Issue in External Table Authentication and Authorization in OBIEE11G

Hello Gurus,
Can anyone help me how to configure External Table Authentication and Authorization in OBIEE11g through weblogic server not like in 10g style(Through INIT Blocks).
I've followed the (Doc ID 1338007.1) document. But when i'm restart the Managed servers and Admin servers after configuring the SQLAuthenticator all my services are showing down.
I already raised the SR (SR 3-6286054151) on this issue. But still i didn't get any reply from them.
Can anyone help me out on this issue or can anyone me send the document for "how to configure External Table Authentication and Authorization in OBIEE11g" . It's really appreciate for your quick response.
my mail ID [email protected]
Thanks,
Syam.
Edited by: 942658 on Oct 13, 2012 10:55 AM

Hi John,
Thanks for your quick response.
We configured "ReadOnlySQL Provider" by following the Oracle's white paper(Doc ID 1338007.1) Please find the below steps what we configured in weblogic console.
1. Created the Data Source
2. In the data source specified the Database driver--> *Oracle's Driver Thin for service connections: Versions:9.0.1 and later.
3. Defined the connection Properties .
4. Selected targets as Admin server and bi_server.
Then Activate changes
5. Created new provider by using ReadOnlySQL Authenticator
6. In the provider specific tab we given the SQL statements and saved it.
7. Restarted the Admin and Managed servers.
After restarted the services when we open the Enterprise Manager page all the services are showed as Undefined - means red.
Apart from that we followed your suggested link http://askjohnobiee.blogspot.com/2012/09/how-to-oid-authentication-with-groups.html
For External table authentication do we need to configure BISQLAuthenticator or ReadOnlySQLAuthenticator ?
If we configure BISQLAuthenticator we just import Groups from database to Console application. Then how can it Authenticated to the User ?
Please let me know your ideas on this.
Thanks,
Syam

