Getting Deployment Rule Sets to work

So, I'm struggling trying to get Java deployment rule sets working as follows:
Here is my simple ruleset.xml:
<ruleset version="1.0+">
<rule>
<id location="javatester.org" />
<action permission="run" version="1.6.0_35" />
</rule>
</ruleset>
I have gotten this same ruleset working using 3 different older versions of jre7 (7u45, 7u35, 7u9) where javatester.org website will display the specified version, even when a newer version is present. However, this seems to break when I try to specify a jre6 version (tried both 6u35 & 6u27).
For example, when I try 6u35, the javatester.org website displays
Error. Click for details
When I click, a blank pop up windows briefly pops up then disappears, with a title bar "Application Error". I have made the Java console visible for testing purposes, and both the 1.7.0_51 & 1.6.0_35 consoles pop up, but I can't find anywhere why this might not work. I am assuming it's not a certificate issue, as I imported my self-signed certificate into the Signer CA store and can see it in both the Java 7u51 control panel, and the Java 6u35 control panel.
Any thoughts? Anyone else get this working?

Hello,
can you show me your "ruleset.xml"?
I had similar problems when I had an error in there (invalid XML). You have to be extra careful that it is valid UTF-8 too. I already got a problem because of an invalid umlaut,
Regards
Markus

Similar Messages

Deployment Rule Sets do not properly launch the latest available version from the JRE6 family when the jpi-version is specified by the RIA

Issue Summary
In Java 1.7 Update 71, Java 1.7 Update 72 and Java 1.8 Update 25 Deployment Rule Sets do not properly launch the latest available version from the JRE6 family when the jpi-version is specified by the RIA. We've noticed this with Oracle Forms and Reports 11g where we have forms that specify Java 1.6 Update 20. We used to be able to specify Java 1.6 Update 26 in our Ruleset, but now the only version a that works in our ruleset is Java 1.6 Update 20 which is the same version requested by the JPI-Version attribute of the jar. The long term solution would be to upgrade Oracle Forms and Reports, however this isn't currently in the cards.
RuleSet.xml Test
Ruleset.xml
1
2
3
4
5
6
7
8
9
10
11
<ruleset version="1.0+">
<rule>
 <id location="*.javatester.org" />
 <action permission="run" version="1.6*" />
</rule>
<ruleset version="1.0+">
<rule>
 <id location="*.internaldomain.name" />
 <action permission="run" version="1.6*" />
</rule>
</ruleset>
Test 1 (Control)
Installed Java Versions:
– 1.7 Update 51 b13 (both x86 and x64 however x86 is invoked)
– 1.6 Update 26 b03 (both x86 and x64 however x86 is invoked)
Deployment Ruleset works as expected for both URLs
Test 2
Installed Java Versions:
– 1.7 Update 72 (both x86 and x64 however x86 is invoked)
– 1.6 Update 26 b03 (both x86 and x64 however x86 is invoked)
The RuleSet works for JavaTester.org however on internaldomain.name we get the following error:
With the trace logging turned on, I suspected the version attribute supplied by the RIA. I was able to trick Java by adding the following to my system deployment.properties file:
deployment.javaws.jre.0.product=1.6.0_20
deployment.javaws.jre.0.path=C\:\\Program Files (x86)\\Java\\jre6\\bin\\javaw.exe
deployment.javaws.jre.0.enabled=true
Because the RIA requests 1.6.0_20 it matches 1.6* from the deployment ruleset sooner than 1.6.0_26. However, if 1.6.0_20 is not available 1.6.0_26 should match according to the Deployment Rule Set documentation:
http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/security/deployment_rules.html
The version of the JRE that is used is determined by the following order of precedence:
1. The current version of the JRE is used if it is available and matches both the version attribute and the version requested by the RIA.
2. The latest available version of the JRE is used if it matches both the version attribute and the version requested by the RIA.
3. The current version of the JRE is used if it is available and matches the version attribute.
4. The latest available version of the JRE is used if it matches the version attribute.
If no version is available that meets the criteria, then the RIA is blocked, and a message is shown to the user. To provide a custom message, include the message element.
As a result:
If Java 1.6.0_20 is listed in the version requested by the RIA and 1.6.0_20 is listed in the deployment.properties file, #1 matches.
If Java 1.6.0_20 is listed in the version requested by the RIA, but 1.6.0_20 is NOT listed in the deployment.properties file the #1 SHOULD match, but doesn’t. It used to match up-to and including JRE 1.7 Update 51 however the ruleset appears to no longer match in subsequent versions.
#2 should never match with our current Deployment Ruleset. It would match if we specified 1.7* as a version in the Ruleset.xml.
#3 used to be broken as well after JRE 1.7 Update 51 however this bug has been marked as fixed. See: http://bugs.java.com/view_bug.do?bug_id=8032781
I have reproduced this issue with Java 1.7 Update 71, Java 1.7 Update 72, and Java 1.8 Update 25 when one of these versions are installed with Java 1.6 Update 26.

