How the ejb know about an authenticated user?

Hi
perhaps it is a dummy question but I didn't find any explicit answer.
I'd like to know how the ejb can know if a user belongs to a role.
For example if I want to access my ejb with a servlet, and this servlet is protected
(access allowed only for group customer)
and in my bean's deployment descriptor I have protected one method with the security
role customer)
What I am wondering is when the user is authenticated in the servlet as a customer
and then try to access the method how the ejb knows that this user is in the group
customer??
Is this information included in the http session or in the initialcontext created
in the servlet or somewhere else??
thanks for your help
romain

Romain - I think the answer to your question is that the information
identifying the user is passed into the initial context parameters. Weblogic
uses this to propagate the security context from the servlet container to
the ejb container.
cheers,
Markus
"romain" <[email protected]> wrote in message
news:3b0e8b23$[email protected]..
>
Hi
perhaps it is a dummy question but I didn't find any explicit answer.
I'd like to know how the ejb can know if a user belongs to a role.
For example if I want to access my ejb with a servlet, and this servlet isprotected
(access allowed only for group customer)
and in my bean's deployment descriptor I have protected one method withthe security
role customer)
What I am wondering is when the user is authenticated in the servlet as acustomer
and then try to access the method how the ejb knows that this user is inthe group
customer??
Is this information included in the http session or in the initialcontextcreated
in the servlet or somewhere else??
thanks for your help
romain

Similar Messages

How can i know about any users who log on sap last one month..all data and

Dear all,
how can i know about any users who log on sap last one month..all data and transaction code they used in a month.
Regards,
ASHUTOSH
9891595497

Dear Ashutosh,
I think your question is in the wrong forum. This is for SAP MDM related questions and answers. SAP MDM does not use Transaction codes. So you may not get much help here.
Please try posting your question in the ABAP forums and you may get the right resources to help you.
Thanks.
Siva K.

How can I know about the latest updates / versions which when available for all the CC products, without having to install and check it with the Desktoip Creative Cloud Application ?

How can I know about the latest updates / versions which when available for all the CC products, without having to install and check it with the Desktoip Creative Cloud Application ?

Thanks for looking into this Jeff!
I work with an Inventory module software and is responsible for software detection across several computers. Once an updated version comes up, I update our database with latest software details to get it detected if installed on any machines.
The problem tracking updates with Desktop Creative Cloud Software are;
1)We have to have it installed with the CC applications in-order to get the notification of the latest updates and have to check everyday.
2)Only relates to the latest updates, so in-between we may miss a prior update unknowingly.Hence, the remote machines having those updates may not get detected with the software version update which would create problem in reporting.
3)For all CC products, there is no base or previous updates available for installation if we miss one.
I went through the Adobe Products Update pages [Product updates] which holds good when it comes to Acrobat and Reader software which I follow to track down any newer updates but this is inconsistent when it comes to CC products like in After Effects CC, Dreamweaver CC etc...
So overall to be very specific, is there any one channel I can follow to get the notifications only for the updates on CC products and then may be I can rely on Desktop Creative Cloud for installation if not available anywhere like in product update pages of Adobe ?
Regards,
Subrat

I have monthly subscription app how can i know about who cancel subscription ? and how i can calculed the monthly revenue ?

i have monthly subscription app how can i know about who cancel subscription ? and how i can calculed the monthly revenue ?

Apple20141 wrote:
Or open sim tray and find out the carrier ring the carrier and give them numbers on sim
The carrier will not give out information about the owner of the phone.

I have monthly subscription app how can i know about who cancel the supscription ?

i have monthly subscription app how can i know about who cancel subscription ? and how i can calculed the monthly revenue ?

Apple20141 wrote:
Or open sim tray and find out the carrier ring the carrier and give them numbers on sim
The carrier will not give out information about the owner of the phone.

How to check new brand iphone 5s?? how to i know i m first user??

how to check new brand iphone 5s?? how to i know i m first user??

shreksiphone22 wrote:
authorized Apple reseller actually apple store not in my city
I'm sorry but I don't quite understand that. The lack of punctuation makes it very unclear.
Please select the answer which best describes what you did:
I ordered it from Apple.
I ordered it from an authorized Apple reseller.
I purchased it from a non-authorized seller.

How the system know which are Inventory cubes?while compres in ProcessChain

Hi,Experts
When I create a Cube compress in ProcessChain ,under the page there is a checkbox called No Maker for Inventory Cube,and I also know the Non-cumulative key figure can not be compress,
My question is how the system know which are Inventory cubes? and many cube create from ourself.

