Implementing security for a custom Java Webdynpro

We have a webdynpro that was developed and forces a user to log in w/their UME credentials. I've been trying to find out where/how to implement specific security to the app (as in, which roles/groups can access it). In the security provider of the admin tool, i don't even see the app listed under the components, if that's even the right place to look.
Basically we want to create a UME role (which we've done) to assign it to this app, and then we'll assign a user group to the role. As of now, pretty much anyone with an account on this instance can access the app.

Hi David,
This is done using UME programmatic security. On the help portal there's a tutorial to explain how to go about doing it. Here's a link:
http://help.sap.com/saphelp_nw2004s/helpdata/en/fa/a64d401be96913e10000000a1550b0/frameset.htm
Once you setup the application, use the UME user admin to assign the application's actions to UME roles, which are then assigned to users.
Regards,
Yonko

Similar Messages

How to access custom JAVA webdynpro application from an iPad?

Hi,
We are trying to access custom JAVA webdynpro application from an iPad, but nothing is opening up from the iPad browser.
What can be the possible reasons for this? Any kind of SICF enablement or opening up of ports in the network?
Any inputs are welcome!!
TIA,
Regards
Deepthi

Hi,
it is possible to show Java Web Dynpro applications on a mobile device in general, but the controls and the ui should be optimized for the mobile device.
Safari devices are not officially supported so far for Mobile Web Dynpro.
Supported are Windows Mobile devices and Blackberry devices. I also got some good results with Symbian devices.
You can find more inforamtion on Mobile Always Connected at:
ht[http://help.sap.com/saphelp_nwce711core/helpdata/en/7d/28fa3e7cb1d861e10000000a114084/content.htm|http://help.sap.com/saphelp_nwce711core/helpdata/en/7d/28fa3e7cb1d861e10000000a114084/content.htm]
Best Regards,
Stefan

Implementing security for a webservice

Hi,
I am working on a services app development project where our app/service is going to serve some consumer application requests in the form of JMS or webservice requests. Please let me know what is the best solution to implement security in this scenario? I am looking for answers pertaining to authentication( validating the user/ client app) and authorization(whether the client can make this request).
Please dont give me the links from java site , unless they are very lucid. Please ... I am looking for straight forward answers in this forum.
( I am a microsoft guy moved into J2EE and honestly, i never felt comfortable with the documentation in Sun site to be simple or easily understandable. [no offense intended to j2ee evangelists :) ] )

I would start with SSL for this and build in application authorization via a handshake listener, provided the SSLSocket is exposed. But you're going to have to look at Java documentation for that, there's no point in me giving you my own version of what it says when it's already documented. I have to say that if you think you're going to get a reliable answer that doesn't cite or quote from official Java documentation, you have very strange expectations, and frankly a very strange way of doing your job.

Implementing security for the Projects in OWB

Hi,
Can we able to implement the security for the individual projects?
Thanks
Vinay

Hi,
do not know exactly what kind of security you want to implement. But the below is the excerption from OWB User guide about implementing security at Project level...
You should be able to find more info in OWB User Guide.
Freezing Projects
If you want to freeze the project MY_PROJECT and prevent access to all its contents,
the following restrictions will apply:
You cannot create, edit, or delete any objects under a frozen project.
You cannot invoke any of the services that modify objects within this frozen
project. For example, you cannot perform an MDL import, a source import, or a
snapshot restore in this project.
You can deploy, export, and execute runtime procedures within a frozen project.
You can validate and generate within a frozen project.
You cannot add or remove any objects from a frozen project to a snapshot.
The frozen project security policy is implemented within Warehouse Builder through
the following files. These files are located on your installation CD under:
samples/security_feature/frozenproject.
frozenProject.pkb: Holds the implementation of the security policy.
frozenProject.sql: Contains a table of the structure as shown in Table 192. The
administrator can freeze projects by inserting them into this table and setting the
isFrozen flag to 1.
HTH
mahesh

Implementing Security for BPEL Process

Hi,
We have a requirement to add security layer to BPEL processes (BPEL 10.1.3.4) deployed on WL 9.2. Client has asked us to implement PKI for WL domain.
Please guide me regarding the same.
Regards,
Prabodh Mitra
P.S. we are not using OWSM due to some business reasons

Hi,
Can you please provide any docs related to implementing pki/ssl in a BPEL-WLS env ? I have tried, but in vain.
These are the questions I have,
1. BPEL is installed on a separate domain in WLS. How will we enable SSL here? Is it ok if we enable at admin server level ?
2. Do we need to do some configuration on BPEL side as we do in OAS setup?
Thanks in advance.
Regards,
AP

