HTTPS/SSL and portal-based apps -- alternatives to 'all or nothing' ?

hi,
I've been told by oracle support via metalink that it is not possible to have one or two pages in a portal application accessible though HTTPS and all the others through HTTP. They said that Portal as a whole must use only HTTPS or only HTTP.
This is frankly quite unbelievable, but I double checked two or three times, and they assured me that this is the case. Having just one or two pages in a large site be SSL -- for credit card submission or whatever -- is obviously an incredibly common real-world use case, and others must have already faced this problem and come up with alternatives.
We thought about going outside portal for the two pages that we need to be SSL, but this isn't possible because the processing that needs to occur on those pages is too dependent on Portal.
What have others done to get around this problem and use HTTPS only for select pages?
thanks,
calvin

Hello ,
I have to do the same thing : only protect certain URLs of my portal with SSL.
Checking my.oracle.com, you can see they do this :
1. Home page in HTTP mode
2. post login/password in HTTPS
3. login successful page in HTTP mode
Opening the source, you can see :
1. function Javascript doLogin() rewriting form.action.value using https://.. as follow :
function doLogin(form) {
if (!isValidUsername(form)) {
return;
form.action = "https://login.oracle.com/pls/orasso/orasso.wwsso_app_admin.ls_login";
2. The post is not done to the login procedure from portal schema, but to a proc of orasso schema : we skip the redirection and cookie positioning. So how can this work. Checking further in the code you see :
if (!parent.frames.s2pFrame) {
form.site2pstoretoken.value = "v1.2~1356~3BDF1F08432CD55....";
} else {
var hw = parent.frames.s2pFrame.window;
var hd = hw.document;
var s2p = hd.forms.freshTokenForm.site2pstoretoken.value;
form.site2pstoretoken.value = s2p;
3. The site2pstoretoken is already in the page as a Javascript variable , but how is this value retrieved? Playing with Etherreal, we see that there is an hidden frame : parent.frames.s2pFrame calling the procedure /pls/moc/moc.wwptl_login.show_site2pstoretoken, returning a simple html page :
<HTML>
<FORM NAME="freshTokenForm">
<INPUT TYPE="hidden" NAME="site2pstoretoken" VALUE="v1.2~1356~FB597....">
</FORM>
</HTML>
This tokenId is then picked by the javascript function before login/password action submit.
Checking in my portal schema (9.0.2.3), i don't see this procedure wwptl_login.show_site2pstoretoken
My portal middle tiers are in 10g , but the infrastructure database is installed on a remote host and is a 9.0.2.3 iAS release.
my.oracle.com seems to be full AS 10g :
My question is : does this procedure exist in a 10g portal schema.
Or is this procedure a special patch for my.oracle.com portal.
I'm blocked again today as i want only protect 2 or 3 pages but to the whole site.
This shows there is a hope for what we want to do.
Hope too my.oracle.com or Portal security/Login Server specialists will answer....
Laurent

Similar Messages

  • My ipod is really beggining to irritate me,wheni finally get apps sent to my ipod touch they are still saying "waiting..." and now the apps picture on all of them is blank and i still haven't dowloaded one app successfully.What's going on with my ipod?

    My ipod is really beggining to irritate me,when i finally get apps sent to my ipod touch thay are still saying "waiting...."and now the apps picture on all of them is blank and i still HAVE YET TO DOWNLOAD ONE APP SUCCESSFULLY! What's going on with my ipod & how do i fix it?

    Have you tried a hard reset of your iPod yet?  To do this, press and hold both the Sleep/Wake and Home buttons together long enough for the Apple logo to appear.
    If that doesn't work, are you still connected to a network?  Either way try connecting to a different one and downloading another FREE app to see if that helps.
    B-rock

  • Devices and I are in one city but time zone and location based apps show devices location in another city

    iPad2 with IOS 8.1.2 located with me in Eastern Time Zone city but settings under General reflects Central Time Zone(Chicago).  All location based Apps are reflecting a Central Time Zone city, one that I have never visited.  I did an erase and restore of a backup prior to this issue but it was not resolved.  What do I do?         

    I am having a similar issue. I moved about 10-15 miles. Any app, such as Maps, a Weather, etc, that use location keep showing my current location as my old address. I'm interested in hearing the solution to your problem.

  • Weird issue with spacebar and text based apps...