Similar Messages

  • How to get ADF authentication and authorization working on server

    I am having an issue with deployment & ADF authentication and authorization.
    From the below testing results, you can see that I am unable to log in when I have deployed my app to my standalone server with both ADF security authentication and authorization turned on. I have included web.xml, jazn-data.xml and the page/server error I am receiving.
    When making an attempt to log in I get the following results:
    Running Locally with ADF Authentication:                                           Works Fine
    Running Locally with ADF Authentication & Authorization:         Works Fine
    Deployed to server with ADF Authentication:                                    Works Fine
    Deployed to server with ADF Authentication & Authorization:  Doesn’t Work
    What I have already tried: Removed all anonymous grants, using the same database credentials as the app user, deploying app twice (on the redeploy not including the login credentials & app policies at the application properties). Various modifications to web.xml e.g. welcomefilelist etc
    JDeveloper Version: 11.1.2.4
    Server Web Logic: 10.3.6
    Server ADF: 11.1.1.16
    Page Error when trying to log in:
    Error 401--Unauthorized
    From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
    10.4.2 401 Unauthorized
    The request requires user authentication. The response MUST include a WWW-Authenticate header field (section 14.46) containing a challenge applicable to the requested resource. The client MAY repeat the request with a suitable Authorization header field (section 14.8). If the request already included Authorization credentials, then the 401 response indicates that authorization has been refused for those credentials. If the 401 response contains the same challenge as the prior response, and the user agent has already attempted authentication at least once, then the user SHOULD be presented the entity that was given in the response, since that entity MAY include relevant diagnostic information. HTTP access authentication is explained in section 11.
    Server error when trying to log in:
    Servlet failed with Exception oracle.adf.controller.security.AuthorizationException: ADFC-0619: Authorization check failed: 'wpd.mobility.view.pageDefs.homePagePageDef' 'VIEW'.
    at oracle.adf.controller.internal.security.AuthorizationEnforcer.handleFailure(AuthorizationEnforcer.java:182)
            at oracle.adf.controller.internal.security.AuthorizationEnforcer.internalCheckPermission(AuthorizationEnforcer.java:162)
            at oracle.adf.controller.internal.security.AuthorizationEnforcer.checkPermission(AuthorizationEnforcer.java:116)
            at oracle.adfinternal.controller.state.ControllerState.checkPermission(ControllerState.java:663)
            at oracle.adfinternal.controller.state.ControllerState.initializeUrl(ControllerState.java:700)
            at oracle.adfinternal.controller.state.ControllerState.synchronizeStatePart2(ControllerState.java:531)
            at oracle.adfinternal.controller.application.SyncNavigationStateListener.afterPhase(SyncNavigationStateListener.java:59)
            at oracle.adfinternal.controller.lifecycle.ADFLifecycleImpl$PagePhaseListenerWrapper.afterPhase(ADFLifecycleImpl.java:530)
            at oracle.adfinternal.controller.lifecycle.LifecycleImpl.internalDispatchAfterEvent(LifecycleImpl.java:120)
            at oracle.adfinternal.controller.lifecycle.LifecycleImpl.dispatchAfterPagePhaseEvent(LifecycleImpl.java:168)
            at oracle.adfinternal.controller.faces.lifecycle.ADFPhaseListener$PhaseInvokerImpl.dispatchAfterPagePhaseEvent(ADFPhaseListener.java:131)
            at oracle.adfinternal.controller.faces.lifecycle.ADFPhaseListener.afterPhase(ADFPhaseListener.java:74)
            at oracle.adfinternal.controller.faces.lifecycle.ADFLifecyclePhaseListener.afterPhase(ADFLifecyclePhaseListener.java:53)
            at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._executePhase(LifecycleImpl.java:447)
            at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:202)
            at javax.faces.webapp.FacesServlet.service(FacesServlet.java:508)
            at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
            at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
            at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
            at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at oracle.adf.model.servlet.ADFBindingFilter.doFilter(ADFBindingFilter.java:205)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at oracle.adfinternal.view.faces.webapp.rich.RegistrationFilter.doFilter(RegistrationFilter.java:125)
            at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
            at oracle.adfinternal.view.faces.activedata.AdsFilter.doFilter(AdsFilter.java:60)
            at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:468)
            at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl._doFilterImpl(TrinidadFilterImpl.java:293)
            at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl.doFilter(TrinidadFilterImpl.java:199)
            at org.apache.myfaces.trinidad.webapp.TrinidadFilter.doFilter(TrinidadFilter.java:92)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
            at java.security.AccessController.doPrivileged(Native Method)
            at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:315)
            at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:442)
            at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
            at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
            at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
            at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
            at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
            at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
            at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
            at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
            at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
            at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
            at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
            at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
            at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)
    Web.xml
    <?xml version = '1.0' encoding = 'windows-1252'?>
    <web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
             version="2.5">
      <context-param>
        <param-name>javax.faces.STATE_SAVING_METHOD</param-name>
        <param-value>client</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.PARTIAL_STATE_SAVING</param-name>
        <param-value>false</param-value>
      </context-param>
      <context-param>
        <description>If this parameter is true, there will be an automatic check of the modification date of your JSPs, and saved state will be discarded when JSP's change. It will also automatically check if your skinning css files have changed without you having to restart the server. This makes development easier, but adds overhead. For this reason this parameter should be set to false when your application is deployed.</description>
        <param-name>org.apache.myfaces.trinidad.CHECK_FILE_MODIFICATION</param-name>
        <param-value>false</param-value>
      </context-param>
      <context-param>
        <description>Whether the 'Generated by...' comment at the bottom of ADF Faces HTML pages should contain version number information.</description>
        <param-name>oracle.adf.view.rich.versionString.HIDDEN</param-name>
