Based Authentication Area</realm-name>
        <form-login-config>
          <form-login-page>/Login/login.jsp</form-login-page>
          <form-error-page>/Login/error.jsp</form-error-page>
        </form-login-config>
      </login-config>
      <!-- Define a logical role for this application, needs to be mapped to an actual role at deployment time -->
      <security-role>
        <role-name>manager</role-name>
      </security-role>
    </web-app>1)My requirement is Login page should be the first page
    If enter the valid user and password
    then i will get directory structure
    when i click the secured JSF page inside secure
    i got this URL
    http://localhost/secure/WorkingZone.jsp
    obiviously /faces is missing
    and i am getting faces context not found.
    If u need further clarification i will send u..
    Plz reply me...

  • Updating password for Form Based authentication database using code

    Hi,
    We have created FBA(Form Based authentication) for SP2010. We are storing all the usernames and Passwords in FBA database. If any user changes their password needs to be save in FBA Database with latest password.
    can any one suggest me how to do this one.....
    Thanks....

    https://msdn.microsoft.com/en-us/library/system.web.security.membershipprovider.changepassword(v=vs.110).aspx
    Scott Brickey
    MCTS, MCPD, MCITP
    www.sbrickey.com
    Strategic Data Systems - for all your SharePoint needs

  • Form-based authentication problem with weblogic

    Hi Everyone,
    The following problem related to form-based authentication
    was posted one week ago and no reponse. Can someone give it
    a shot? One more thing is added here. When I try it on J2EE
    server and do the same thing, I didn't encounter this error
    message, and I am redirected to the homeage.
    Thanks.
    -John
    I am using weblogic5.1 and RDBMSRealm as the security realm. I am having the following problem with the form-based authentication login mechanism. Does anyone have an idea what the problem is and how to solve it?
    When I login my application and logout as normal procedure, it is OK. But if I login and use the browser's BACK button to back the login page and try to login as a new user, I got the following error message,
    "Form based authentication failed. Could not find session."
    When I check the LOG file, it gives me the following message,
    "Form based authentication failed. One of the following reasons could cause it: HTTP sessions are disabled. An old session ID was stored in the browser."
    Normally, if you login and want to relogin without logout first, it supposes to direct you to the existing user session. But I don't understand why it gave me this error. I also checked my property file, it appears that the HTTP sessions are enabled as follows,
    weblogic.httpd.session.enable=true