Need opinions/links/etc... regarding Oracle security for a custom app

Okay it's an open ended question but I need some help figuring out what we should be doing.
We have an old legacy Sybase system written in Powerbuilder which they want to move to a web app. Great! That means we get new toys. Problem, it's a standalone system now being merged into a web system. We're looking at Oracle 10.2 and App Server to run everything. We're not sure about reporting yet.
Here's my question. What/how is everyone using for user account security? I'll have say 5000 users at different locations in the world. Let's say you have sites A, B and C. I'll ultimately need to be able to allow Mr. Smith at Site A to create info which nobody at site B or C is allowed to see. But then Mr. Smith's manager should be allowed to see all the work done by his people so he technically has visibility to everything at site A regardless if he created it or not. The company VP & Presidents need to see everything from sites A, B and C. (Also possibly allow someone to 'grant' access to another person's info. ie - someone at site A allowing someone at site B to view their info by some interface setting)
Now there's a second level of sensitivity. Say unclassified, classified and top secret. Each employee, regardless of where they sit in the heirarchy tree above, can only see documents up to their sensitivity level. So someone with classified access can see unclassified and classified items, but not top secret.
Now I've looked at Oracle row level security and it looks like exactly what I'll need but that means that every user, needs to be a database user? I've never worked with something like that. The only other way I'm aware of doing this, would be have the application developers code all the checks into the system based on user info. That leaves lots of maintenance headaches and we will need a reporting tool so then we have to recreate all that info on the report side as well. (which is actually the way the current standalone system works. One main user to do the connections, then we have a "user table" to check rights, password & so forth).
Is it unheard of to create a custom app (that's the key, there is no COTS for this), then have all the user accounts be stored as actual Oracle users? For a web app, I'm used to a single user being the "pass through" for any connections to the database then pass that back to the user. Are there any considerations or tricks to integrate Oracle user creation into the system or it's as simple as have the app run the correct sql from an account with the correct permissions?
How else can this be done or how else is everyone doing it? Any links to info would be great and most appreciated. Stories and how you did it type of info is also real good!
Thanks.

Pierre,
That helped a lot. I ended up ordering one of Tom's recommended books on security. I also was able to find a few examples (once I figured what I needed to be looking for) that got me up and running with a test instance to play with.
Thank you very much!

Implementing Alerts for a Custom List

Hi,
I have a custom list in our SharePoint 2013 environment. One of the columns is "Contract Expiry Date". We would like to send an automated email to a specific person when the "Contract Expiry Date" is 30 days ahead of time.
I believe there are few ways to implement this in SharePoint. Could you please give me your opinion about how you would implement the above requirement.
Thanks a lot.
Dineth

Hi Dineth,
Thanks for posting your issue, Workflows seem like the right way to do it. you can customize your workflow condition based on your expiry date.
Kindly browse the below mentioned URLs to create workflow to send an email for expiry
http://mysharepointchronicles.wordpress.com/2012/11/05/sharepoint-list-with-workflow-email-reminder-set-to-send-30-days-from-created-date/
http://markeev.com/Articles/item-expiration-reminders-in-sharepoint-using-workflow.aspx
I hope this is helpful to you, mark it as Helpful.
If this works, Please mark it as Answered.
Regards,
Dharmendra Singh (MCPD-EA | MCTS)
Blog : http://sharepoint-community.net/profile/DharmendraSingh

Implementing Security For ADF Pages when integrated with Oracle APPS

Hi,
Can anyone please let me know the solution to the below problem ?
I have an ADF application that is deployed on a weblogic server. An URL is generated to access the ADF Pages.
I have created one more simple jsp (Launch.jsp) which redirects to this URL on page load.
I am using Oracle APPS where:
->I registered a form function referring to Launch.jsp
->I am referring form function in a responsibility , attaching that to a menu
->When the valid oracle user logs in, I am sending all oracle apps environment variables (User id , Responsibility id, application id ) for that session
What my issue is :
->The URL along with the parameters that I am sending from the Launch.jsp to the ADF Page is visible to the user. So, even if the Oracle APPS user has not logged in, anybody who knows the URL can access the ADF Pages.
->So, Is there any way to implement the security so as, even if anyone knows the URL of the ADF Page cannot access the ADF Pages without the valid user being logged-in through the Oracle APPS.
I am using Jdeveloper 11g.
Please let me know if you need anymore details.
Thanks in advance,
Kavitha

