How to expire EBS user sessions on shared workstations/kiosks

My organization is using Oracle Applications Release 12.1.3.
Recently we have deployed several shared kiosks to multiple internal locations which our employees use to access information within Oracle Applications, including pay advice and compensation information.
One challenge we are facing is that if a user accesses his/her personal information (such as pay stub details) and then browses to another web site (such as weather.com) without logging out of EBS, the user's session cookie remains active. Another user can then go to the kiosk, press the browser "back", and is able to see the prior user's confidential information.
One way we are trying to avoid this is by training users to always log off of EBS, using the "logout" hyperlink which expires the user's EBS session and prevents the next user from being able to access his/her information using the browser "back" button. However we can't always count on this.
I would like to know if other companies have put other controls or measures in place to forcefully expire a user's EBS session in cases where the user doesn't click the "logout" hyperlink (such as if going to another web site or simply closing the browser window). Greatly appreciate any feedback or recommendations from the community on this topic. It seems as though it is a common challenge for companies using shared kiosks / workstations within their organizations.
Regards,
Jeremy

I don't believe we have considered using the "kiosk mode" browser feature. This may be a viable solution for us. I've passed this on to our internal team that is looking for solution ideas for this issue.
Thank you much for this suggestion Srini - I hope to see you at the EBS Tech Stack SIG meeting at OpenWorld next week.
Regards,
Jeremy

Similar Messages

Expire specific users sessions

Hello everybody,
I hope to write in the right forum.
We want to modify the portal login to obtain the following scenario:
1) Only one session (via web browser) is allowed for each user
2) A login-option to allowed user to login into the portal and expire all other existence sessions of the same user
We have already modified portal login page to set up a checkbox that enable user to force the expiration of all other session of the same user.
We create new login module and correctly added into the portal login stack.
This module correct reads the checkbox in the portal page.
In this login module we want to add code to satisfied the operation 2)
Still now we try some tricks but with no successful results.
Here an example
InitialContext initCtx;
MBeanServer mbs;
Set names;
String namePattern;
Object security;
try {
     initCtx = new InitialContext();
     mbs = (MBeanServer) initCtx.lookup("jmx");
        ObjectName pattern = ObjectNameFactory.getNameForServerChildPerNode("SAP_J2EEServiceRuntimePerNode", "security", null, null);
        names = mbs.queryNames(pattern, null);
        RemoteSecuritySessionsImpl rss = (RemoteSecuritySessionsImpl)mbs.getAttribute(pattern, "SecuritySessions");
        SecuritySession[] ss = rss.listSecuritySessions();
        for(int i=0; i<ss.length; i++){
             SecuritySession s = ss<i>;
          java.security.Principal principal = s.getPrincipal();
                // userName is the string contain userName previously get from CallBackHandler
          if(userName.toUpperCase().equals(principal.getName().toUpperCase())){
                        // forceDisconnect is the boolean previously get from CallBackHandler. Specify if we have to disconnect all other user sessions
               if(!forceDisconnect){
                           throw new LoginException("Session already exists");
               }else{
                                // we also try either expire or logout exclusively...
                    s.expire();
                    s.logout("ticket",callbackHandler);
                    rss.removeSecuritySession(s);
In this manner seems that from server side the session iwa expired but the logon ticket still live inside web browser cookie.
We have to use callbackhandler of each user session and force expiration of cookies? How we can get these callbackhandler?
any suggestions?
We use SSO tickets
thanks in advance
Cristian