    I've never seen this one before and I've been using OS X since the beginning.
    I'm seeing this on my boss' computer so here goes...
    When using any text based app ie Text Edit, Mail, Microsoft Office 2011, etc. if I try and write a word and then add a few spaces in between that and a new word the app won't let me add more than 2 spaces. If I create another user and try with the said apps there -- adding more than 2 spaces works fine. The thing is my boss doesn't really want to transition to another user because it would take him forever. Thus far, I've repaired permissions and deleted a few suspect preferences. Nothing worked. Any ideas as to why this is happening. Could there be some hidden setting that is user wide that would cause this?
    Regards,
    Scotty

    Moving all the prefs to a folder on the desktop seemed to work. I figured that Mail would be important along with a few other apps like Address Book and iCal so I left them in the Preferences folder. The boss is going to have to deal with any other loss of preferences.
    Thanks Tom!
    ~Scott

  • Air HTML HTMLLoader load https ssl with untrusted or unknown certificate, click 'yes' does nothing

    When i go to a https website with an untrusted certificate i get this warning.
    when i click "yes" the HTML component does not go anywhere. just a blank white screen.
    tried this out with adobe air 1.5 and 2.0

    Hi,
    I have the same problem on win 7 with my AIR project that worked fine with HTTP (HTTPService) and that has a chaotic behaviour with HTTPS, i.e. for each request the user need to clic 2 times on yes. The first time for accept the fact that the certificate is not validated by an offcial authority and the second time because the name in the certificate is not corresponding with the name of the server....
    Do these two actions for each request makes the application unusable ! I already tried to add my certificate to CA Root on my machine but it didn't resolve anything. Is there a solution to disable these warning from my air application ? Can I continue to use HTTPService for my communication ? Need I use low level classes as SecureSocket ?
    Thanks !
    Julien
    Message was edited by: JulienBu
    Additionnal info : I tried  to establish a socket connection on my server with SecureSocket class and I didn't find a way to bypass the blocking IOError #2031:Socket Error with the serverCertificateStatus = "principalMismatch". If I good understand, the socket do not want to connect to my server because it has not the good name and there is no way to accept to continue... That's it ?

  • Running Opera, flickr, teashark and web based apps...

    I am unable to run web based applications like opera mini flickr cellity Teashark and others.
    Whereas opera,flickr are some inbuilt apps but still unable to access internet through them.
    Internet accessing is fine via default browser but none of the web browsers like Opera mini, Teashark,etc are not working.
    Its not the problem of Network since on my other mobiles, apps run fine.
    Please reply with the solution for the problem so that i can access web via web based Java Apps.
    Message Edited by aparichit on 11-Oct-2008 12:49 PM

    m so sry my net connection was nt working so couldn't reply
    ok so here is step by step procedure:
    Menu->Settings->Configuration->Personal config. sett->Options->Add New->Access Point:
    now what you hav to do here is dat basically you need to know the access point of the setting you want to use key in the access point there. user name and password are nt needed usually.
    save that access point and go back to the configuration page nw in 'preferred access pt.' set dat access point which you created just nw.
    this process worked for me mayb this works for you all too. (i've presumed dat you all have got your internet services activated from your provider)
    if you don't knw the name of your access point then your operator's customer care centre could be of some help..
    Was this post of some help? Click 'Kudos' star on the right hand side of this post. Your gesture will be highly appreciated!

  • Deleted Large Message now stuck in drafts and stopping mail app work at all

    I started to create a message containing a lot of photos from iPhoto - realising it was too big (23mb) I deleted it but it started trying to send the message (there was no address) - it then saved it in a new folder Drafts (.mac) since then I haven't been able to receive email at all. I have deleted the 'draft' a number of times and it keeps coming back. When I send a mail it hangs and doesn't send until I force quit and then it sends it but doesn't keep a record in sent items.
    When I leave it logged in for a while I get a message saying:
    Some actions taken while the account “.Mac” was offline could not be completed online.
    I've reconfigured my online offline settings to only save drafts locally but it hasn't helped and instead has deleted all of my offline folders!
    HELP!!

    Hi k:
    That file is in your home folder ~(symbol for home)>library>preferences.
    A preference file may (rare, but it happens) become corrupted. OS X rebuilds them as needed. You will need to enter any personal preferences that differ from the default settings.
    By the by, welcome to the wonderful world of Apple computing. You will find these forums represent the best on-line community anywhere.
    Barry

  • How the external system will talk to ECXpert 3.5 for transfering files via HTTP SSl?

