HTTPS request signed by client certificate from PL/SQL procedure

Hi All, please help.
The PL/SQL procedure connects to different web services, using both HTTP/HTTPS, for HTTPS sever certificates were used. Everything was OK.
The next service requires client to sign requests with client certificate. I made the client certificate, sign it by CA, store it in Wallet Manager.
Is here the possibility to send signed HTTPS request from PL/SQL?
If not, how to do it using Java and encapsulate for PL/SQL?
Please answer ASAP!!!

It is pretty straight-forward to make HTTPS requests with UTL_HTTP.
To do so, you first need to create an Oracle wallet on the database server host with Oracle Wallet Manager. If your database resides on Windows, I believe a short-cut has been created in the Windows menu. On Linux, it can be invoked from $ORACLE_HOME/bin/owm.
Once the wallet is created, you need to make an additional call to utl_http.set_wallet(<wallet-directory>, <wallet-password>) before any utl_http.request or utl_http.begin_request calls. The <wallet-directory> is the wallet directory where you will find the cwallet.sso and/or ewallet.p12 files, using the format "file:/<wallet-directory>". For example:
utl_http.set_wallet('file:/home/oracle/wallets/my_wallet/', '123456');
When an Oracle wallet is created, it is pre-populated with common certificate authorities' certificates (e.g. Verisign). In the event that the server certificate of the HTTPS host is not signed by one of those common certificate authorities, you need to import the additional certificate authority's certificate in your wallet using Oracle Wallet Manager.

Similar Messages

Applet does not get client certificate from browser (Firefox, IE7)

I'm writing a web service which runs Tomcat through Apache. One critical requirement is that the service be able to invoke certain device drivers on the end user's machine. Fortunately, there is a Java API for this, so this requirement can be fulfilled using an applet.
Here's the problem. This is a B2B application, so we're using SSL and requiring client authentication. I'm no web security guru, but I managed to get SSL set up through Apache (with a self-signed certificate for now; we'll get a real one from a real CA when we're ready to go to production). I also managed to set up client authentication by creating my own CA and generating a client certificate, which I then copied to my test client (Win XPSP2) and imported into both Firefox (2.0.0.15) and IE (6.0.2900). The applet is signed with a real certificate, and that causes no problems. And all of the pages for my web service work as expected.
All except one. The page which is supposed to load the applet pops a dialog stating 'Identification required. Please select certificate to be used for authentication', and presents a list of zero certificates.
Actually, I get this dialog in Firefox on my XPSP2 box, and also when I test on a Vista Home Premium box running IE 7.0.6000. Puzzlingly, this behavior does NOT occur on my XPSP2 box when running through IE 6.0. It seems that with XPSP2 and IE 6.0, the JVM can manage to obtain the required client certificate from the browser and pass it along to Apache, but the JVM can't do this when running in Firefox or in IE 7.0 on Vista.
I have gone to the Java Control Panel and verified that the 'Use certificates and keys in browser keystore' option is selected on both boxes.
I've done a fair amount of research for this (including in this forum) and see that this appears to be a chronic difficulty with applets. What makes it worse is that I don't think I can use the standard workaround, which is to download the applet from a different host/virtual host, because the applet needs to communicate with the web service. Since we have the additional layer of Tomcat container-managed user authentication, the applet needs to be communicating with the server using the same session token as everything else.
So at this point, I'm stuck. Does anyone know a solution to this problem? Two thoughts (I'm reaching at straws here):
1) I have the certificate imported in both Firefox and IE as a 'personal' certificate. Is there someplace else I can put it so the JVM will know how to find it? A rather old thread in this forum mentioned something about setting properties in the Java Control Panel, but I see no place in the JCP to specify such properties, so I'm guessing that solution is no longer operative.
2) I'm using a trick I found on the internet to make the applet load cleanly with both Firefox and IE, namely, I'm using the <OBJECT> tag to specify the applet class and codebase for IE, and then using <COMMENT><EMBED ... /></COMMENT> within the <OBJECT> declaration to specify the information for Firefox. Is there some other way of doing the markup that will give the JVM a hint that it should get a certificate from the browser?
BTW . . . I would hate to drop support for Firefox, but if someone has an IE-only solution, I'll take it. Unfortunately, I reckon a Firefox-only solution would not fly.
Thanks all.

