How can I check if an user has access to an url within my web app?

Hi,
I have a web application where I allow the users to set their startup page by presenting them a list of startup pages. However, some startup pages can accessed only by certain users, so I want to present the user only those pages the user has access to.
How can I do this with weblogic?
One way is to read the web.xml file and determine the roles that have access to the page, then check whether the user has any of those roles.
Is there a better way eventually using some weblogic api?
Thanks

Just for the record, I decided to parse the web.xml file and to simulate whatever the container does.

Similar Messages

How can I tell if a user has used IMAP?

How can I tell if a user has used IMAP?
<P>
Check their mailbox for a file called "__VALIDITY__" If they have this
file in their mailbox, they've used IMAP.

You may want to refer to the Java Security forum at http://forum.java.sun.com/forum.jspa?forumID=545 for information on Kerberos & JAAS.
There is a also a post in this forum, outlining how to utilise Kerberos, JAAS with JNDI to access Active Directory. JNDI, Active Directory and Authentication (Part 1) (Kerberos)
at http://forum.java.sun.com/thread.jspa?threadID=579829&tstart=300
Possibly the part you are looking for is the functionality included in the class that implements java.security.PrivilegedAction
Good luck.

HT5313 How can I check if my iMac has this update? OS X Lion v10.7.5 Update

How can I check if my iMac has this update? OS X Lion v10.7.5 Update

It's not technically challenging, but it isn't clearly necessary. In any case here's how:
Reinstalling Lion/Mountain Lion Without Erasing the Drive
Boot to the Recovery HD: Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.
Repair the Hard Drive and Permissions: Upon startup select Disk Utility from the main menu. Repair the Hard Drive and Permissions as follows.
When the recovery menu appears select Disk Utility. After DU loads select your hard drive entry (mfgr.'s ID and drive size) from the the left side list. In the DU status area you will see an entry for the S.M.A.R.T. status of the hard drive. If it does not say "Verified" then the hard drive is failing or failed. (SMART status is not reported on external Firewire or USB drives.) If the drive is "Verified" then select your OS X volume from the list on the left (sub-entry below the drive entry,) click on the First Aid tab, then click on the Repair Disk button. If DU reports any errors that have been fixed, then re-run Repair Disk until no errors are reported. If no errors are reported click on the Repair Permissions button. Wait until the operation completes, then quit DU and return to the main menu.
Reinstall Lion/Mountain Lion: Select Reinstall Lion/Mountain Lion and click on the Continue button.
Note: You will need an active Internet connection. I suggest using Ethernet if possible because it is three times faster than wireless.

How can i check if at&t has unlocked my phone

How can i check if at&t has unlocked my phone?

You should get an email from them to let you know the unlock request has successfully been processed. From there, you restore the phone as new and should get a message on its screen that says it's been unlocked.
If you haven't gotten the email, contact AT&T for an update.
~Lyssa

How can I tell if a user has already authenticated against AD?

Sorry to begin with if this has been dealt with in another thread already. Ive taken a look around and cant see something that answers my questions exactly. If such a thread exists, please point me in that direction.
We have a product that needs to be installed on a customer site. Its a windows based, web fronted application with a client program on the user's pc and a server side component that handles requests for data. What I need to do is to check if the user has already authenticated against active directory. If so then I dont need to ask for authentication (single sign on).
This is my first look at jndi so Im in the dark about how this should be done. Is there a way to use the user's credentials (is there a token?) to check or do I need a specific login for my application to access the customer AD?
Any tips would be very welcome,
Mark

You may want to refer to the Java Security forum at http://forum.java.sun.com/forum.jspa?forumID=545 for information on Kerberos & JAAS.
There is a also a post in this forum, outlining how to utilise Kerberos, JAAS with JNDI to access Active Directory. JNDI, Active Directory and Authentication (Part 1) (Kerberos)
at http://forum.java.sun.com/thread.jspa?threadID=579829&tstart=300
Possibly the part you are looking for is the functionality included in the class that implements java.security.PrivilegedAction
Good luck.