I can't seem to edit this post anymore, for some odd reason.
So here goes;
I found this post in NVIDIA's knowledge base;
When installing an after-market graphics card into a certified Windows 8 PC with UEFI enabled, the s...
The interesting parts in this post are as follows;
When an after-market graphics card is installed into a motherboard with UEFI enabled in the system BIOS, or if the system is a certified Windows 8 PC with Secure Boot enabled, the system may not boot.
UEFI is a new system BIOS feature that is provided on most new motherboards. A UEFI system BIOS is required in order for the Windows 8 Secure Boot feature to work. Secure boot is enabled by default on certified Windows 8 PCs.
In order to get the PC to boot with a graphics card that does not contain UEFI firmware, the end-user must first disable the secure boot feature in the system's SBIOS before installing the graphics card.
Note: Some system SBIOS's incorporate a feature called compatibility boot. These systems will detect a non-UEFI-enabled firmware VBIOS and allow the user to disable secure boot and then proceed with a compatibility boot. If the system contains a system SBIOS the supports compatibility boot, the user will need to disable secure boot when asked during boot process
This leads me to believe that the BIOS update that wrecked my setup was 9SKT58A/9SJT58A, which only contains one change;
"Adds support for updating BIOS from a WIN7 BIOS to a WIN8 BIOS".
I've just ordered a cheap UEFI-compatible GT640 from Gainward, so I hope I'll be able to try that out this weekend.

7u45: MacOS X: Deployment Rule Set not found?

Per the Deployment Rule Set packaging instructions:
http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/deployment_rules.html#package
"Install the DeploymentRuleSet.jar file on your users' systems in the following directories:
On Windows platforms, install the file in the <Windows-directory>\Sun\Java\Deployment directory, for example, c:\Windows\Sun\Java\Deployment.
On Mac OS X and UNIX platforms, install the file in the /etc/.java/deployment directory.
To view the active rule set, see the Security section of Java Control Panel."
I am able to use and view the rule set on Windows and Linux platforms, but the deployment rule set is not seen under MacOS X (10.9 Mavericks).
I placed it in:
/etc/.java/deployment/DeploymentRuleSet.jar and yes, it is properly signed, in the correct format, etc. Identical file works fine under Windows and Linux.
Anyone else have this issue?

Hurray!! I finally found out how to get the JCP to display the DeployementRuleSet.jar file.
The path in the documentation (/etc/.java/deployment) is wrong (at least on Mac OSX 10.7.5)!.
I went through the decompilation of the ControlPanel source code, and found out that the expected path for the jar file is
/Library/Application Support/Oracle/Java/Deployment
Note:The Deployment directory has to be created

Allowing jnlp via deployment rule set

Hello,
In our network, we use a deployment rule set to only allow applets that we deem necessary, and all others are blocked. This has been working fine. However recently I've been asked to add a website to the allowed list. This website downloads a jnlp file, then launches the jnlp locally, and is blocked every time. Now I'm not that well versed in java applets. But I've added the website address that this applet calls too, and have had no luck with this running. Everything I've tried has not worked.
This is a snippet of the ruleset.xml
<rule>
<id location="http://elm.elluminate.com:80/" /> 
<action permission="run" />
</rule>
The java console has not been helpful, as the application is blocked before java even starts...after the jnlp verifies, it blocks the application due to the ruleset. How can i set this ruleset up so that this jnlp is allowed to run?