Please help me out if anyone has a solution to this problem.
Thanks,
Kavitha

Value Help for Model in java webdynpro

I have created an OVS in web dynpro. I would like to query the database(ABAP Table in SAP R/3).
How do I do it in webdynpro.
Thanks and Regards,
Narayani

Hi Valery ,
I tried using the ICMIQuery but there seems to be a problem. I am getting the following exception:
"java.lang.UnsupportedOperationException: Not supported for generic queries"
This is the code that I tried for query.
Selectquery is the query model class that I have created.
I have even tried without the wdcontext also.
SelectQuery query = new SelectQuery();
wdContext.nodeSelectQuery().bind(query);
WDValueServices.addOVSExtension("OVSTEST",attributes,query,listener);
Thanks.
Narayani

Custom XPath Extensions vs Custom Java

So, I was taking a look at some Custom Java abilities inside a BPEL process. It seemed to me that this was not too re-usable. So, I thought, maybe we could wrap this inside a custom XPath expression. The result of which you could just pass to a variable.
However, there seems to be some limitations or lack of availability of some inherently available features in the Custom Java. IE. Lookup, get, set etc. Is there an easy way to get at the builtins for the custom java sections inside a custom xpath expression? Within an XPath extension, can I just get the context from the InitialContext() with no env specified?
Am I taking a wrong approach here? Should I just stick with the Custom Java tasks?
Thanks,
BradW

Thanks for the reply, I tried with
public static String[] myUppercaseStringArray(String[] arg) in java file
and Ljava.lang.String; myUppercaseStringArray([Ljava.lang.String;) in my xml config file, It doesnt work.
Please suggest.

Where can I find the original code for class in Java API

I am learning Java programming and wanted to see how professionals handel all cases. Can anyone tell me where I can find the original implementation code for classes in Java API? It would be a great help for me.

the basic source is where you installed java in a file called java.src, its either in the main dir of one of the sub dirs ( mmm ), contains all the source code for all the classes in the api.

Implementing Security in web services developed using JAX WS approach

Hi ,
Our Organization has developed a Web service using JAX WS approach exposing EJB as EndPoint .This wsdl file URL is only used by third party companies that register with us (Means i want to say that this wsdl url is not world wide accessable).
Now we need to implement security for this service , please tell me what is the appropiate for doing so ??
Thank you in advance .
Waiting for your valuable suggestions .
Please help .

You can implement message level security in many ways. Some of the ways are
SAML
Digital certificates etc
You may have to work with your vendor specific API to achieve this. Take a look at one case study.
http://www.ibm.com/developerworks/webservices/library/ws-security.html
You will find lot of articles on google to implement message level security however my recommendation would be to get in touch with security expert.

Java WebDynpro's and IE security settings for file download

We have a EP 7.0 SP13 environment on which we have deployed a number of own developed java webdynpro's. In some of these webdynpro's we provide the file download functionality. The portal and webdynpro's are used by both internal personnel and external customers.
On the other hand the default Internet security settings for Internet Explorer, disable "Automatic prompting for file downloads".
When a user, with these default security settings active, tries to use our webdynpro's file download functionality, the screen seems to refreshes but no file download starts. When (s)he retries, the session runs for some minutes and gives following error message:
"com.sap.tc.webdynpro.services.session.LockException: Thread SAPEngine_Application_Thread[impl:3]_20 failed to acquire exclusive lock on client session ClientSession".
This behavior is explained in SAPNote 1234847. Webdynpro provides a single-thread module, meaning a user session is blocked for the during of the request. And because the previous file download isn't yet completed the new try can't start.
Issue now, although the users IE settings allow file downloads and don't block pop up's, he can't download the file and even isn't made aware of the cause of the failure.
How can we avoid this issue, without having to communicate the
application requires specific browser settings?