My applet is also signed by a valid certificate. The question of whether the applet is signed/self-signed/unsigned >isn't an issue --- I just wanted you to make sure the Applet runs because it is a know valid Java2 Applet that is 100% signed properly and verified to run.
This eliminates the possibility that it is a JVM issue. However after reading your message further I am afraid
it is not relevant to your issue.
due to the client authentication, my browser (Firefox, IE7) refuses to even download the applet.
I went to your site, and I can see your applet in both Firefox and IE6. However, I don't believe your site is set up >quite like mine, because it appears I can run your applet whether I have imported your X509 certificate or not. What I >did was:If that is true we are all dead :) No I think you just missed the cert in the IE databse. It doesn't have to be in the
Applet database to function. Surprise!
Check your IE/tools/internet options/content tab/certificates/trusted root certification authorities.
I then opened the Java control panel and verified that the certificate isn't listed there, either. So unless the certificate >is being cached/read from some other location (which could be, this certificate stuff is largely black magic to me), >then your server isn't requiring client authentication, either accidentally or by design.No HyperView is a valid java2 Applet and actually writes to a file "hyperview.dat" though it is probably empty.
If you click on a component in the view and then on the view and type "dumpgobs" it shoud write out some data about the current graphics objects so you can see it has complete read/write access..
Further it opens up a complete NIO server ands starts listening for connections on a random port
(Echoed in your java console) You can connect to it with telnet and watch impressive ping messages all day :)
This all goes back to a few years BTW back before there was a plugin and there was only Netscape & IE.
There are actually 2 certificate databases and what loads where depends on which type of cert you are using. Now self signed or not doesn't matter but what does matter is the type of certificate. IE: is it RSA/DSA/Sha1
etc. The Netscape DB was a Berkley DB and MS used whatever they use. The Cert is a DSA/Sha1 cert
which I like the best ATM as it (X fingers it stays so) always has worked.
Sadly that tidbit doesn't help you either I am afraid.
What I'm trying to do is require client authentication through Apache by including the following markup in a virtual >host definition:
SSLCACertificateFile D:/Certificates/ca.crt
SSLVerifyClient require
SSLVerifyDepth 1You got me there I avoid markup at all costs and only code in C java and assembler :)
Now unless I am wrong I think you are saying that you want the Applet to push the certificate to the server
automatically and I don't think this happens. Least I have never heard of this happening from an Applet automatically.
On my client machine, I have a certificate which was generated using OpenSSL and the ca.crt file listed. Testing >shows that the server is requiring a certificate from the client, and the web browser is always providing it.
The problem is that when the browser fires up the Java plugin to run an applet, there is not sufficient communication >between the browser and the plugin so that the plugin can obtain the certificate from the browser and provide it to >the server.
So the server refuses to send the applet bytecode to the JVM, and we're stuck.In terms of implementation ease I think you may have the cart before the horse because I think it would be far easier to run an Applet in the first place to do the authentication, and then send, for example, a jar file to bootstrap and run
(or some classes) in the event the connection is valid. Then again one never knows it all and there may be some classes which enables the plugin as you wish. I have never heard of this being done with the plugin the way you suggest.
I am thinking maybe there is another method of doing this I do not know.
Did you try pushing the cert via JavaScript/LIveConnect?? That way it could run before the Applet and do the authentication.
Maybe someone else has other ideas; did you try the security forum??
Sorry but I am afraid that is not much help.
I did snarf this tidbit which may have some relevance
The current fix for this bug in Mantis and 1.4.1_02 is using JSSE API, Here are the step:
In Java control panel, Advanced tab -> Java Runtime Parameters, specify:
-Djavax.net.ssl.keyStore=<name and path to client keystore file>
-Djavax.net.ssl.keyStorePassword=<password to access this client keystore file>
If it is a PKCS12 format keystore, specify:
-Djavax.net.ssl.keyStoreType=PKCS12
In our future JRE release 1.5, we will create our own client authentication keystore file for JPI and use that for client authentication, for detail info, please see RFE 4797512.
Dennis
Posted Date : 2005-07-28 19:55:50.0Good Luck!
Sincerely:
(T)
Edited by: tswain on 23-Jul-2008 10:07 AM