Hello everybody,
I hope to write in the right forum.
We want to modify the portal login to obtain the following scenario:
1) Only one session (via web browser) is allowed for each user
2) A login-option to allowed user to login into the portal and expire all other existence sessions of the same user
We have already modified portal login page to set up a checkbox that enable user to force the expiration of all other session of the same user.
We create new login module and correctly added into the portal login stack.
This module correct reads the checkbox in the portal page.
In this login module we want to add code to satisfied the operation 2)
Still now we try some tricks but with no successful results.
Here an example
InitialContext initCtx;
MBeanServer mbs;
Set names;
String namePattern;
Object security;
try {
     initCtx = new InitialContext();
     mbs = (MBeanServer) initCtx.lookup("jmx");
        ObjectName pattern = ObjectNameFactory.getNameForServerChildPerNode("SAP_J2EEServiceRuntimePerNode", "security", null, null);
        names = mbs.queryNames(pattern, null);
        RemoteSecuritySessionsImpl rss = (RemoteSecuritySessionsImpl)mbs.getAttribute(pattern, "SecuritySessions");
        SecuritySession[] ss = rss.listSecuritySessions();
        for(int i=0; i<ss.length; i++){
             SecuritySession s = ss<i>;
          java.security.Principal principal = s.getPrincipal();
                // userName is the string contain userName previously get from CallBackHandler
          if(userName.toUpperCase().equals(principal.getName().toUpperCase())){
                        // forceDisconnect is the boolean previously get from CallBackHandler. Specify if we have to disconnect all other user sessions
               if(!forceDisconnect){
                           throw new LoginException("Session already exists");
               }else{
                                // we also try either expire or logout exclusively...
                    s.expire();
                    s.logout("ticket",callbackHandler);
                    rss.removeSecuritySession(s);
In this manner seems that from server side the session iwa expired but the logon ticket still live inside web browser cookie.
We have to use callbackhandler of each user session and force expiration of cookies? How we can get these callbackhandler?
any suggestions?
We use SSO tickets
thanks in advance
Cristian

How to know if user (session) is authenticated in other application (SSO)

Hi folks!
We've deployed various J2EE applications in some OC4J instances. So far the applications used SSO Authentication against OiD (LDAP), but we need a public access application.
The problem is the following: we need a different behaviour in this last application (without authentication characteristics) depending on one user is authenticated within other application that required SSO login.
How could check if current user (session) si authenticated against SSO, for example, in ADF-STRUTS DataAction class?
We tested the gerRemoteUser() method but is only works within the applications requering login.
Please, anyone could guide me?
Mike
Thanks!

Hi,
Oracle AS Single Sign ON stores some of the attributes of an authenticated user in a browser cookie - the name of the Cookie is SSO_ID.
You cannot get any information from this Cookie. The Cookie is avaliable only to the Oracle AS Single Sign ON and is meant to be used only by it. You cannot read any useful information from the Cookie as it is higly encrypted.
If you need to know the name of the currently logged in user, your application should be a Partner Application or an External Applciation to Oracle AS Single Sign On.
The reason is simple - you can use your browser to connect to many Websites protected by Oracle AS Single Sign ON. Thus, if your application isn't a Partner or an External Application registered with SSO, your application can't establish a context.
Hence, your application needs to be registered as a Partner Application or an External Application with SSO.
An application which is nto registered with SSO cannot get the User information from SSO. The getRemoteUser() method would always return a null in such cases.
Regards,
Sandeep

How to delete last user session from backend SQL query?

Sometimes user session gets closed between some work by any reason.
When next time that user logs to P6, he gets some error or particular functionaly dosen't work for that user or system hangs.
In that case if i decided to clear last session history of that user from database, how to write SQL query?
I don't want to delete all user sessions from table USESSION and USESSAUD, i simply want to delete last user session of particular user (E.g XYZ).

I am quoting this from MOS Doc Id "Why would multiple session records be present in the User Sessions screen in P6 Web, and why might some of them have different IP addresses? (Doc ID 1600172.1)"
Multiple sessions show up for users since different sections of P6 Web have their own sessions associated with them. If a user is authorized to use multiple areas of the software they will have multiple sessions each time they log in. Additionally, if users are closing their browsers before logging out of P6 Web Access you might see some past sessions still appearing in the list. These will eventually be cleared out by background jobs, however you can also reset the sessions in the software by clicking the "Reset User" link (Administer > User Sessions > Manage User Sessions), or by choosing the "Reset All Users" link (Administer > User Sessions > Manage User Sessions) to do this for all past sessions.
Multiple IP addresses for sessions can happen when a user logs in from different machines. For example, a person may login at their desk, but then go to a colleagues workstation to discuss a project, and log in from there. Doing so will leave them with multiple IP addresses in the session records.
Hope this helps
Regards,
Sachin Gupta

How to recreate EBS user and keep all his historical data.