How to check if a user has access to a responsibility

Hi,
I have a user_id in the controller. How do I know if this user has a particular responsibility added to him or not. I guess there a specific proflle call which gives this information. Can you give me that information.
Thanks,
HC

Create a vo with the following SQL passing userid as bind value:
SELECT C.USER_NAME,
B.RESPONSIBILITY_NAME,
A.START_DATE,
A.END_DATE
FROM APPS.FND_USER_RESP_GROUPS_DIRECT A,
APPS.FND_RESPONSIBILITY_TL B,
APPS.FND_USER C
WHERE C.USER_ID = A.USER_ID
AND C.USER_NAME= :1
AND B.RESPONSIBILITY_ID = A.RESPONSIBILITY_ID
You will have the list of all the responsibilities of a user.
Kristofer

How can i check the unzip file has finished unzip process?

i am using 7zip to unzip the file. java program can check the unzip file has finished unzip process?
Edited by: rayray2008 on Feb 12, 2008 7:14 PM

Downloading and burning Linux or Windows ISO images for example with a single flipped bit can cause system instability nearly impossible to track down, and not otherwise detectable. An MD5 checksum (OR SHA) check will quickly detect any such transmission errors. Not something anyone I know bothers to use unless it's important data. The temporary fix of changing the about:config setting, then expanding to full screen in downloads was working. But now, based on my interpretation of comments made on the authors Sourceforge page, Firefox has made updates that prevent the MD5 Reborned Hasher from working in Firefox at all. If that's true, I would really like to know the reason. With all this talk of NSA spying, I would think more people would be interested in making sure someone isn't tampering with their downloads. I have no idea. But I do believe the wonderful volunteers at Firefox need to figure out a way to make this valuable piece of security software whole again. Thank You.
PS: For those needing to verify a file, you might want to try the "Microsoft File Checksum Integrity Verifier" kb841290 . It's old, but does large file MD5 from a command prompt.

How can I check an object is an instance of any type within an array of related types?

In LabVIEW, it's possible to check the runtime type of an object using To More Specific Class.vi. One usage of this would be to perform a safety check if some kind of class uses instances of another kind of class but is only able to handle a subset of that class' child types.
For instance, let's say you had Beverage.lvclass, which represents an abstract type of product, and several subclasses: Coffee.lvclass, Tea.lvclass and Soda.lvclass.
We also have a Person.lvclass which can drink beverages. A person also has preferences about the drinks they do or do not like:
Attached is an implementation of this in LabVIEW.
In Person.lvclass : Drink.vi, I have the following code. For whatever reason the wire appears broken in these snippets but it's all fine in the actual code.
In Scenario.vi, I have the following code:
What I'm finding is that no error is generated and instead I get "Yum, I love tea!", "Yum, I love coffee!" and "Yum, I love soda!". My guess is that To More Specific Class.vi casts to the static type of the "target class" input wire rather than its runtime type - and because I'm passing in elements from an array of types, the wire's static type is upcasted to the most specific type that is a superclass of the types in the array - which would be Beverage.lvclass. And so the cast is trying to determine if an object of static type Beverage.lvclass is an instance of Beverage.lvclass, which will of course be the case all the time.
Is there any way to make LabVIEW check against the most specific runtype type of an object? As in, is there something I could do that, in this example case, would allow me to get the required behaviour of Joe throwing an error when he's made to drink soda? Or is this another limitation of LabVIEW that I'm going to have to live with?
Solved!
Go to Solution.
Attachments:
TypeCastingExample.zip ‏64 KB

tst wrote:
Your guess seems reasonable. I can't check right now, but there's a primitive called preserve run time type, which should do what you want.
Cheers, that seems to have got it! I've never really looked at Preserve Run-Time Class before, but it seems to do the right thing.

Determine if a user has access to a URL in a webApp?