Hi,
I think,
- in the sap tables there are no information.
- the program reads the infocube definition and check: is there a non-***. value?
Sven

My iPhone 5c require I cloud ID and paswerd. Any one tell me to resolve the operation without id and paswerd or tell me how I could know about previous user

My iPhone 5c require i cloud ID and password of the first previous user. Any one tell me to resolve this problem or how know about previous id or contact number

Enter the correct Apple ID and password that was used to setup "Find My iPhone" on the device. Without those credentials the iPhone is a paperweight.

How Can I know about any change happened in the page??

........... I Use JDev 11g ........
How Can I know if any change happened in the page???
for example:
I have a page and I press a creation button that create a new row in view object I want when I press any button that will call another page the page ask a user Are you want to save changes? before leaving a page.
Or
I edit the value in a view object but not committed ( I didn't commit the data in database ) . When I want to leave the page I want to display a message say : Are you want to save changes?
How can I do that?
Thank You...
Sameh Nassar

Check out http://radio.weblogs.com/0118231/stories/2004/09/23/notYetDocumentedAdfSampleApplications.html Example 60. Do not go by the 'on page load' name... This approach will allow you to plug in your custom code at any 'phase' of your adf life cycle. You can capture any request coming from your page, and check for pending transaction states and act accordingly.. I realize that the reply is a little abstruse, but this is not a drag-drop-smile requirement.. :-)
http://download.oracle.com/docs/html/B25947_01/bcdcpal005.htm#sm0271
Julian

How do I know about the whole tables, sequences, triggers of the specific D

Hello,
I can check the whole tables of the db users with select * from tab; BUT can I know the whole META DATA of tables, sequences, triggers, procedures of a specific user?
Best regards

Raakh wrote:
Hello,
I can check the whole tables of the db users with select * from tab; BUT can I know the whole META DATA of tables, sequences, triggers, procedures of a specific user?
Oracle doesn't expose the metadata just like that but shows it in the various columns of various views based on the object type, for example like for tables, it would be in the user_tables and so on. If you are interested in knowing about the metadata of a specific object, you should use dbms_metadata package.
http://download.oracle.com/docs/cd/E11882_01/appdev.112/e16760/d_metada.htm#ARPLS641
HTH
Aman....

How the system know a device is removable

Something I find rather insecure is the way devices can be mounted by end user. In a usual configuration users are allowed to mount "removable" devices with a desktop application (that I believe use dbus). How the system does know a device is removable. I have not found any documentation on how to make a USB hard disk non removable.
It seems that in the usual configuration USB hard disk are "removable" while SATA disks are not. Yet both interfaces support about the same speed (if we use USB3) and it is entirely conceivable to have the main hard disk connected to USB. If you have a desktop computer, you can even connect your USB harddisk to a USB3 internal connector which will render the difference unnoticeable. If we think about it, usual Linux system are configured to make an essential difference in the security policy based on the physical form of the connector used to connect your hard disk; and that is quite weird. I do not think such confusing configuration can be considered secure if security is really important.
Last edited by olive (2014-06-12 09:02:01)

olive wrote:By the way my initial question still make sense. Suppose that you have connected your hard disk on an internal USB port. Then this disk should be considered non removable and be treated as such for everything. In this case this is exactly that: an non removable disk. Trying to emulate the behavior of a non removable disk for a disk that is still considered removable seems not very clean and error prone.
Let say you are the person responsible for making a decision of what volume is an internal one and what volume is not, how would you decide?
All you see is 4 usb ports and you cant tell which one is accessible only from within the computer and hence a case has to be opened for the port to be accessed(quoted scenario) or the port is externally exposed and a user can plug in and out a usb device at will.Usb ports do not carry useful information in this regard and hence what hard drive is connected in what usb port is not useful information in making the decision.
Suppose now you decide to ask the disk itself if its removable or not.Your usb stick will probably say it is not,your sata drive in an enclosure will probably say it is removable since the drive can be removed from its en closer.Here,you should see a distinction need to be made between "removable" and "hot swappable".
A usb stick is non removable but hot swappable
A sata drive in an enclosure will make the sata drive "removable".The sata drive will be "hot swappable" if the enclosure is connected to the computer through a externally exposed usb port and the sata drive will not be "hot swappable" if the enclosure is connected through internally exposed usb port.
The above should show that asking the drive itself will not work in all circumstances as the drive could give misleading information.
The above should show that there is no "bullet proof" way to solve this.
I have a project called zuluCrypt[1] and i have looked at this problem extensively and it is not an easy problem to solve and a user will have to intervene sooner or later.udev has a hack somewhere that allows a user to specify what usb port is externally visible and what is not.My solution is the user maintained volume lists discussed below.
In my project,i came up with a concept of "system volume" and "non system volume".
I defined a "system volume" as a volume that has an entry in "/etc/fstab","/etc/crypttab","/etc/zuluCrypt/system_volumes.list" or if udev identify the volume as system if udev support is enabled.
i defined a "non system volume" as a volume that fail in the above criteria or if it has an entry in "/etc/zuluCrypt/nonsystem_volumes.list".
You know your computer best,the best way to solve the problem using udev is to look for the udev usb port hack and tell udev what usb port is externally accessible and what is not.This should make it easy for udev to make predictable decisions that agrees with your computer setup
[1] https://code.google.com/p/zulucrypt/