Hello,
To allow a local jnlp to run without any prompts using Deployment Rule Sets, you can use a rule to allow all the applets signed with a specific certitificate:
<rule>
 <id>
 <certificate hash="794F53C746E2AA77D84B843BE942CAB4309F258FD946D62A6C4CCEAB8E1DB2C6" />
 </id>
 <action permission="run" />
</rule>
You can get your certificate hash in SHA-256 from the signed jar file following this doc:
http://docs.oracle.com/javase/8/docs/technotes/guides/jweb/security/deployment_rules.html#gethash

Deployment Rule Set broken with Java 7u55

Hello!
I'm using Deployment Rule Set in my company environment, its signed by code signing certificate that is given out by internal CA. After I upgraded to Java 7u55, the Deployment Rule Set does not recognize older statically installed Java version.
Versions I have:
7u45 - install directory: C:\Program Files\Java\jre1.7.0_45
7u51 - install directory: C:\Program Files\Java\jre1.7.0_51
7u55 - install directory: C:\Program Files\Java\jre1.7.0_55 or C:\Program Files\Java\jre7\ - neither does not work
When I go to site described in Ruleset and that has to use Java 7u45, then I receive an message "Deployment Rule Set required Java version 1.7.0_45 not available. In the same way it doesn't recognize 1.7.0.51 or even Java version 6.
When I uninstall Java 7u55, everthing works fine again.
My ruleset looks like this:
<ruleset version="1.0+">
 <rule>
 <id location="first.site.com" />
 <action permission="run" version="1.7.0_45" />
 </rule>
 <rule>
 <id location="second.site.com" />
 <action permission="run" version="1.7.0_51" />
 </rule>
 <rule
 <id />
 <action permission="default" />
 </rule>
</ruleset>
Anyone knows what's wrong or is it a bug?

costlow - I disagree. If I'm using IE, then I only need the internal certficate used to sign the jar to be also insalled on the machine in question in the windows CA Certs store. If the cert was the issue, why does it work with 7u51. If it was a bad cert, it should fail with every version. Plus, I think the pop up has a different error message if it has a cert issue.
I'm having the exact same issue as the OP described and it all started with 7u55. Here's what I've found:
- With 7u55 or 7u60 installed, the error will come up rergardless of what prior version is being requested.
- If 7u51 is the latest installed, it works
- If 8u05 is installed with 7u55 and/or 7u60, it works
- If I install the 7u60 EA b15, it works
Something in the final release is being added that blocks this functionality, but for some odd reason only in the 7 family starting with 7u55.
Any insight you could give would be very helpful. In the meantime, I am deploying 8u05 to cover this up, but it does pose issues for some apps that don't work with the new 8 family plugin.

Deployment Rule Set Centrally Managed location of .jar file?

Hello,
We are currently looking at implementing the Deployment Rule Set in our company and I was wondering if there is a way to centrally manage the Deployment Rule Set?
Having to keep up with deploying the jar file for every change and expiring certificates isn't ideal
Thanks!

And your OS doesn't have a file search feature, which might have given you the answer faster than waiting for a response on these columns?
db