Hello All.
I have created a WebApp and defined <security-constraint>'s in the
/WEB-INF/web.xml file, and all works fine.
However, I would like to enable/disable links on my User Interface based on
the current user's groups/roles and the <security-constraints>'s.
I can use the request.isUserInRole() method to determine if a user belongs
to a particular role.
However, what happens if the access to the URL changes in the web.xml file.
I need to programmatically determine which roles can access a URL defined in
the <security-constraint>.
Are there any weblogic classes that will assist in determining url patterns
and roles.
Any help would be greatly appreciated.
Thank you
Brad Hof

Bradley Hof wrote:
Hello All.
I have created a WebApp and defined <security-constraint>'s in the
/WEB-INF/web.xml file, and all works fine.
However, I would like to enable/disable links on my User Interface based on
the current user's groups/roles and the <security-constraints>'s.
I can use the request.isUserInRole() method to determine if a user belongs
to a particular role.
However, what happens if the access to the URL changes in the web.xml file.You can't redeploy webapps in WL 5.1 so this will never happen :)
Cheers,
Alex

How Can I Check Time Machine backup has worked?

Hello all
I am new to Mac and still feeling my way so please be gentle! I am not even sure if this is the right community to be in. My system runs 10.7.2 (is that lion, leaopard or penguin?)
Today I used Time Machine for the first time. Successfully formatted my external harddrive and did the first backup. Then uploaded all my photos from my camera using iphoto and did another backup.
I want to check that the back up was successfull and that my photos are on the external hard drive before I do a second backup on a different hardrive and then delete the pics from my camera. I am not sure how to check this. When I open the external harddrive I can't really understand where the iphoto files would be...
your advice and patience with a rookie would be much appreciated
Cheers
CC

Hi ChicaneChampagne
It would appear from your posts that you are failing to understand how backups and TM works...
For a better understanding see these links before going any further...
Time Machine Tutorial
How do I view or restore selected items?
Restore From Time Machine
http://support.apple.com/kb/VI29
You may also find this Link by Pondini of Interest...
http://pondini.org/TM/Clones.html

How can I check if a thread has stopped?

I'm writing a program which is supposed to open a file, sort all the numbers from smallest to largest value, and then write the sorted list back into a new file. It is specified in the task that I have to use multiple threads, and because of that I have a question:
I want my program to check if all the threads have stopped before the program starts writing to the output file. Doing it with an if-sentence and/or using a boolean would be perfect, I think. Is there any way I can do this?

u can use Thread.isAlive() to know if the thread is still running.. else u can use Thread.join() that waits until the Thread excutes till completion..when you would know that the thread is completed

How can I check my iPad backup has backed up my photographs

Hi
I've had to buy a new laptop and now want to sync my iPad with it. I've followed some previous instructions on backing up with iTunes. The next step is to sync it which will wipe the iPad and to restore from backup. I'm very nervous about doing this - how do I know that the backup backed up my photographs - it didn't seem to take that long. Foolishly I don't have the photographs stored anywhere else and I don't want to lose them.
thanks

Apart from restoring the backup onto a device there is no other way of confirming what is in it - but it should contain photos taken with the iPad, copied to it via the camera connection kit, or saved from emails/websites etc. The backup won't contain photos that weren't originally synced from a computer.
If the photos are still on the iPad then you can copy them off : http://support.apple.com/kb/HT4083
You can also copy off photos that were originally synced from a computer, but you will need a third-party app such as Simple Transfer which can copy them off via your wifi network. But as photos are 'optimised' when they are synced to the iPad, any that you then copy back to a computer may not be exactly the same as they originally were on your computer.