Hi all
We have a user that is having an issue seeing any of his scheduled Discoverer reports within the Schedule Manager window of Discoverer Plus; Discoverer Desktop works fine.
The solution for it's to recreate the EBS user. The problem with this is that, if we recreate the EBS user, he will lose all historical data connected to that user, including the results of the scheduled Discoverer reports as well as all of the EBS created/last updated information.
There is a way to recreate an EBS user and preserve the historical references.
Thanks

We have a user that is having an issue seeing any of his scheduled Discoverer reports within the Schedule Manager window of Discoverer Plus; Discoverer Desktop works fine.
The solution for it's to recreate the EBS user. The problem with this is that, if we recreate the EBS user, he will lose all historical data connected to that user, including the results of the scheduled Discoverer reports as well as all of the EBS created/last updated information.Why do you need to recreate the user?
Are you saying you are going to create a new username for the same user and end-date the old one?
There is a way to recreate an EBS user and preserve the historical references.I believe there is no such a way to find all records/tables with the old user_id. Even if you find the list and update them manually, I believe this approach is not supported.
Please log a SR to confirm the same with Oracle support.
Thanks,
Hussein

How can I share user sessions?

Hello,
This is my scanario in my 9i Production release 2
I've got one workspace with two projects, one containig a user logon jsp (with HttpSession Object) and another containig the rest of the jsp. When I test the application I run first the logon jsp, and after, I redirect it to another jsp which it's placed in the second project. I see then that the session dissapears. So How I have to name the projects, or the applications, or the context-root??
Regards

read the manual on context sharing of the servlet api (2.3). There you should find what you need. Prerequisit: both applications should remain on the same server, otherwise you should persist the sessions in a database or filesystem.
Regards Marc

How to Create Bulk Users in Hpyerion Shared Services Console

Hi All,
I need to create bulk users in Shared Services Console. Since i have huge number of users so i don't want to use Front End. Instead i prefer to upload some CSV sort of stuff.
For this i export Shared Services console and open its Users.csv file.
Now my plan is to add all my users here and then will Import that Shared Services Console backup.
The only point where i am confused is that how should i specify Encrypted Passwords in Users.csv file and also what should i write in "internal_id" column

If you are using LCM and these are native users then you should be able to enter an uncrypted password and when it is imported it should be encrypted.
Leave the internal id column blank for new users, test by creating one new user.
Cheers
John
http://john-goodwin.blogspot.com/

How to deal with user session when power goes off

Hi
All,
One day I had 170 oracle session connected on oracle database server and and suddenly electricity went off. but server was still running. and after power back on ther same bunch of user try to connect it.So I don't know what happen to those 170 session. does anybody know how to deal with this? I did shutdown and restart of database but I am not sure that is correct way to deal with this kind of situation.
Thanks,
Vishal

If the database server is still running, the sessions will remain there, but it depends on how they got connected to the server. If they got access through a middle tier which maintains the session and this MT is still running the sessions will still be visible from the database perspective, unless the MT handles the disconnection event.
If the sessions are working on a Client-Server basis, then PMON will mark the sessions as abruptly broken and it will get rid of them. Sessions may eventually remain hanged, but it depends on the topology, so the way you proceed was a clean database restart.
~ Madrid
http://hrivera99.blogspot.com

How to trace a user session?