Automatic Deployment Rules - Just Not Working/Reboot

Good Morning:
For the better part of 5 days I have been trying to get ADR deployed in my lab to install and automatically reboot machines. I have gotten everything set up and the rule is working and downloading the update, just never making it to the clients to
install the updates and or reboot. For simplicity sake, I created a device collection, "domain controllers" and this finds my two DCs just fine. I then created a ADR
Collection - Domain Controllers, Add to Existing Software Update Group - Software Updates (date released - 2 months, Product - 2008 R2) as both of my DCs are 2008 R2 - Evaluation Schedule (Run on schedule - once a week at 11:30 pm) - Deployment Schedule
(software/specific time 1 hour) (installation/2 hours) - User Experience Software Installation Checked - Then I create a new deployment package and then run it.
It created the deployment packages, and the software update group, I checked the logs and it downloads the files just fine and shows 42 updates needed. However I cannot get those two servers to install updates and reboot for the life of me. I have
google and read everything possible. I checked the permissions of the package source, I created a maintenance window for that time, I attempted to change the work information via powershell in case it was overlapping.
Can anyone please give me a little push in the right direction on what I could possibly be missing?
I did see this in the log,
Could not find element DeploymentId SMS_RULE_ENGINE
1/3/2014 10:03:35 AM 3240 (0x0CA8)
Could not find element UpdateGroupId SMS_RULE_ENGINE
1/3/2014 10:03:35 AM 3240 (0x0CA8)
Could not find element UpdateGroupName SMS_RULE_ENGINE
1/3/2014 10:03:35 AM 3240 (0x0CA8)
SQL is: select cis.CI_ID from vCI_ConfigurationItems cis join vProvisionedCIs pci on cis.CI_ID = pci.CI_ID where cis.CI_ID in (16789853, 16789855, 16789865, 16789867, 16790069, 16790071, 16790077, 16790081, 16790087, 16790089, 16790164, 16790166,
16790193, 16790195, 16790203, 16790205, 16790213, 16790217, 16790221, 16790424, 16790426, 16790430, 16790436, 16790438, 16790444, 16790448, 16790452, 16790509, 16790517, 16790523, 16790527, 16790531, 16790535, 16790537, 16790547, 16790568, 16790574) order
by cis.CI_ID SMS_RULE_ENGINE
1/3/2014 10:03:35 AM 3240 (0x0CA8)
42 of 42 updates are downloaded and will be added to the Deployment.
SMS_RULE_ENGINE 1/3/2014 10:03:35 AM
3240 (0x0CA8)
Any assistance would be greatly appreciated as this is just making me spin in circles.

In the WUAHandler
<![LOG[Failed to Add Update Source for WUAgent of type (2) and id ({425A8C16-C127-4006-B60D-8F04DF0333EB}). Error = 0x87d00692.]LOG]!><time="11:28:02.414+360" date="01-03-2014" component="WUAHandler" context="" type="3" thread="6796" file="cwuahandler.cpp:2325">
<![LOG[Its a WSUS Update Source type ({425A8C16-C127-4006-B60D-8F04DF0333EB}), adding it.]LOG]!><time="12:58:08.788+360" date="01-03-2014" component="WUAHandler" context="" type="1" thread="4344" file="sourcemanager.cpp:1232">
<![LOG[Enabling WUA Managed server policy to use server: http://KSP-SCCM.waw.local:8530]LOG]!><time="12:58:08.788+360" date="01-03-2014" component="WUAHandler" context="" type="1" thread="4344" file="sourcemanager.cpp:948">
<![LOG[Waiting for 2 mins for Group Policy to notify of WUA policy change...]LOG]!><time="12:58:08.803+360" date="01-03-2014" component="WUAHandler" context="" type="1" thread="4344" file="sourcemanager.cpp:954">
<![LOG[Group policy settings were overwritten by a higher authority (Domain Controller) to: Server http://KSP-SCCM:8530 and Policy ENABLED]LOG]!><time="12:58:10.348+360" date="01-03-2014" component="WUAHandler" context="" type="3" thread="4344" file="sourcemanager.cpp:1013">
<![LOG[Failed to Add Update Source for WUAgent of type (2) and id ({425A8C16-C127-4006-B60D-8F04DF0333EB}). Error = 0x87d00692.]LOG]!><time="12:58:10.348+360" date="01-03-2014" component="WUAHandler" context="" type="3" thread="4344" file="cwuahandler.cpp:2325">
So now I think that GPO setting maybe causing my issues.

Deployment Rule Set - Allow file://

I have a DVD that uses Java to look up parts. Java content is blocked because the content is not signed by the vendor. When it is blocked, it lists the location as "file://"
I have tried to add the following to the DeploymentRuleSet with no success:
<rule>
<id location="file://" />
<action permission="run" />
</rule>
It no longer tells me that the content is blocked, but it also doesn't run the content. It just sits there.
I have even added file:/ to the exceptions list and it still doesn't work.
I've had to work around this issue by installing Java 6 on systems that need to access this DVD.
Has anyone been successful in allowing "file://" to run through a rule in their DeploymentRuleSet?