HTTP Request error: 403 Client Error: Forbidden

Greetings -
I am trying to pull event data from blobs & tables storage using REST API built using python.
After running script, I am getting following error -
HTTP Request error: 403 Client Error: Forbidden
Could someone please advise me how to fix this.
Thank you

Hi Satish,
Would you be able to share some details about the error like the operation text?
You could refer the following link for details on the types of 403 errors and why they might occur:
http://azure.microsoft.com/en-in/documentation/articles/storage-monitoring-diagnosing-troubleshooting/#the-client-is-receiving-403-messages
Regards,
Malar.

Returing array from PL/SQL procedure

Hi,
I am trying to return array from PL/SQL procedure. Heres is the code. I am getting an error "OracleParameter.ArrayBindSize is invalid ".
Will anybody let me know what is wrong in following code. or does anybody have code to return PL/SQL array using VB.NET.
oCommand.CommandText = "MyPack.TestVarchar2"
oCommand.CommandType = CommandType.StoredProcedure
Dim id As Integer = 10
Dim deptname As String()
Dim oParam1 As Oracle.DataAccess.Client.OracleParameter = New Oracle.DataAccess.Client.OracleParameter("id", Oracle.DataAccess.Client.OracleDbType.Int32)
Dim oParam2 As Oracle.DataAccess.Client.OracleParameter = New Oracle.DataAccess.Client.OracleParameter("deptname", Oracle.DataAccess.Client.OracleDbType.Varchar2)
oParam1.Direction = ParameterDirection.Input
oParam2.Direction = ParameterDirection.Output
oParam1.CollectionType = Oracle.DataAccess.Client.OracleCollectionType.None
oParam2.CollectionType = Oracle.DataAccess.Client.OracleCollectionType.PLSQLAssociativeArray
oParam1.Value = id
oParam2.Value = ""
oParam1.Size = 10
oParam2.Size = 20
oCommand.Parameters.Add(oParam1)
oCommand.Parameters.Add(oParam2)
oCommand.ExecuteNonQuery()
Thanks
Sameer

Thanks Arnold for the reply..
Yes, I am trying to get result set in array which is unknow to me (No of rows return by the query). For the test I will pre-define the result set so that I will able to set ArrayBindSize.
I have read C# example but when I try to write it in VB.NET it gives me syntax error when I try to set the ArrayBindSize.
oParam.ArrayBindSize = new int[3]{15,23,13} // individual max size of 3 outputsWill you please let me know how to set ArrayBindSize (VB.NET) because I am new to this..
There is an example at otn "How to: Bind an Array to an ODP.NET Database Command" which does multiple INSERTs in one trip to database. This works fine. I need to do same for the SELECT statement which will return me multiple rows. I do not mean refCursor. If I use refCursor, it will make soft parse which I am trying to avoid using this Array techniq.
Thanks
Sameer

Sending OS command from PL/SQL procedure

"How can I send a operating system comand from PL/SQL procedure?
I want to move , to copy , delete a file from a PL/sql procedure. i.e under unix send mv, cp or
rm command";
my e-mail is [email protected]

take a look at
http://asktom.oracle.com/pls/ask/f?p=4950:8:881946
regards
Freek D'Hooge
"How can I send a operating system comand from PL/SQL procedure?
I want to move , to copy , delete a file from a PL/sql procedure. i.e under unix send mv, cp or
rm command";
my e-mail is [email protected]

Run report from PL/sql procedure

Please any one tell how to I run a report from pl/sql procedure.