    We are using ECxpert3.5 on Solaris box. One of our Trading Partner want to communicate through HTTP-SSL and we are doing XML/EDI mapping. Could you guide us what steps we need to take care to implement this.
    How the external system will talk to ECXpert for transferring files. (We need the syntax for the URL). How ECXpert will receive XML file through HTTP-SSL protocol from External System and file submittion.
    Please send is there any other document which explain about. Thanks in advance for your help. [email protected] or [email protected]

    Hi Steve,
    You can bring the GRC framework to a state equivalent to a raw install by following options:
    Option 1.) You should have a base-line backup before GRC installation. If so then apply that base-lin backup and deploy GRC components. If there is no base-lin backup, then
    Option 2.) Uninstall and re-install J2EE and then follow up with rest of the installation process. If you don't want to go through re-install process, then
    **Correction to Option 3**
    Option3.) SAP is in process of creating a SAP Note for Delete script, Instead of delivering Delete Script script via OSS message.  Will update you as soon as the Note gets released.
    Please refere to Note # 1416728 to Manage your deletion in RAR 5.3 SP10.
    Hope this helps.
    Best Regards,
    Sirish Gullapalli.

  • ECXpert3.5- How to setup HTTP-SSL for xml protocol

    Hi,
    We are using ECXpert3.5 on Solaris box. One of our Trading Partner want to communicate through HTTP-SSL and we are doing XML/EDI mapping. Could you guide us what steps we need to take care to implement this.
    How the external system will talk to ECXpert for transferring files.(We need the syntax for the URL). Could you suggest how to setup the HTTP SSL for XML protocol to receive xml files from remote system.
    Thanks in advance for your help!
    Regards,
    Ravi.

    Hi,
    We are using ECXpert3.5 on Solaris box. One of our Trading Partner want to communicate through HTTP-SSL and we are doing XML/EDI mapping. Could you guide us what steps we need to take care to implement this.
    How the external system will talk to ECXpert for transferring files.(We need the syntax for the URL). Could you suggest how to setup the HTTP SSL for XML protocol to receive xml files from remote system.
    Thanks in advance for your help!
    Regards,
    Ravi.

  • We were wondering how you stop some apps from running with out deleting them something like a task manager and in my settings im missing the application button in it how do i get it back and stop some apps its making it run really slow

    how do you stop apps with out deleting them i have looked for something like a task manager and nothing and researched about it and it says to go into your settings and then click applications but i dont have one can someone please help[ me thank you

    Double click the Home button. The bottom row shows the recently used apps. Touch and hold the app until they all start to wiggle then tap the circled minus sign by apps you want to remove. Press the Home button to return to normal.
    However, that is recently used apps not apps doing something. Some apps will do things all the time/periodically like checking for Notification, new mail. Yu can turn those off in the apps themselves.
    Just what are you trying to accomplish?

  • How do I open and use this app after I have paid for my subscription? I previously downloaded Primeir Pro CC for the trial and when I try to open the app it says my trial has ended and there is no other option to sign in and use the app?

    how do I open and use this app after I have paid for my subscription? I previously downloaded Primeir Pro CC for the trial and when I try to open the app it says my trial has ended and there is no other option to sign in and use the app?

    Remove all current Adobe software.  Download Adobe Cleaner Follow instructions.

  • Https ssl config Oracle AS, webcache, portal...almost works

    Hi,
    I have searched the forums and I havent found anything that works for me.
    I have Oracle infrastructure on one server, and Oracle App server/portal on another server. I can get as far as the http server showing the "welcome to oracle" page in https form. When I try to access a page in the portal (plsql) I get a blank page. It does convert the "https://myserver:xxxx//pls/portal/url/page/IRWEB/HOME
    " to "https://myserver:xxxx/portal/page?_pageid=73,86254,73_86264:73_86316:73_8632...." but nothing comes up.
    Also, it uses the Infrastructure server for single-sign-on...so I need to make the app server do the single sign-on. I've tried by adding /pls/orasso entry in DADS.conf of http server..
    So as far as I can tell...the http server IS operating in https/ssl, but the single-sign-on and the pages in the portal are not.
    I have to do everything manually since I am using 10.1.2 (no Oracle Collab Suite installed, so no SSLConfigTool and other assistants)
    Here is what I've done to get https://myserver:xxxx/ to come up ok.
    server 1: Oracle Infrastructure and Oracle database release 1 10.1.2.0.0
    server 2: Oracle Application Server / Portal with webcache release 2 10.1.2
    using Oracle Wallet for certificate,
    http server -> process management "ssl-enabled",
    http server -> advanced -> ssl.config: SSLWallet file:, SSLWalletPassword, virtual host for ssl
    webcache -> added settings for ssl (I used the current entries for non-ssl as a guide for the ssl entries)
    Interesting issue...with the ports in the ssl.conf file example:
    Port 4459
    Listen 4459
    VirtualHose myserver.blah.edu:4450
    Port 4458
    When I get the blank page trying to use ssl and 4459, I can manually change the url in my browser to 4458 (or maybe its the other way around) and get this message: "Error: The portlet could not be contacted"
    Is this a problem with webcache? Do I have to do any ssl config on the server with the database?
    I've even tried disabling the webcache, both with the oracle sql script and through web interface but neither made a difference...same problem.
    Any help would be greatly appreciated..I feel as if I'm almost there.
    If I did not post enough info for accurate help, please ask what you need to know to provide help! Thanks in advance.