Hello,
Can you try something like
file://*
file://c/*
etc.
-Roger

Cannot get restricted command set to work with ACS 5.5 and HP Procurve switches - Can anyone assist?

I have AAA authentication working with no restrictions and I have TACACS working with command restrictions for my Cisco gear.

Hi... I have created a shell profile in Policy Elements -> Authorization and Permissions -> Device Administration -> Shell Profiles which has a assigned privilege level of 15 and a max privilege level of 15. Further to this I have added a new commands set via Policy Elements -> Authorization and Permissions -> Device Administration -> commands sets.
I have referenced the shell profile via Access Policies -> Access Services -> Default Device Admin -> Authorization. And this part of it seems to work fine, but the command set I am using to restrict the commands allowed is not being used...do I need to reference the command set somewhere else within the ACS platform as well? The configuration I have added on to the Network Device is as follows: -
aaa new-model
aaa authentication login default group tacacs+
aaa authentication enable default group tacacs+
aaa authorization config-commands
aaa authorization exec default group tacacs+ local
aaa authorization commands 15 default group tacacs+ none
Can you advise what it is I am missing?

Getting the autocomplete setting to work by typing the first letter of a word

Before I installed Firefox 5.0, I had made it so that whenever I visited a website that remembered an account/password of mine, this happened:
1.- It asked for my master password.
2.- After entering it, I would click on the form field and then type in the FIRST LETTER of the account.
3.- When entering that exact first letter, Firefox would suggest in a drop-down menu the account or accounts that started with that letter on that particular site, e.g.: say I have a Twitter account that is "koko999". If I went to twitter.com and entered the letter "k" in the form field (after entering the master password), Firefox would suggest the account "koko999" in the drop-down menu.
4.- After selecting the account that I desired from the drop-down menu, Firefox would automatically autocomplete the password.
5.- Then, if I closed Firefox, all my active accounts would close/sign out. So, if afterwards I opened Firefox, I would have to repeat from Step 1 if I wanted to use an account, e.g.: if I closed FF while having my Twitter account logged in, and then opened FF again, I would have to start from Step 1.
Now, I had this setting for a bunch of different websites. After installing Firefox 5.0, this configuration vanished or something. Now, when entering the master password, Firefox autocompletes EVERYTHING. Say, using the example from before, that I go to twitter.com. Firefox asks for the master password, I enter it and then the ID/password for the twitter account automatically fills in without me entering any letter in the form field. And I do not want Firefox to do that!
So, I'm asking for help. I know that what I what to do is not impossible, I just can't find the way to do it! I kinda need the exact steps. Thanks a lot!

See:
* http://kb.mozillazine.org/Password_only_filled_after_entering_user_name
* http://kb.mozillazine.org/signon.autofillForms (false)
If you are in Private Browsing then Firefox wont fill the names and passwords automatically.
You can set the pref browser.sessionstore.privacy_level to 2 (never) or 1 (non-HTTPS, default in Firefox 3 versions) on the about:config page to disable saving cookies via session restore.
* http://kb.mozillazine.org/browser.sessionstore.privacy_level
You can also use [[Clear Recent History]] to clear the "Active Logins" when you close Firefox.
To open the about:config page, type about:config in the location (address) bar and press the "Enter" key, just like you type the url of a website to open a website. 
If you see a warning then you can confirm that you want to access that page. 
You can use the Filter bar at to top of the about:config page to locate a pref more easily.

Rule set - Fundamentals - 46C ECC6 Upgrade impact

Hi,
Am on CC 4.0 FF3.0, SP 12
1.Am I right to say that the rule set contains objects /tcds ?
2. During the upgrde from 46C to ECC6.0 many objects are present, how much is the impact if I use the same rule set as 46C on ECC6 ?
3. Do I really need to change the rule set now or can i defer it - to a date when i get to the GRC 53?
Thanks

Hi George,
Please find my response below:
1.Am I right to say that the rule set contains objects /tcds ? Yes. Rule set contains all the rules which in turn contains combinations of objects and tcodes which poses risks.
2. During the upgrde from 46C to ECC6.0 many objects are present, how much is the impact if I use the same rule set as 46C on ECC6 ? The same rule set will work but it won't have all the new tcodes or objects.
3. Do I really need to change the rule set now or can i defer it - to a date when i get to the GRC 53? *As long as you don't use new tcodes/objects from ECC, it should be fine. If you have to follow SOX then your auditors might not agree with thi
Regards,
Alpesh

Mail Box Rules' won't work!