I am not sure, but depending on your environment you can create a script to run your PL/SQL code and then generate the report. As is customary in an UNIX environment utilizing shell scripts.

Creating web service from pl/sql procedure

Hello.
I need to create a web service from pl/sql procedure and i chose JDeveloper for this implementation. I have wsdl, but I never created web services. So, I created web service with document/literal message format.
But I have several troubles:
1. All element names have lower case letters.
2. The SOAP envelope must begin from words soapenv:Envelope but i have soap:Envelope.
3. And operation name has tail like "Element".
I know bad way for implement 1 and 3 points. It's a modification of java_wsdl_mapping.xml and wsdl files. But if I want to add new method to my service all changes will be cleaned. It's not critical but inconvenient to support.
But for point 3 i have no ideas.
This task is very important for me. Can somebody help me?
JDeveloper 10.1.3.3
Regards,
Aleksey

http://www.oracle.com/technology/obe/obe1013jdev/10131/wsfromplsqlpackage/devwsfrom%20plsql.htm
Frank

How to call javascript function from PL/SQL procedure

Can anybody advice me how to call javascript function from PL/SQL procedure in APEX?

Hi,
I have a requirement to call Javascript function inside a After Submit Process.
clear requirement below:
1. User selects set of check boxes [ say user want to save 10 files and ticks 10 checkboxes]
2. user clicks on "save files" button
3. Inside a After submit process, in a loop, i want to call a javascript function for each of the file user want to save with the filename as a parameter.
Hope this clarify U.
Krishna.

Unix shell script run from pl/sql procedure

Hi Guru
I want to run unix shell script from pl/sql procedure. Actual I want to run it from developer 10g form.
Please guide me in this regards
Regards
Jewel

Look at the host or client_host builtins in the help

Sending message from PL/SQL procedure to form

Hello Friends,
How can I send messages from PL/SQL procedure to Form ?
Ultimate target is catching progress of PL/SQL procedure from
form. I heard about DBMS_PIPe but not sure,.
Adi

Hello,
Yeah , I got the solution using DBMS_PIPE function,I
followed following steps.
1. Pipe is created. see below procedure.
create or replace procedure proc_testpipe as
     v_pipe_integer          integer;
     v_pipe_message          integer;
begin
     v_pipe_integer := DBMS_PIPE.Create_Pipe('adipipe');
     dbms_pipe.pack_message('Hello Adinath Kamode,Message
     from Pipe');
     v_pipe_message := dbms_Pipe.Send_message('adipipe');
     end;
end;
2. then I created one Function which will obtain message from
Pipe and
will return value to form.
create or replace function proc_callpipe return varchar2 as
v_msg          integer;
v_rem          integer;
v_message          varchar2(500);
begin
v_msg:=dbms_pipe.receive_message('adipipe');
dbms_pipe.unpack_message(v_message);
dbms_pipe.purge('adipipe');
v_rem := dbms_pipe.remove_pipe('adipipe');
return(v_message);
end;
3. Last I called this function from form.
Cheers .. !
Adi

Creating Excel Workbook from PL/SQL Procedure

I am trying to create Excel Workbook with two worksheets from PL/SQL procedure. I created one worksheet. Can I create a separate sheet from same procedure. I used OWA_UTIL.MIME_HEADER ('application/vnd.ms-excel', FALSE)
command to create the spreadsheet.
Any help would be helpful.
Thanks
Yagna Shah