    Hi...
    Hehe... I actually did implement the way you implement it. My login.jsp actually checks if the user is authenticated. If yes, then it will forward it to the home page. On the other hand, I used ServletAuthentication to solve the problem mentioned by Cameron where Form Authentication Failed usually occurs for the first login attempt. I'm also getting this error occasionally. Using ServletAuthentication totally eliminates the occurence of this problem.
    I'm not using j_security_check anymore. ServletAuthentication does all the works. It also uses RDBMSRealm to authenticate the user. I think the biggest disadvantage I can see when using ServletAuthentication is that the requested resource will not be returned after authentication cause the page returned after authenticating the user is actually hard coded (for my case, it's the home.jsp)
    cheers...
    Jerson
    "John Wang" <[email protected]> wrote:
    >
    Hi Jerson,
    I tried your code this weekend, it didn't work in my case. But
    I solved my specific problem other way. The idea behind my problem is that the user tries to relogin when he already logs in. Therefore, I just redirect the user into another page when he is getting the login page by htting the BACK button, rather than reauthenticate the user as the way you did.
    But, I think your idea is very helpful if it could work. Problems such multiple concurrence logins can be solved by pre-processing.
    In your new code, you solved the problem with a new approach. I am just wondering, do you still implement it with your login.jsp file? In other word, your action in login.jsp is still "Authenticate"? Where do you put the URL "j_security_check"?
    Thanks.
    -John
    "Jerson Chua" <[email protected]> wrote:
    I've solved the problem by using ServletAuthentication. So far I'm not getting the error message. One of the side effects is that it doesn't return the requested URI after authentication, it will always return the home page.
    Jerson
    package com.cyberj.catalyst.web;
    import weblogic.servlet.security.*;
    import javax.servlet.*;
    import javax.servlet.http.*;
    import java.io.*;
    public class Authenticate extends HttpServlet {
    private ServletAuthentication sa = new ServletAuthentication("j_username", "j_password");
    public void doPost(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, java.io.IOException {
    int authenticated = sa.weak(request, response);
    if (authenticated == ServletAuthentication.NEEDS_CREDENTIALS ||
    authenticated == ServletAuthentication.FAILED_AUTHENTICATION) {
    response.sendRedirect("fail_login.jsp");
    } else {
    response.sendRedirect("Home.jsp");
    public void doGet(HttpServletRequest request, HttpServletResponse response)
    throws ServletException, java.io.IOException {
    doPost(request, response);
    "Jerson Chua" <[email protected]> wrote:
    The problem is still there even if I use page redirection. Grrr... My boss wants me to solve this problem so what are the alternatives I can do? Are there any other ways of authenticating the user? In my web tier... I'm using isUserInRole, getRemoteUser and the web tier actually connects to EJBs. If I implement my custom authentication, I wouldn't be able to use this functionalities.
    Has anyone solved this problem? I've tried the example itself and the same problem occurs.
    Jerson
    "Cameron Purdy" <[email protected]> wrote:
    Jerson,
    First try it redirected (raw) to see if that indeed is the problem ... then
    if it works you can "fix" it the way you want.
    Peace,
    Cameron Purdy
    Tangosol, Inc.
    http://www.tangosol.com
    +1.617.623.5782
    WebLogic Consulting Available
    "Jerson Chua" <[email protected]> wrote in message
    news:[email protected]...
    Hi...
    Thanks for your suggestion... I've actually thought of that solution. Butusing page redirection will expose the user's password. I'm thinking of
    another indirection where I will redirect it to another servlet but the
    password is encrypted.
    What do you think?
    thanks....
    Jerson
    "Cameron Purdy" <[email protected]> wrote:
    Maybe redirect to the current URL after killing the session to let the
    request clean itself up. I don't think that a lot of the request (such
    as
    remote user) will be affected by killing the session until the nextrequest
    comes in.
    Peace,
    Cameron Purdy
    Tangosol, Inc.
    http://www.tangosol.com
    +1.617.623.5782
    WebLogic Consulting Available
    "Jerson Chua" <[email protected]> wrote in message
    news:[email protected]...
    Hello guys...
    I've a solution but it doesn't work yet so I need your help. Because
    one
    of the reason for getting form base authentication failed is if an
    authenticated user tries to login again. For example, the one mentionedby
    John using the back button to go to the login page and when the user logsin
    again, this error occurs.
    So here's my solution
    Instead of submitting the page to j_security_check, submit it to a
    servlet
    which will check if the user is logged in or not. If yes, invalidates its
    session and forward it to j_security_check. But there's a problem in this
    solution, eventhough the session.invalidate() (which actually logs theuser
    out) is executed before forwarded to j_security_check, the user doesn't
    immediately logged out. How did I know this, because after calling
    session.invalidate, i tried calling request.RemoteUser() and it doesn't
    return null. So I'm still getting the error. What I want to ask you guyis
    how do I force logout before the j_security_check is called.