How do I get the 'Rule' function to work? I want certain mail I recieve to be deleted. I have entered all the information I thought it needed, but it still doesn't work.
For eg: I want to delete all the Apple Discussion forums that don't relate to my topics, because I am recieving thousands of them everytime I log on (which isn't very often). So I just want to delete them.
Does it make a difference if I select the option 'subject' or 'from'? I am really sick of manually deleting all this unwanted mail.

You could setup rule that "if any Subject is xxx" then "move it to Trash", then stop processing rules, but you'd have to keep enough emails to know all the subjects you're receiving before you can filter them out. You can do multiple subjects in one rule.
The discussion forums are available via RSS, so are you using Mail as your RSS Newsreader, or are you truly receiving email? If it's the latter, I suggest using RSS instead, since you can subscribe only to the topics that interest you.
Mulder

RA&R rules 5.3 changes compared to standard global rule set

Good day,
Please can someone assist me. I need to compare a clients customised rule set to the standard rule set, and document where changes have been made. (There is no log of the changes) A client has made modifications to the rule set, we are not sure if these modifications were valid, so we need to compare these to the standard rule set. The problem is that the client has modified the "GLOBAL" rule set, so I do not have a base rule set to work from. I have looked at the initial upload files, but they are not easily compared with the current production rule set. Does anyone have any solutions as to how this could be achieved?
Thank you and Kind Regards
Jill

Hi ,
How the client has modified the GLOBAL Rule Set in RAR, are they just dectivated the risk from the global rule set? or deleted the risks peminately.
if they dectivated the Risks in GLOBAL Rule set, just download the Rules through utilities(Cofiguration) and check the values which are having the '0' (ZERO) values, those risks only deactivated. it is the better process to sagarigate rule set.
Regards,
Arjuna.

When our iPad is in use on the internet, my iMac internet connection goes off. I can't get the two devices to work at the same time with the AirPort Express. Is there a setting somewhere I may have missed?

When our iPad is in use on the internet, my iMac internet connection goes off. I can't get the two devices to work at the same time with the AirPort Express. Is there a setting somewhere I may have missed?

When two or more devices conflict it typically means that the DHCP service is either misconfigured or is not running at all. DHCP provides IP addresses to local network clients.
Is your AirPort Express base station the only router in your current network configuration? That is, is it connected directly to an Internet modem and not to another router upstream of it?

[svn:fx-trunk] 13257: Fix for @inheritDoc not working on a setter, but works on a getter

Revision: 13257
Revision: 13257
Author:   [email protected]
Date:     2010-01-04 10:49:13 -0800 (Mon, 04 Jan 2010)
Log Message:
Fix for @inheritDoc not working on a setter, but works on a getter
QE notes: None.
Doc notes: None
Bugs: SDK-24727
Reviewed By: Paul
Tests run: checkintests
Is noteworthy for integration: No
Ticket Links:
    http://bugs.adobe.com/jira/browse/SDK-24727
Modified Paths:
    flex/sdk/trunk/modules/compiler/src/java/flex2/compiler/asdoc/ClassTable.java

steabert wrote:
Hi,
I had a similar problem with my Dell Latitude E4310, and apparently also the E6410, E6510.
The solution for me was to add the following line to /etc/modprobe.d/modprobe.conf:
options snd-hda-intel model=dell-s14
I tried that, unfortunately it does not work with this chipset. I do get a different set of channels though but it still cannot record anything. Maybe this chipset is too "new" for alsa. The latest release dates back from the end of January. Support for it is explicitly stated in the changelog to 1.0.24 but perhaps the recording part of it slipped through the cracks. ALSA bug tracking system seems quite closed.

Getting Deployment Rule Sets to work

Similar Messages

Maybe you are looking for