Welcome to the Apple Support Communities
See > http://support.apple.com/kb/HT5290
You can install the program using different ways:
1. Right-click the application installer and choose Open.
2. Go to System Preferences > Security and Privacy and select Anywhere in Allow applications downloaded from

Sample Java WebDynPro calling Customer Details BAPI does not work

Hi,
I have created a sample application (referring SAP's tutorials for Java WebDynPro) which invokes the BAPI_BUPA_ADDRESS_GETDETAIL Bapi.( for reading Customer Address details)
I've made only one view which takes in BusinessPartner as the input and a form for the output.
Have created a model for this purpose and a custom controller.
I've mapped the appropriate fields for both the contexts of View and the Custom Controller.
The Application has been built and deployed on the server. The Jco connections have been configured and tested.
However, Nothing happens when the user enters a business partner input and clicks on the related button to bring up the output.
This WebDynPro has been designed the exact same way as the SAP provided tutorial at
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/webcontent/uuid/28113de9-0601-0010-71a3-c87806865f26?rid=/library/uuid/49f2ea90-0201-0010-ce8e-de18b94aee2d#15 [original link is broken]
Code has been implemented in the implementation tabs of the view and the custom controller the same way too.
Any ideas?
Thanks,
Raman

Implementation tab of Custom Controller
public void wdDoInit()
    //@@begin wdDoInit()
    Bapi_Bupa_Address_Getdetail_Input input = new Bapi_Bupa_Address_Getdetail_Input();
    wdContext.nodeBapiCall().bind(input);
    input.setBusinesspartner(new String());
    //@@end
public void executeBapi( )
    //@@begin executeBapi()
    try
         wdContext.currentBapiCallElement().modelObject().execute();
         wdContext.nodeOutput().invalidate();
    catch (Exception ex)
         ex.printStackTrace();
    //@@end
Custom Controller Binding With Model
Context
*BapiCall
    *Output
       *Bapiadtel $$$
         *Field A
         *Field B and so on
    *BusinessPartner $$$
Fields marked with $$$ above are mapped to Bapi_Bupa_Address_GetDetail_Input's Bapiadtel and BusinessPartner.
View Binding with Custom Controller
Context
*BapiStart
    *Output
       *Bapiadtel @@@
         *Field A
         *Field B and so on
    *BusinessPartner @@@
Fields marked with @@@ above are mapped to BapiCall's(Custom Ctrllr) Bapiadtel and BusinessPartner.
Thanks.

How to do sorting/filtering on custom java data source implementation

Hi,
I have an entity driven view object whose data should be retrieved and populated using custom java data source implementation. I've done the same as said in document. I understand that Query mode should be the default one (i.e. database tables) and createRowFromResultSet will be called as many times as it needs based on the no. of data retrieved from service, provided we should write the logic for hasNextForCollection(). Implementation sample code is given below.
protected void executeQueryForCollection(Object qc, Object[] params, int noUserParams) {
Iterator datumItr = retrieveDataFromService(qc, params);
setUserDataForCollection(qc, datumItr);
hasNextForCollection(qc);
super.executeQueryForCollection(qc, params, noUserParams);
protected boolean hasNextForCollection(Object qc) {
Iterator datumItr = (Iterator) getUserDataForCollection(qc);
if (datumItr != null && datumItr.hasNext()){
return true;
setCallService(false);
setFetchCompleteForCollection(qc, true);
return false;
protected ViewRowImpl createRowFromResultSet(Object qc, ResultSet resultSet) {
Iterator datumItr = (Iterator) getUserDataForCollection(qc);
Object datumObj = datumItr.next();
ViewRowImpl r = createNewRowForCollection(qc);
return r;
Everything is working fine include table sorting/filtering. Then i noticed that everytime when user perform sorting/filtering, executeQueryForCollection is called, which in turn calls my service. It is a performance issue. I want to avoid. So i did some modification in the implementation in such a way that, service call will happen only if the callService flag is set to true, followed by executeQuery(). Code is given below.
private boolean callService = false;
public void setCallService(boolean callService){
this.callService = callService;
public boolean isCallService(){
return callService;
protected void executeQueryForCollection(Object qc, Object[] params, int noUserParams){
if (callService)
Iterator datumItr = retrieveDataFromService(qc, params);
setUserDataForCollection(qc, datumItr);
hasNextForCollection(qc);
super.executeQueryForCollection(qc, params, noUserParams);
Issue i have:
When user attempts to use table sort/filter, since i skipped the service call and set null as userDataCollection, createRowFromResultSet is not called and data which i retrieved and populated to view object is totally got vanished!!. I've already retrived data and created row from result set. Why it should get vanished? Don't know why.
Tried solution:
I came to know that query mode should be set to Scan_Entity_Cache for filtering and Scan_View_Rows for sorting. I din't disturb the implementation (i.e. skipping service call) but overrided the executeQuery and did like the following code.
@Override
public void executeQuery(){
setQueryMode(callService ? ViewObject.QUERY_MODE_SCAN_DATABASE_TABLES : ViewObject.QUERY_MODE_SCAN_ENTITY_ROWS);
super.executeQuery();
By doing this, i could able to do table filtering but when i try to use table sorting or programmatic sorting, sorting is not at all applied.
I changed the code like beolw*
@Override
public void executeQuery(){
setQueryMode(callService ? ViewObject.QUERY_MODE_SCAN_DATABASE_TABLES : ViewObject.QUERY_MODE_SCAN_VIEW_ROWS);
super.executeQuery();
Now sorting is working fine but filtering is not working in an expected way because Scan_View_rows will do further filtering of view rows.
Question:
I don't know how to achieve both filtering and sorting as well as skipping of service call too.
Can anyone help on this?? Thanks in advance.
Raguraman