    here's the code I did which the login.jsp actually submits to
    import javax.servlet.*;
    import javax.servlet.http.*;
    import java.io.*;
    public class Authenticate extends HttpServlet {
    public void doPost(HttpServletRequest request, HttpServletResponseresponse)
    throws ServletException, java.io.IOException {
    if (request.getRemoteUser() != null) {
    HttpSession session = request.getSession(false);
    System.out.println(session.isNew());
    session.invalidate();
    Cookie[] cookies = request.getCookies();
    for (int i = 0; i < cookies.length; i++) {
    cookies.setMaxAge(0);
    getServletContext().getRequestDispatcher("/j_security_check").forward(reques
    t, response);
    public void doGet(HttpServletRequest request, HttpServletResponseresponse)
    throws ServletException, java.io.IOException {
    doPost(request, response);
    let's help each other to solve this problem. thanks.
    Jerson
    "Jerson Chua" <[email protected]> wrote:
    I thought that this problem will be solved on sp6 but to my
    disappointment, the problem is still there. I'm also using RDBMSRealm,same
    as John.
    Jerson
    "Cameron Purdy" <[email protected]> wrote:
    John,
    1. You are using a single WL instance (i.e. not clustered) on that
    NT
    box
    and doing so without a proxy (e.g. specifying http://localhost:7001),
    correct?
    2. BEA will pay more attention to the problem if you upgrade to SP6.If
    you don't have a reason NOT to (e.g. a particular regression), then
    you
    should upgrade. That will save you one go-around with support: "Hi,I
    am
    on SP5 and I have a problem.", "Upgrade to SP6 to see if that fixes
    it.
    Call back if that doesn't work."
    3. Make sure that you are not doing anything special before or after
    J_SECURITY_CHECK ... make sure that you have everything configuredand
    done
    by the book.
    4. Email BEA a bug report at [email protected] ... see what they say.
    Peace,
    Cameron Purdy
    Tangosol, Inc.
    http://www.tangosol.com
    +1.617.623.5782
    WebLogic Consulting Available
    "John Wang" <[email protected]> wrote in message
    news:[email protected]...
    Cameron,
    It seems to me that the problem I encountered is different a little
    from
    what you have, evrn though the error message is the same eventually.
    Everytime I go through, I always get that error.
    I am using weblogic5.1 and sp5 on NT4.0. Do you have any solutions
    to
    work
    around this problem? If it was a BUG as you
    pointed out, is there a way we can report it to the Weblogic
    technical support and let them take a look?
    Thnaks.
    -John
    "Cameron Purdy" <[email protected]> wrote:
    John,
    I will verify that I have seen this error now (after having read
    about it
    here for a few months) and it had the following characteristics:
    1) It was intermittent, and appeared to be self-curing
    2) It was not predictable, only seemed to occur at the first
    login
    attempt,
    and may have been timing related
    3) This was on Sun Solaris on a cluster of 2 Sparc 2xx's; the
    proxy
    was
    Apache (Stronghold)
    4) After researching the newsgroups, it appears that this "bug"
    may
    have gone away temporarily (?) in SP5 (although Jerson Chua
    <[email protected]> mentioned that he still got it in SP5)
    I was able to reproduce it most often by deleting the tmpwar and
    tmp_deployments directories while the cluster was not running,
    then
    restarting the cluster. The first login attempt would fail(roughly
    90%
    of
    the time?) and that server instance would then be ignored by the
    proxy
    for a
    while (60 seconds?) -- meaning that the proxy would send all
    traffic,
    regardless of the number of "clients", to the other server in thecluster.
    As far as I can tell, it is a bug in WebLogic, and probably has
    been
    there
    for quite a while.
    Peace,
    Cameron Purdy
    Tangosol, Inc.
    http://www.tangosol.com
    +1.617.623.5782
    WebLogic Consulting Available
    "John Wang" <[email protected]> wrote in message
    news:[email protected]...
    Hi Everyone,
    The following problem related to form-based authentication
    was posted one week ago and no reponse. Can someone give it
    a shot? One more thing is added here. When I try it on J2EE
    server and do the same thing, I didn't encounter this error
    message, and I am redirected to the homeage.
    Thanks.
    -John
    I am using weblogic5.1 and RDBMSRealm as the security realm. I
    am
    having
    the following problem with the form-based authentication login
    mechanism.
    Does anyone have an idea what the problem is and how to solve it?
    When I login my application and logout as normal procedure, it
    is
    OK.
    But
    if I login and use the browser's BACK button to back the login
    page
    and
    try
    to login as a new user, I got the following error message,
    "Form based authentication failed. Could not find session."
    When I check the LOG file, it gives me the following message,
    "Form based authentication failed. One of the following reasons
    could
    cause it: HTTP sessions are disabled. An old session ID was stored
    in
    the
    browser."
    Normally, if you login and want to relogin without logout first,
    it
    supposes to direct you to the existing user session. But I don'tunderstand
    why it gave me this error. I also checked my property file, it
    appears
    that
    the HTTP sessions are enabled as follows,
    weblogic.httpd.session.enable=true