How the ejb is bound to JNDI name

I am very new to Oracle App server. In weblogic, we declare the jndi-name of an EJB in weblogic-ejb-jar.xml file.
I did not see this in OC4J.
Actualli I have written a simple stateful session bean and trying to access it through a standalone java client. But don't know what to look up in JNDI.
HELP PLEASE!!!!!!!!!

Hi Vinay,
Your question has been asked (and answered) many times previously in this forum. (However, when I tried searching the forum archives, I only got three results!?!)
The below code shows how to perform a lookup of the "home" interface of an EJB from a stand-alone, non-deployed java client:
Properties props = new Properties();
props.put(Context.INITIAL_CONTEXT_FACTORY,
"com.evermind.server.rmi.RMIInitialContextFactory");
props.put(Context.PROVIDER_URL,"ormi://<host>/<app_name>");
props.put(Context.SECURITY_PRINCIPAL,"admin");
props.put(Context.SECURITY_CREDENTIALS,"<admin_password>");
new InitialContext(props).lookup("<home_name>");where "<host>" is the name of the machine where OC4J is running;
"<app_name>" is the name you gave to the application when you deployed it;
"<admin_password>" is the password for the "admin" user (that you supplied when you installed OC4J);
"<home_name>" is the value of the "<ejb-name>" element from your "ejb-jar.xml" file.
I have assumed that you have not set up any special security for your application -- otherwise you need to change the values for the SECURITY_PRINCIPAL and SECURITY_CREDENTIALS properties.
I have also assumed that you are using the stand-alone version of OC4J.
Good Luck,
Avi.

How my EntityBean knows about its primary key?

Well, i found a dubious place in my EntityBean.
I wrote an ItemBean with some simple getter and setter methods.
It has 3 instance variables:
- String id, (primary key)
- String productId,
- String name
Here is the code of my application client:
Context init = new InitialContext();
Object ref = init.lookup("java:comp/env/ejb/ItemBean");
ItemRemoteHome home = (ItemRemoteHome)PortableRemoteObject.narrow(
ref,ItemRemoteHome.class);
ItemRemote remote = home.create("x","y","z");
String key = remote.getPrimaryKey();
System.out.println(key);The code works well, but i dont know how my EntityBean knows its primary key when
i call the remote.getPrimaryKey() method.
i traced the method invoking and checked the server log.
// when calling home.create()
the bean's constructor is called to create a bean
setEntityContext() is called. but now the primary key in the entity context is null
ejbCreate() and ejbPostCreate() is called
( i inserted a row to the DB in the ejbCreate() method)
ejbStore() is called
// when calling remote.getPrimaryKey();
ejbLoad() is called, so all the bean's instance variables are refreshed
but non of the getter or setter methods are called
I think that the primary key is taken from the entity context instead of the bean.
but when did the entity context get the primary key?
I never tell the bean that its primary key is its id.
Stange, isnt it?

I never tell the bean that its primary key is its id.You should be returning the primary key from the ejbCreate method. The container picks that up and pops it into the EJB context.

Management workstation question - how does AD know about this?

We are trying to setup MBAM 2.5 for the first time. The test client isn't running bitlocker automatically like we hoped.
We copied the policy templates to a pc and configured the GPO settings. I don't understand how AD is supposed to know about this "management workstation"? What are we missing in the documentation?
I am thinking this is the step that is keeping it from working. At least one of the steps...
Thanks.

The GPO settings can be applied either from AD or from the management workstation. The 2.5 docs still say that a management workstation is required.
I think this might not be the case with MBAM 2.5. We were able to get it working, and I'm sure our clients are not accessing the management workstation.
Apparently the documentation needs to be updated.

Error getting the EJB Handle for context name: User

I am getting EJB Handle for context name: User.
1) I specified ejb's and datasource in the ejb-jar.xml in the session tags.
<session> </session>
and I also included ejb's and datasource in the sun-ejb-jar.xml still I am getting the above error I am new to EJB how can I resolve this?

What is the Oracle application server version?
JDeveloper 11g supports direct deployment to Oracle Application Server 11g
http://www.oracle.com/technology/products/jdev/collateral/papers/11/newfeatures/index.html

How the ejb know about an authenticated user?

Similar Messages

Maybe you are looking for