Further to my previous post here is how I will develop a typical master details excel report.
by using the package,
It will also show sum of salary at each department.
Note : When I paste the code here I loose the indentation. So the code below is not indented properly.
DECLARE
r NUMBER := 0 ; --- r IS the ROW NUMBER IN this excel file
l_sum NUMBER ;
BEGIN
--- Generate the styles that we need
gen_xl_xml.create_excel( 'UTL_DIR','master_Detail.xls') ;
gen_xl_xml.create_style( 'dept_title' , 'Arial', 'Red',14, p_backcolor => 'LightGray' );
gen_xl_xml.create_style( 'sgs2' , 'Arial', NULL ,10, p_bold => TRUE );
gen_xl_xml.create_style( 'sgs3' , 'Arial', 'blue',14 );
gen_xl_xml.create_style( 'sgs4' , 'Arial', 'green',14 );
gen_xl_xml.create_style( 'emp_title' , 'Arial', 'Black',9, p_backcolor => 'LightBlue' );
gen_xl_xml.create_style( 'sal_tot' , 'Arial', 'Brown',13, p_backcolor => 'Yellow' );
-- SET ANY COLUMN AND ROW changes
gen_xl_xml.set_column_width( 3, 145 );
gen_xl_xml.set_column_width( 4, 145 );
l_sum := 0 ;
FOR recd IN ( SELECT department_id, department_name FROM departments ) LOOP
IF l_sum <> 0 THEN
r := r +1 ;
gen_xl_xml.write_cell_char( r, 4, 'Department Total ->' , 'sal_tot' );
gen_xl_xml.write_cell_num( r, 5, l_sum , 'sal_tot' );
l_sum := 0;
END if ;
r := r+1 ;
gen_xl_xml.write_cell_CHAR( r,1, 'Department : '|| recd.department_name , 'dept_title' );
-- As we need same style applied till the above data flows use write_cell_null
gen_xl_xml.write_cell_NULL( r,2 , null );
gen_xl_xml.write_cell_NULL( r,3, 'dept_title' );
gen_xl_xml.write_cell_NULL( r,4, 'dept_title' );
gen_xl_xml.write_cell_NULL( r,5, 'dept_title' );
--- Add employee heading
r := r+1 ;
gen_xl_xml.write_cell_CHAR( r,2, 'EmployeeID' , 'emp_title' );
gen_xl_xml.write_cell_CHAR( r,3, 'First Name' , 'emp_title' );
gen_xl_xml.write_cell_CHAR( r,4, 'Last Name' , 'emp_title' );
gen_xl_xml.write_cell_CHAR( r,5, 'Salary' , 'emp_title' );
FOR rec IN (SELECT employee_id , first_name , last_name, salary FROM employees WHERE department_id = recd.department_id ) LOOP
r := r+1 ;
gen_xl_xml.write_cell_num( r,2, rec.employee_id, 'sgs2' );
gen_xl_xml.write_cell_char( r,3, rec.first_name, 'sgs3' );
gen_xl_xml.write_cell_char( r,4, rec.last_name , 'sgs4' );
gen_xl_xml.write_cell_num( r,5, rec.salary );
l_sum := l_sum + rec.salary ;
END LOOP ;
END LOOP ;
gen_xl_xml.close_file ;
END ;
-----------------------------------------------------------------------------------------------------------------

Signing with p12 certificate from client

Hy there
Our client provided us with a p12 format certificate and a password for signing AIR Applications.
When I tried to sign the application in question with the certificate I got the following Error:
Unable to build a valid certificate chain for the signer.
What would google do in this situation?
According to http://www.globalsign.com/support/root-certificate/osroot.php I did the following:
Install the certificate in Internetexplorer
Install the GlobalSign ObjectSign CA in Firefox
Export a new p12 certificate from firefox
Sign the application again with the new p12 certificate
Still getting the same error!
Install the new p12 certificate in Internetexplorer
Again exporting the cert in Firefox
and so on...
No matter what I tried I still got the same error. I am now wondering whether our client needs to sign the application, but this does not seem to make sense since I have a p12 certificate and a password...
I really would appreciate any help on this matter.
Kind regards

According to tzengs suggestion I tried to export the certificate again from firefox using "backup all" instead of "backup" with no effect.
One thing which I am still not sure of:
Can my client give me a p12 certificate which I can use as it is to sign my application using the provided password or do I have to process this certificate first?
Depending on the answer to this question I need to take different action:
YES: I need to tell my client to export the certificate in a different manner in order to "create the complete chain"
NO: The certificate from my client is fine but I still need to figure out how to change the certificate so that I don't get the error.
Thanks for your help.