  • MOBI SSO with trusted authentication and form based authentication

    Dear All,
    I am trying to configure Trusted authentication based SSO FOR MOBI, here are the details:
    - SAP BI 4.1 SP04
    - Trusted authentication with HTTP header configurred for BI Launchpad and working fine.
    Now to have SSO from Mobile, I plan to leverage the existing configuration of BI Launchpad and at Mobile level, I want to use authentication type as TRUSTED_AUTH_FORM, instead of TRUSTED_AUTH_BASIC, with the approach: Trusted authentication with HTTP header.
    And
    Provide our app users their X502 certs.
    1. Will the above approach work ??
    2. As per SAP NOTE: 2038165 - SSO using form based trusted auth gives with the SAP BI app for iOS gives error MOB00920 this does not work and is still under investigation from July last year ? So for any community member, has this been found working ??
    I would appreciate your valuable inputs.
    Regards,
    Sarvjot Singh

    Hi,
    According to your post, my understanding is that you want to know the difference of the SharePoint three type user authentications.
    Windows claims-based authentication uses your existing Windows authentication provider (Active Directory Domain Services [AD DS]) to validate the credentials of connecting clients. Use this authentication to allow AD DS-based accounts access to SharePoint
    resources. Authentication methods include NTLM, Kerberos, and Basic.
    Forms-based authentication can be used against credentials that are stored in an authentication provider that is available through the ASP.NET interface
    SAML token-based authentication in SharePoint 2013 requires coordination with administrators of a claims-based environment, whether it is your own internal environment or a partner environment.
    There is a good article contains all the SharePoint Authentications, including how they work and how to configure.
    http://sp77.blogspot.com/2014/02/authentication-in-sharepoint-2013_5.html#.VFcyQ_mUfkJ
    Thanks & Regards,
    Jason
    Jason Guo
    TechNet Community Support

  • Help: Form Based Authentication Failed

              Can someone from bea help me with this? We're using servlet's j_security_check to authenticate the user and from time to time, this message
              "Form based authentication failed. One of the following reasons could cause it:
              HTTP sessions are disabled.
              An old session ID was stored in the browser"
              pops out. How can we prevent this from happening?
              thanks in advanced...
              Jerson
              

    Please see the recent thread in the Security section dealing with the same
              message. (Search on "Form based authentication failed".) There appears to
              be at least one bug in WL that causes this, although I wouldn't rule out a
              config issue.
              At any rate, the error message printed out to the console (and log) is
              stupid. Chances are your problem has nothing to do with either an old
              session ID or sessions being disabled, both of which WebLogic should be able
              to tell you for sure if they were indeed the problem.
              Peace,
              Cameron Purdy
              Tangosol, Inc.
              http://www.tangosol.com
              +1.617.623.5782
              WebLogic Consulting Available
              "Jerson Chua" <[email protected]> wrote in message
              news:3a30499c$[email protected]..
              >
              > Can someone from bea help me with this? We're using servlet's
              j_security_check to authenticate the user and from time to time, this
              message
              > "Form based authentication failed. One of the following reasons could
              cause it:
              > HTTP sessions are disabled.
              > An old session ID was stored in the browser"
              > pops out. How can we prevent this from happening?
              >
              > thanks in advanced...
              > Jerson
              >
              

  • Catching authentication exception in form-based authentication

    Hi.
    I have a custom UserManager that implements a simple authentication of username/password.
    The web-application is secured using a form-based login-config in web.xml with a form-login-page and a form-error-page. Both these resources points to the same page (login.jsp).
    I want to present a relevant error message when the user fails to log-in (providing wrong username or password, or there is an exception in the UserManager). As far as I can tell there is no way to handle this in a straight-forward manner: When I throw an exception in the UserManager this exception is swallowed by OC4J and never propagates to the form-error-page specified in web.xml. All I can do is to provide a "default" message on the error-page saying "Failed to login". There is no way to tell if the login failed due to invalid username/password or if the login failed due to an unexpected exception in the UserManager implementation (i.e. SQLException).
    I can go around this by storing the relevant error message in a ThreadLocal variable from the UserManager and retrieve this message from the error jsp page. But this is ugly :)
    Shouldn't the form-error-page receive a Throwable in the exception-object? Or is the behavior in OC4J the "standard" way to handle these issues?
    Best Regards //Anders