    Hi,
    Yes you can go for SSl configuration without re-installing any of the components.
    Regards,
    access_tammy

  • Portal and role based access

    We have a requirement to provide role based access to our portal. Employees require full portal access, partners require access to specific applications and resources, while guests should be provided access only to the Internet. People suggested SSL VPN from vendors like Array Networks, Juniper, Portwise etc.
    We are trying to kind of use our portal as a web VPN. Also we wanted to use strong access control.... Are there any ideas other than using SSL VPN's.
    -thanks

    1. You can configure your portal on HTTPS (SSL). That keeps it on secure SSL layer.
    2. Have SSO to distinguish between authenticated_users (logged in users like your employees, partners, etc) and un-authenticated_users (Guest).
    3. Use Groups for translating roles for your users. i.e., Make Groups for your users based on what you called as roles in your message.
    4. Assign access privileges available in portals for pages and portal objects according to your needs to these Groups.
    I dont think VPN will be needed when you are having an extranet-portal (as you hinted internet for guests).
    You can have a darn strong access control using this mechanism.
    hope that helps!
    AMN

  • HTTPS and portal

    I've done all passages described by Paul Encarnacion for enabling ssl on portal, but at the end, when I try to request:
    https://server-linux.urmetdomus.net/pls/portal30/
    I read this message:
    "The request for content either timed out, or produced an error, after 0 seconds"
    Who can help me???
    I'm lost...
    P.S. If I write:
    https://server-linux.urmetdomus.net/pls/portal30_sso/
    I can see Portal30_sso page.

    I'm using a trial certificate, and now I changed the Certificate Chain File. There is a problem: the CA certificate has expired 1/01/2001 so it is not valid anymore. I don't know if this may be a problem...
    Anyway:
    After I changed the Certificate Chain File, these are the messages I found in Jserv.log, starting with the startJServ.sh procedure start (having changed the command Apachectl start with Apachectl startssl) ending with the request Https://server-linux.urmetdomus.net/pls/portal30
    [01/03/2001 09:56:14:121](EMERGENCY)wrapper:Jerv(2412)did'nt die nicely, killing it
    [01/03/2001 09:58:09:778 CET] page/oracle.webdb.page.ParallelServlet:init
    [01/03/2001 09:58:09:797 CET] page/Starting a pool of 25 handlers.
    [01/03/2001 09:58:10:317 CET] page/Content Fetcher Exception, name=content-fetcher()
    Javax.net.ssl.SSLException:SSL handshake failed
    at oracle.security.ssl.OracleSSL socketImpl.startHandshake (Native Method)
    at oracle.security.ssl.OracleSSL socketImpl.startHandshake (Unknown source)
    I don't know what to do...
    Thank you for interest.

  • HTTP and HTTPS (SSL) at the same time?

    Hi
    In our company we will use SAP Portal as a external facing portal and as portal  that uses authorisation and authentication (logon) . The question for us is: Is it possible to run the EFP without SSL and the “securede  portal” with SSL? Where do I find documentation?
    Thanks
    Christian Thulstrup

    Hi Christian,
    yes, you can run the portal with HTTP and HTTPS at the same time - it's just a question of the URL you are entering in the browser...
    <b>BUT:</b>
    If you access your portal with HTTPS <b>all</b> content provided by the portal should be accessed with HTTPS too - otherwise you will get security warnings in IE and maybe some strange behavior of the integrated content. Session Management to SAP backend systems will not work also...
    Vice-versa: if you access you portal with HTTP all content should be accessed with HTTP... obviously...
    So if your content for the external facing portal is completely seperated from the internal content - yes you can access the portal with differen protocolls.
    If it is not seperated - and that includes KM objects also - then better use one protocoll for both only!!
    Hth,
    Michael

Maybe you are looking for