How to check if the user has only the display authority of a message

hi,
How to check if the user has only the display authority of a message but does not have the change authority for a certain message?
Best regards,

hi blake
though i am an application consultant and for authorisation u need to have help of BASIS person if u r not the one but still i can guide u regarding the same,
Basically Authorization Management
Use
You can use the following authorization objects to control the authorizations for maintaining business partner data:
        Authorization objects for the Business Partner:
             B_BUPA_GRP
             B_BUPA_ATT
             B_BUPA_FDG
             B_BUPA_RLT
Authorization objects for relationships:
             B_BUPR_BZT
             B_BUPR_FDG
In addition, you can assign an authorization group to a business partner in the dialog. The authorization group controls which users may maintain data for this business partner.
You can also define authorizations for fields and field groups using the Business Data Toolset (BDT). Depending on the settings you have made, the system carries out the relevant authorization checks.
In the dialog in the SAP GUI, you can display an overview of the authorizations assigned to you by pressing the button Settings.
For more information on authorization management, see the Implementation Guide (IMG) of the Business Partner, as well as in the Developers Handbook for the BDT under Authorizations.
IntegrationAuthorization management for the Business Partner forms part of the SAP authorization concept.
Prerequisites
You have made the necessary settings in Customizing of the Business Partner under Basic Settings--> -Address Management.
Moving over
AS ABAP Authorization Concept
The ABAP authorization concept protects transactions, programs, and services in SAP systems from unauthorized access. On the basis of the authorization concept, the administrator assigns authorizations to the users that determine which actions a user can execute in the SAP system, after he or she has logged on to the system and authenticated himself or herself.
To access business objects or execute SAP transactions, a user requires corresponding authorizations, as business objects or transactions are protected by authorization objects. The authorizations represent instances of generic authorization objects and are defined depending on the activity and responsibilities of the employee. The authorizations are combined in an authorization profile that is associated with a role. The user administrators then assign the corresponding roles using the user master record, so that the user can use the appropriate transactions for his or her tasks.
Authorization Checks
To ensure that a user has the appropriate authorizations when he or she performs an action, users are subject to authorization checks.
The following actions are subject to authorization checks that are performed before the start of a program or table maintenance and which the SAP applications cannot avoid:
        Starting SAP transactions (authorization object S_TCODE)
        Starting reports (authorization object S_PROGRAM)
        Calling RFC function modules (authorization object S_RFC)
        Table maintenance with generic tools (S_TABU_DIS)
Checking at Program Level with AUTHORITY-CHECK
Applications use the ABAP statement AUTHORITY-CHECK, which is inserted in the source code of the program, to check whether users have the appropriate authorization and whether these authorizations are suitably defined; that is, whether the user administrator has assigned the values required for the fields by the programmer. In this way, you can also protect transactions that are called indirectly by other programs.
AUTHORITY-CHECK searches profiles specified in the user master record to see whether the user has authorization for the authorization object specified in the AUTHORITY-CHECK. If one of the authorizations found matches the required values, the check is successful.
Starting SAP Transactions
When a user starts a transaction, the system performs the following checks:
        The system checks in table TSTC whether the transaction code is valid and whether the system administrator has locked the transaction.
        The system then checks whether the user has authorization to start the transaction.
The SAP system performs the authorization checks every time a user starts a transaction from the menu or by entering a command. Indirectly called transactions are not included in this authorization check. For more complex transactions, which call other transactions, there are additional authorization checks.
             The authorization object S_TCODE (transaction start) contains the field TCD (transaction code). The user must have an authorization with a value for the selected transaction code.
             If an additional authorization is entered using transaction SE93 for the transaction to be started, the user also requires the suitable defined authorization object (TSTA, table TSTCA).
If you create a transaction in transaction SE93, you can assign an additional authorization to this transaction. This is useful, if you want to be able to protect a transaction with a separate authorization. If this is not the case, you should consider using other methods to protect the transaction (such as AUTHORITY-CHECK at program level).
        The system checks whether the transaction code is assigned an authorization object. If so, a check is made that the user has authorization for this authorization object.
The check is not performed in the following cases:
You have deactivated the check of the authorization objects for the transaction (with transaction SU24) using check indicators, that is, you have removed an authorization object entered using transaction SE93. You cannot deactivate the check for objects from the SAP NetWeaver and HR areas.
This can be useful, as a large number of authorization objects are often checked when transactions are executed, since the transaction calls other work areas in the background. In order for these checks to be executed successfully, the user in question must have the appropriate authorizations. This results in some users having more authorization than they strictly need. It also leads to an increased maintenance workload. You can therefore deactivate authorization checks of this type in a targeted manner using transaction SU24.
             You have globally deactivated authorization objects for all transactions with transaction SU24 or transaction SU25.
             So that the entries that you have made with transactions SU24 and SU25 become effective, you must set the profile parameter AUTH/NO_CHECK_IN_SOME_CASES to Y (using transaction RZ10).
All of the above checks must be successful so that the user can start the transaction. Otherwise, the transaction is not called and the system displays an appropriate message.
Starting Report Classes
You can perform additional authorization checks by assigning reports to authorization classes (using report RSCSAUTH). You can, for example, assign all PA* reports to an authorization class for PA (such as PAxxx). If a user wants to start a PA report, he or she requires the appropriate authorization to execute reports in this class.
We do not deliver any predefined report classes. You must decide yourself which reports you want to protect in this way. You can also enter the authorization classes for reports with the maintenance functions for report trees. This method provides a hierarchical approach for assigning authorizations for reports. You can, for example, assign an authorization class to a report node, meaning that all reports at this node automatically belong to this class. This means that you have a more transparent overview of the authorization classes to which the various reports are transported.
You must consider the following:
              After you have assigned reports to authorization classes or have changed assignments, you may have to adjust objects in your authorization concept (such as roles (activity groups), profiles, or user master records).
              There are certain system reports that you cannot assign to any authorization class. These include:
              RSRZLLG0
              STARTMEN (as of SAP R/3 4.0)
              Reports that are called using SUBMIT in a customer exit at logon (such as SUSR0001, ZXUSRU01).
              Authorization assignments for reports are overwritten during an upgrade. After an upgrade, you must therefore restore your customer-specific report authorizations.
Calling RFC Function Modules
When RFC function modules are called by an RFC client program or another system, an authorization check is performed for the authorization object S_RFC in the called system. This check uses the name of the function group to which the function module belongs. You can deactivate this check with parameter auth/rfc_authority_check.
Checking Assignment of Authorization Groups to Tables
You can also assign authorization groups to tables to avoid users accessing tables using general access tools (such as transaction SE16). A user requires not only authorization to execute the tool, but must also have authorization to be permitted to access tables with the relevant group assignments. For this case, we deliver tables with predefined assignments to authorization groups. The assignments are defined in table TDDAT; the checked authorization object is S_TABU_DIS.
You can assign a table to authorization group Z000. (Use transaction SM30 for table TDDAT) A user that wants to access this table must have authorization object S_TABU_DIS in his or her profile with the value Z000 in the field DICBERCLS (authorization group for ABAP Dictionary objects).
please See also:
        SAP Notes 7642, 20534, 23342, 33154, and 67766
guess this info will help you,there is one graphic which actually explain the hierarchy of authorisation,i will find some time out to let u know more info about the authorisation
but if u sit with ur BASIS guy then u can learn lot of things in PFCG
i guess u r a basis guy,then its not a problem
best regards
ashish

How do I change the color of font in a fillable form in Adobe Reader? How can I check if the writer of the document has given permission to edit color and not just add text?

How do I change the color of font in a fillable form in Adobe Reader? How can I check if the writer of the document has given permission to edit color and not just add text? Please help! I'm technologically challenged.

Most forms (99% or more) are created for simple text input, where you cannot change anything.
The creator of the form could allow Rich Text input (which allows you to change font, text size, color, etc.), but frankly I have never seen such a form, and I wouldn't know how they look. But I'm sure they would show some kind of controls to alter the text appearance.

How to check if a user has SAP_ALL in a program?

Hi:
I want to create a program that will check if the user has SAP_ALL. Is there a standard FM or BAPI?. Otherwise, can someone pelase help.
Thank you.
Seshagiri Gopi

Hi,
Please check the below link:
http://wiki.sdn.sap.com/wiki/display/BI/AuthorizationinSAPNWBI
Regards,
Nilesh.

How can I check if an user has access to an url within my web app?

Similar Messages

Maybe you are looking for