    Since no one is replying I'm refreshing the thread with some more info..
    Cut from the Servlet 2.3 Specification (in SRV.12.5.3, Form Based Authentication):
    When a user attempts to access a protected web resource, the container checks the user s authentication.
    If the user is authenticated and possesses authority to access the resource, the requested web resource is activated and a reference to it is returned.
    If the user is not authenticated, all of the following steps occur:
    1. The login form associated with the security constraint is sent to the client and the URL path triggering the authentication is stored by the container.
    2. The user is asked to fill out the form, including the username and password fields.
    3. The client posts the form back to the server.
    4. The container attempts to authenticate the user using the information from the form.
    5. If authentication fails, the error page is returned using either a forward or a redirect, and the status code of the response is set to 401.
    6. If authentication succeeds, the authenticated user s principal is checked to see if it is in an authorized role for accessing the resource.
    7. If the user is authorized, the client is redirected to the resource using the stored URL path.
    The error page sent to a user that is not authenticated contains information about the failure.
    The last sentence could be interpreted as "The container should provide the error page with a valid exception object".
    How is this implemented in other servlet containers - JBoss, Websphere, Weblogic, Orion?
    //Anders

  • Behavior in form-based authentication

    Environment
    - WebLogic5.1 with SP8
    - WinNT 4.0 with SP5
    - JDK1.2.2
    When an authenticated user tries to access a resource that the user is not
    authorized to access, he/she
    is automatically forwarded to login page and WebLogic loses the
    authentication information of that user.
    Then the user has to re-login to access resources that he/she has
    permissions and previously accessed.
    My question is:
    1. Is there any way to redirect the user who attempts to access unauthorized
    resources to an error page, not the login page,
    so that the user doesn't have to re-login to access authorized resources?
    2. if a user tries to access an unauthrized resource, shouldn't I be
    getting a 403 {sc_Forbidden} error back?
    Is that correct? If so, I don't see why the following setting wouldn't work.
    <error-page>
    <error-code>403</error-code>
    <location>/errorpages/error.jsp?errorcode=403</location>
    </error-page>
    <error-page>
    <error-code>401</error-code>
    <location>/errorpages/error.jsp?errorcode=401</location>
    </error-page>
    <login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
    <form-login-page>/login.jsp</form-login-page>
    <form-error-page>/errorpages/error.jsp?errorcode=999</form-error-page>
    </form-login-config>
    </login-config>
    Thanks in advance for any help or comment.
    Sang

    Tom,
    Thanks for you comment. I appreciate it.
    I've tried what you suggested but there is still a problem.
    When a user is forwarded to the page specified as a login page in the xml,
    the identity of the user is already lost in the container.
    If you print the current user in the login.jsp by calling
    "Request.getRemoteUser()", you'll get a NULL.
    Although you go back to the JSP page you have already accessed, you have to
    go through the authentication over again.
    Is this correct authentication behavior?
    The following is an abstract of form-based authentication processes from
    Servlet v2.2 spec.
    ============================================================================
    When a user attempts to access a protected web resource, the container
    checks if the user has been
    authenticated. If so, and dependent on the user's authority to access the
    resource, the requested web
    resource is activated and returned. If the user is not authenticated, all of
    the following steps occur:
    1. The login form associated with the security constraint is returned to the
    client. The URL path
    which triggered the authentication is stored by the container.
    2. The client fills out the form, including the username and password
    fields.
    3. The form is posted back to the server.
    4. The container processes the form to authenticate the user. If
    authentication fails, the error page is
    returned.
    5. The authenticated principal is checked to see if it is in an authorized
    role for accessing the origi-nal
    web request.
    6. The client is redirected to the original resource using the original
    stored URL path.
    If the user is not successfully authenticated, the error page is returned to
    the client. It is
    recommended that the error page contains information that allows the user to
    determine that the
    authorization failed.
    ============================================================================
    Although the procedures of form based authentication is well-specified,
    behavior of authorization is quite unclear.
    It doesn't specify what should be done and what happens to the state of the
    current identity in case of authorization failure.
    Is there any workaround solution for this problem?
    Thanks again.
    Sang
    Tom Mitchell <[email protected]> wrote in message
    news:[email protected]...
    Sang,
    The behavior you are seeing seems to be correct. You are logged in andtry to
    hit a resource that you do not have access to. So, as far as thecontainer
    knows, it is supposed to give you a chance to reauthenticate as someonewho can
    access the new resource.
    If you have rights to both resources, you will not get prompted again.
    If I understand your desired behavior, you could have login to take place
    "manually" - meaning you will have an explicit login button or link.
    Then could have your login page, defined in the xml, actually be an errorpage
    that would not affect the current identity.
    Hope this helps.
    Tom Mitchell
    [email protected]
    Very Current Stoneham, MA Weather
    http://www.tom.org
    "Sang Y. Sung" wrote:
    Environment
    - WebLogic5.1 with SP8
    - WinNT 4.0 with SP5
    - JDK1.2.2
    When an authenticated user tries to access a resource that the user is
    not
    authorized to access, he/she
    is automatically forwarded to login page and WebLogic loses the
    authentication information of that user.
    Then the user has to re-login to access resources that he/she has
    permissions and previously accessed.
    My question is:
    1. Is there any way to redirect the user who attempts to accessunauthorized
    resources to an error page, not the login page,
    so that the user doesn't have to re-login to access authorizedresources?
    >>
    2. if a user tries to access an unauthrized resource, shouldn't I be
    getting a 403 {sc_Forbidden} error back?
    Is that correct? If so, I don't see why the following setting wouldn'twork.
    >>
    <error-page>
    <error-code>403</error-code>
    <location>/errorpages/error.jsp?errorcode=403</location>
    </error-page>
    <error-page>
    <error-code>401</error-code>
    <location>/errorpages/error.jsp?errorcode=401</location>
    </error-page>
    <login-config>
    <auth-method>FORM</auth-method>
    <form-login-config>
    <form-login-page>/login.jsp</form-login-page>
    <form-error-page>/errorpages/error.jsp?errorcode=999</form-error-page>
    </form-login-config>
    </login-config>
    Thanks in advance for any help or comment.
    Sang