Presenting a Client Certificate from ACE?

Hi Folks,
This is a bit of an odd one, so please stick with me!
A bit of background:
We currently visit a secure 3rd party website from our company, in order to identify our company to the website we have to use a client-side certificate to authenticate us (before we then login to the website).
As we have a large number of machines loading a client-certificate on to each one has not proved agile enough (this is more a legacy thing). So to work around this we have used a Stunnel proxy which the clients are forwared too (HTTP), which then proxies the connection as HTTPS and provides the end website with the Client Cert and does all the bits for SSL. The Stunnel service was meant to be a tempory workaround, about 3 or so years ago (don't you just love those?) and is hosted on a desktop PC which has recently started to crash - there's no real support on this either - which leads me onto the question:
Can the ACE module replace the Stunnel Box in this scenario?
Is it possibile to load a client certificate onto the ACE and get it to provide this to an end webserver. I realise that the ACE is probably not designed for this function, however this would get us onto something more stable and has a better internal support function.
I've attached a really basic diagram of how the connectivity operates - but I'm happy to consider suggestions on alternative ways of doing it.
Thanks in advance
Kev

Hi.
It seems to be not possible : http://www.cisco.com/en/US/partner/docs/app_ntwk_services/data_center_app_services/ace_appliances/vA4_1_0/configuration/ssl/guide/initiate.html
I have to check if other products can do what you want, but I have some doubts...

Signing with Code Certificate from COMODO ?

Hi,
does anyone have some experience with a Code Signing Certificate from COMODO ?
I exported the certificate from Chrome or IE and tried the signing for a ja file,
but get:
jar signed.
Warning:
The signer's certificate chain is not validated.
Can anyone help me ?
Many thanks.

According to tzengs suggestion I tried to export the certificate again from firefox using "backup all" instead of "backup" with no effect.
One thing which I am still not sure of:
Can my client give me a p12 certificate which I can use as it is to sign my application using the provided password or do I have to process this certificate first?
Depending on the answer to this question I need to take different action:
YES: I need to tell my client to export the certificate in a different manner in order to "create the complete chain"
NO: The certificate from my client is fine but I still need to figure out how to change the certificate so that I don't get the error.
Thanks for your help.

Applet won't get client certificate from browser

Hi,
We have an applet that runs fine as long as we don't have the web server require a client certificate. This applet runs inside a protected Intranet with a standard client JRE version 1.4.2 The rules of the intranet state that client certificates are required. So we registered our certificates with the JRE plug in in the browser and NaDa...
I have read all sorts of things out there on the web that says the end user must register a personal Keystore and then we must code the applet to look into the end user's keystore for the certificate and the user must type in their personal password for the keystore into some sort of a form for the applet to read the keystore certificate.
This sounds illogical and I strongly suspect that I am mis-interpreting what is being said...
Can anyone help me understand what I am missing? (or perhaps point to a tutorial that has some better info in it...) I have looked at the Sun Java tutorial for applets didn't see any specific info regarding this type of problem- solution.
Thanks for any pointers or suggestions you might have.
JpGuy

Hi,
We have an applet that runs fine as long as we don't have the web server require a client certificate. This applet runs inside a protected Intranet with a standard client JRE version 1.4.2 The rules of the intranet state that client certificates are required. So we registered our certificates with the JRE plug in in the browser and NaDa...
I have read all sorts of things out there on the web that says the end user must register a personal Keystore and then we must code the applet to look into the end user's keystore for the certificate and the user must type in their personal password for the keystore into some sort of a form for the applet to read the keystore certificate.
This sounds illogical and I strongly suspect that I am mis-interpreting what is being said...
Can anyone help me understand what I am missing? (or perhaps point to a tutorial that has some better info in it...) I have looked at the Sun Java tutorial for applets didn't see any specific info regarding this type of problem- solution.
Thanks for any pointers or suggestions you might have.
JpGuy

HTTPS request signed by client certificate from PL/SQL procedure

Similar Messages

Maybe you are looking for