Hi DBA,
OS: Linux 5
DB Ver: 10.2.0.1
can any one tell me how to trace a session of user in oracle 10g?
Regards,
BK

user12942781 wrote:
Hi DBA,
OS: Linux 5
DB Ver: 10.2.0.1
can any one tell me how to trace a session of user in oracle 10g?
http://download.oracle.com/docs/cd/B19306_01/server.102/b14211/sqltrace.htm#CHDDGCCB
HTH
Aman....

How to enable ebs users to change their own passwords.

Hi,
Is there any profile option which will enable the users to change their passwords on their own from EBS front-end applications...?

Hi,
Is there any profile option which will enable the users to change their passwords on their own from EBS front-end applications...?Users can change their password from the application itself (Edit > Preferences > Change Password).
If you want to force all users to change their password, see (How To Force All Applications Users To Change Their Password? [ID 414976.1]).
Also, see old threads for similar discussion -- http://forums.oracle.com/forums/search.jspa?threadID=&q=414976.1&objID=c3&dateRange=all&userID=&numResults=15&rankBy=10001
Thanks,
Hussein

How to find out user session??

I have deployed application using Oracle 9iAS server. At times
the IAS server cpu goes 100% and if I see the task manager only
one (or) two ifweb60 (forms session) session taking the maximum
cpu time out of 60 ifweb60 sessions. I want to know which NT
user has initiated the session. When I see the session info. in
my backend, all the session showing the same account which is
nothing but Service account configured for IAS. Is there any way
to identify this???

dear Ragothaman
I work under 817, if I see that someone is doing a killing/resource select I do this:
first I query the view V$SQLTEXT and V$SQLAREA
then...
select SID, SERIAL#, USERNAME, MODULE from v$session where username='USER_NAME';
then I get the SID & SERIAL# and get him/her out of the way :)
ALTER SYSTEM KILL SESSION '48,2285';
in which the SID=48 and SERIAL=2285
nasty isn't it? :>
rjh

How to disable the User directory in Shared Services?

Hello,
We need to disable (Not Delete) the User Directory in Hyperion Shared Services. We are using the Hyperion version 9.3.1. Is there a way we can do this?
Thanks
S

From the 9.3.1 docs:
"If you do not want to use a configured user directory that was used for provisioning, remove it from the search order so that the user directory is not searched for users and groups. This action maintains the integrity of provisioning information. It also enables you to use the user directory at a later time, if needed."
http://docs.oracle.com/cd/E10530_01/doc/epm.931/html_cas_help/frameset.htm?removesearchord.htm
Cheers
John
http://john-goodwin.blogspot.com/

Portal Cluster: How to locate all user sessions at once?

Hi Folks -
We use Portal NW 7.0 SP14 (Java only) in a clustered mode (several server nodes). The UME is LDAP, the portal database is Oracle. Sometimes we need to see where a user's sessions are located in the cluster. We currently use Visual Administrator > Security Provider > Login sessions, but we must search each server node (very time-consuming).
Does anyone know of an easier (one-step) method to retrieve all sessions for a userid?
Thanks in advance - Jeff

Hi Jeff,
Bad luck: There is no easier way implemented within the standard.
Hope it helps nevertheless
Detlev

How to change a user name in shared photostream

Iselected the wrong name in my shared photostream account. And I am not able to change the name.

duplicate thread????
which user password you want to change..... and refer to your old thread... dont keep creating new threads for the same problem....

How to set per user session time out.

Hi folks,
I am trying to set longer session time out to selective users with the following line, but it turns out setting this time out for the whole app. Is there a way to change the session time out per user only?
request.getSession(true).setMaxInactiveInterval(172800);
Billy

Well, there's the rub. If you want more control over session handling, you have to take the good with the bad. My suggestion is to use a good open source caching solution and let the cache evict entries for you. You should be able to specify both an interval over which data goes stale and/or the maximum size you want the cache to reach. Really, a session is just a specialized form of caching anyway.
http://java-source.net/open-source/cache-solutions
- Saish

How to expire EBS user sessions on shared workstations/kiosks

Similar Messages

Maybe you are looking for