  • Any one else have problems using 'FORM' based authentication in OC4J?

    Since I couldn't find any information on this from Oracle I went with the specifications from Orion.
    I am using Oracle Internet Directory Server for authentication of OC4J apps. I followed Orions specs for writing and pluging in your own usermanger to make calls to OID. Everything works fine when I use BASIC authentication but when I use FORM based authentication it fails to send the browser to the original url that was requested.
    The browser just displays a blank screen?
    You can tell that the client is authenticated because you can just request the URL again and it's displayed without prompting for a username/password.
    For the login in screen the only specs Orion gives is that your form has to have an action of 'j_security_check' and pass 'j_username' and 'j_password'.
    Does oracle have another way to do this, or has anyone else experienced this and no a way to fix it?

    Tom,
    Custom user authentication in Oc4J 1.0.2.2 is same in both Oc4J and Orion and we have tested that form based authentication works
    fine. In 9iAS Release 2 Oracle has an integerated JAAS implementation with OC4J which you can configure either to authenticate users from a encrypted file or users stored in OID.

  • Forcing specific clients or groups to use forms based authentication (FBA) instead of windows based authentication (WIA) with ADFS

    Hi,
    We are have a quite specific issue. The problem is most likely by design in ADFS 3.0 (running on Windows Server 2012 R2) and we are trying to find a "work-around".
    Most users in the organization is using their own personal computer and everything is fine and working as expected, single sign-on (WIA) internally to Office 365 and forms based (FBA) externally (using Citrix NetScaler as reverse proxy and load
    balancing with the correct rewrites to add client-ip, proxy header and URL-transformation).
    The problem occurs for a few (50-100) users where they are sharing the same computer, automatically logged on to the computer using a generic AD-user (same for all of them). This AD-user they are logged on with does not have any access to Office365
    and if they try to access SharePoint Online they receive an error that they can't login (from SharePoint Online, not ADFS).
    We can't change this, they need to have this generic account logged on to these computers. The issue occurs when a user that has access to SharePoint Online tries to access it when logged on with a generic account.
    They are not able to "switch" from the generic account in ADFS / SharePoint Online to their personal account.
    The only way I've found that may work is removing IE as a WIA-capable agent and deploy a User-Agent version string specific to most users but not the generic account.
    My question to you: Is there another way? Maybe when ADFS sees the generic user, it forces forms based authentication or something like that?
    Best regards,
    Simon

    I'd go with your original workaround using the user-agent and publishing a GPO for your normal users that elects to use a user-agent string associated with Integrated Windows Auth.. for the generic accounts, I'd look at using a loopback policy that overwrites
    that user agent setting, so that forms logon is preferred for that subset of users. I don't think the Netscaler here is useful in this capacity as it's a front-end proxy and you need to evaluate the AuthZ rules on the AD FS server after the request has been
    proxied. The error pages in Windows Server 2012 R2 are canned as the previous poster mentioned and difficult to customize (Javascript only)...
    http://blog.auth360.net

  • Issue with form based Authentication in three tier sharepoint 2013 environment.