Hi,
I have an entity driven view object whose data should be retrieved and populated using custom java data source implementation. I've done the same as said in document. I understand that Query mode should be the default one (i.e. database tables) and createRowFromResultSet will be called as many times as it needs based on the no. of data retrieved from service, provided we should write the logic for hasNextForCollection(). Implementation sample code is given below.
protected void executeQueryForCollection(Object qc, Object[] params, int noUserParams) {
Iterator datumItr = retrieveDataFromService(qc, params);
setUserDataForCollection(qc, datumItr);
hasNextForCollection(qc);
super.executeQueryForCollection(qc, params, noUserParams);
protected boolean hasNextForCollection(Object qc) {
Iterator datumItr = (Iterator) getUserDataForCollection(qc);
if (datumItr != null && datumItr.hasNext()){
    return true;
setFetchCompleteForCollection(qc, true);
return false;
protected ViewRowImpl createRowFromResultSet(Object qc, ResultSet resultSet) {
Iterator datumItr = (Iterator) getUserDataForCollection(qc);
Object datumObj = datumItr.next();
ViewRowImpl r = createNewRowForCollection(qc);
return r;
}Everything is working fine include table sorting/filtering. Then i noticed that everytime when user perform sorting/filtering, executeQueryForCollection is called, which in turn calls my service. It is a performance issue. I want to avoid. So i did some modification in the implementation in such a way that, service call will happen only if the callService flag is set to true, followed by executeQuery(). Code is given below.
private boolean callService = false;
public void setCallService(boolean callService){
this.callService = callService;
public boolean isCallService(){
return callService;
protected void executeQueryForCollection(Object qc, Object[] params, int noUserParams){
if (callService) {
    Iterator datumItr = retrieveDataFromService(qc, params);
    setUserDataForCollection(qc, datumItr);
hasNextForCollection(qc);
super.executeQueryForCollection(qc, params, noUserParams);
}Issue i have:
When user attempts to use table sort/filter, since i skipped the service call and storing of userDataCollection, createRowFromResultSet is not called and data which i retrieved and populated to view object is totally got vanished!!. I've already retrived data and created row from result set. Why it should get vanished? Don't know why.
Tried solution:
I came to know that query mode should be set to Scan_Entity_Cache for filtering and Scan_View_Rows for sorting. I din't disturb the implementation (i.e. skipping service call) but overrided the executeQuery and did like the following code.
@Override
public void executeQuery(){
setQueryMode(callService ? ViewObject.QUERY_MODE_SCAN_DATABASE_TABLES : ViewObject.QUERY_MODE_SCAN_ENTITY_ROWS);
super.executeQuery();
}By doing this, i could able to do table filtering but when i try to use table sorting or programmatic sorting, sorting is not at all getting applied.
I changed the code like below one (i.e. changed to ViewObject.QUERY_MODE_SCAN_VIEW_ROWS instead of ViewObject.QUERY_MODE_SCAN_ENTITY_ROWS)
@Override
public void executeQuery(){
setQueryMode(callService ? ViewObject.QUERY_MODE_SCAN_DATABASE_TABLES : ViewObject.QUERY_MODE_SCAN_VIEW_ROWS);
super.executeQuery();
}Now sorting is working fine but filtering is not working in an expected way because Scan_View_rows will do further filtering of view rows.
If i OR'ed the Query Mode as given below, i am getting duplicate rows. (vewObject.QUERY_MODE_SCAN_ENTITY_ROWS | ViewObject.QUERY_MODE_SCAN_VIEW_ROWS) Question:
I don't know how to achieve both filtering and sorting as well as skipping of service call too.
Can anyone help on this?? Thanks in advance.
Raguraman
Edited by: Raguraman on Apr 12, 2011 6:53 AM

Implementing security for a custom Java Webdynpro

Similar Messages

Maybe you are looking for