    Hi,
    We are facing issue with form based Authentication in three tier environment.
    We are able to add users to the database and in SharePoint.
    But we are not able to login with created users.
    In single tier everything working fine
    Please help , Its urgent ... Thanks in advance.
    Regards,
    Hari
    Regards, Hari

    if the environments match, then it sounds like a kerberos double-hop issue
    Scott Brickey
    MCTS, MCPD, MCITP
    www.sbrickey.com
    Strategic Data Systems - for all your SharePoint needs

  • How do I get data to the from in a form based on a stored procedure

    I would like to create a form based on a stored procedure. I have bound LOV's that lookup the ID of the data that is to be displayed on the form. Then I have a button that reads the database and populates the fields on the form. This is our current UI standard on our portal site, and I need to copy that UI exactly in order to mix HTML DB code with our current portal code because we can not afford to re-write all our code in portal to HTML DB. Can this be done, and how can it be done? Thanks

    We are developing an entire HR system for our organization using portal forms. I am trying to prototype in HTML DB to see if we can switch our future development to this new product. However, we already have 50 or so forms that follow a certain user interface look and feel in portal. I am trying to create this interface look and feel in HTML DB. What we are doing in Portal is have a lookup section at the top of each form where you find the record you want to update with LOV's, sometimes 2 or 3 bound together, and then have a lookup button that does PL/SQL to read the database and populate the fields on the form. Then there is an Update button at the end of the form that takes the fields off the form and passes them to a stored procedure. I can not figure out how to do the Lookup button type of code to read information and bring it to the form when doing a form based on a stored procedure.

  • How to redirect to j_security_check without the form based authentication

    Hi,
    I am trying to integrate my application authentication to a backend system with the ibm websphere form based authentication. Below is the scenario:
    1. when the user clicks on a protected url, the container will redirect the user to the login page.
    2. instead of displaying the login page, i would like to automatically redirect the user to j_security_check action. which means that instead of displaying the login.jsp page, the user will automatically be redirected to j_security_check to perform some user authentication, and if successful, the application pages will be displayed.
    The reason i want to auto redirect the user to j_security_check is because i am implementing some integration work with a backend system. the user will key in the username/password from another system. once the user is authenticated, the user information will be passed to my system. The login page of my system will not be displayed again, and by using the username value, my system will assume that the user has successfully been authenticated (authentication done by the backend system), and therefore automatically gain authorization to login into my application.
    i hope that clarifies my problem.
    anyone out there has any solution to my problem?
    thanks a lot in advance.

    Hi Darren,
    Let me explain the whole authentication environment.
    There are actually 2 systems in this environment. Let;s call it system A and system B.
    System B is actually using the authentication mechanism that i described in my previous message.
    A login page will be presented to the user (within system A). User credential is collected and passed to system A to be authenticated. System A will use its own mechanism to authenticate the user.
    Once the user is authenticated, system A will pass the user ID to system B. At this point, system B will assume that the user is authenticated and grant authorization to access the application. (system B global security is enabled and implements the form based authentication mechanism) Therefore, at this point, the redirect page (so called login page) will not be displayed to the user, instead it will be automatically redirected to the j_security_check action to execute the customer Ldap Registry class. (ps : eventhough authentication is no longer needed, the flow will still go to Ldap Registry class. A check is done in the Ldap Registry class to skip the authentication, if it is not boot strap login. Only first and only time authentication is done for boot strap login).
    In the case a protected url is clicked or invoked by the user directly, the application will redirect the user to the initial login of system A. Otherwise (the url link originates from system A, during the passing of user token to system B), system B will redirect to j_security_check and execute the customer Ldap Registry class.
    Based on the above explained scenario, in your opinion, is there any security loopholes? consider that system B no longer perform authentication but only to grant authorization to the user.
    Appreciate your advice. Thanks in advance
    Anyway, i am using the ibm websphere server. :)

Maybe you are looking for