        <param-value>false</param-value>
      </context-param>
      <context-param>
        <description>Security precaution to prevent clickjacking: bust frames if the ancestor window domain(protocol, host, and port) and the frame domain are different. Another options for this parameter are always and never.</description>
        <param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
        <param-value>differentOrigin</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.FACELETS_SKIP_XML_INSTRUCTIONS</param-name>
        <param-value>true</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.FACELETS_SKIP_COMMENTS</param-name>
        <param-value>true</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.FACELETS_DECORATORS</param-name>
        <param-value>oracle.adfinternal.view.faces.facelets.rich.AdfTagDecorator</param-value>
      </context-param>
      <context-param>
        <param-name>javax.faces.FACELETS_RESOURCE_RESOLVER</param-name>
        <param-value>oracle.adfinternal.view.faces.facelets.rich.AdfFaceletsResourceResolver</param-value>
      </context-param>
      <filter>
        <filter-name>JpsFilter</filter-name>
        <filter-class>oracle.security.jps.ee.http.JpsFilter</filter-class>
      </filter>
      <filter>
        <filter-name>trinidad</filter-name>
        <filter-class>org.apache.myfaces.trinidad.webapp.TrinidadFilter</filter-class>
      </filter>
      <filter>
        <filter-name>adfBindings</filter-name>
        <filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
      </filter>
      <filter-mapping>
        <filter-name>JpsFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
      </filter-mapping>
      <filter-mapping>
        <filter-name>trinidad</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>ERROR</dispatcher>
      </filter-mapping>
      <filter-mapping>
        <filter-name>adfBindings</filter-name>
        <servlet-name>Faces Servlet</servlet-name>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
      </filter-mapping>
      <filter-mapping>
        <filter-name>adfBindings</filter-name>
        <servlet-name>adfAuthentication</servlet-name>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>REQUEST</dispatcher>
      </filter-mapping>
      <listener>
        <listener-class>oracle.adf.mbean.share.connection.ADFConnectionLifeCycleCallBack</listener-class>
      </listener>
      <listener>
        <listener-class>oracle.adf.mbean.share.config.ADFConfigLifeCycleCallBack</listener-class>
      </listener>
      <listener>
        <listener-class>oracle.bc4j.mbean.BC4JConfigLifeCycleCallBack</listener-class>
      </listener>
      <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
      </servlet>
      <servlet>
        <servlet-name>resources</servlet-name>
        <servlet-class>org.apache.myfaces.trinidad.webapp.ResourceServlet</servlet-class>
      </servlet>
      <servlet>
        <servlet-name>BIGRAPHSERVLET</servlet-name>
        <servlet-class>oracle.adf.view.faces.bi.webapp.GraphServlet</servlet-class>
      </servlet>
      <servlet>
        <servlet-name>BIGAUGESERVLET</servlet-name>
        <servlet-class>oracle.adf.view.faces.bi.webapp.GaugeServlet</servlet-class>
      </servlet>
      <servlet>
        <servlet-name>MapProxyServlet</servlet-name>
        <servlet-class>oracle.adf.view.faces.bi.webapp.MapProxyServlet</servlet-class>
      </servlet>
      <servlet>
        <servlet-name>adfAuthentication</servlet-name>
        <servlet-class>oracle.adf.share.security.authentication.AuthenticationServlet</servlet-class>
        <init-param>
          <param-name>success_url</param-name>
          <param-value>/faces/Pages/homePage.jspx</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
      </servlet>
      <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>/faces/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>resources</servlet-name>
        <url-pattern>/adf/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>resources</servlet-name>
        <url-pattern>/afr/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>BIGRAPHSERVLET</servlet-name>
        <url-pattern>/servlet/GraphServlet/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>BIGAUGESERVLET</servlet-name>
        <url-pattern>/servlet/GaugeServlet/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>MapProxyServlet</servlet-name>
        <url-pattern>/mapproxy/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>resources</servlet-name>
        <url-pattern>/bi/*</url-pattern>
      </servlet-mapping>
      <servlet-mapping>
        <servlet-name>adfAuthentication</servlet-name>
        <url-pattern>/adfAuthentication</url-pattern>
      </servlet-mapping>
      <mime-mapping>
        <extension>swf</extension>
        <mime-type>application/x-shockwave-flash</mime-type>
      </mime-mapping>
      <mime-mapping>
        <extension>amf</extension>
        <mime-type>application/x-amf</mime-type>
      </mime-mapping>
      <security-constraint>
        <web-resource-collection>
          <web-resource-name>test</web-resource-name>
          <url-pattern>/faces/pages/*.</url-pattern>
          <url-pattern>/faces/*.</url-pattern>
        </web-resource-collection>
        <auth-constraint>
          <role-name>valid-users</role-name>
        </auth-constraint>
      </security-constraint>
      <security-constraint>
        <web-resource-collection>
          <web-resource-name>adfAuthentication</web-resource-name>
          <url-pattern>/adfAuthentication</url-pattern>
        </web-resource-collection>
        <auth-constraint>
          <role-name>valid-users</role-name>
        </auth-constraint>
      </security-constraint>
      <login-config>
        <auth-method>FORM</auth-method>
        <form-login-config>
          <form-login-page>/login.html</form-login-page>
          <form-error-page>/error.html</form-error-page>
        </form-login-config>
      </login-config>
      <security-role>
        <role-name>valid-users</role-name>
      </security-role>
    </web-app>
    Jazn-data.xml
    <?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?>
    <jazn-data xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
               xsi:noNamespaceSchemaLocation="http://xmlns.oracle.com/oracleas/schema/jazn-data.xsd">
      <jazn-realm default="jazn.com">
        <realm>
          <name>jazn.com</name>
          <users>
            <user>
              <name>*****</name>
              <display-name>*******</display-name>
              <description>******</description>
              <credentials>********<credentials>
            </user>
          </users>
          <roles>
            <role>
              <name>support</name>
              <display-name>support</display-name>
              <members>
                <member>
                  <type>user</type>
                  <name>mobile</name>
                </member>
              </members>
            </role>
          </roles>
        </realm>
      </jazn-realm>
      <policy-store>
        <applications>
          <application>
            <name> myapp </name>
            <app-roles>
              <app-role>
                <name>mob_mobile_support</name>
                <class>oracle.security.jps.service.policystore.ApplicationRole</class>
                <display-name>mob_mobile_support</display-name>
                <description>support role</description>
                <members>
                  <member>
                    <name>mobile</name>
                    <class>oracle.security.jps.internal.core.principals.JpsXmlUserImpl</class>
                  </member>
                </members>
              </app-role>
            </app-roles>
            <jazn-policy>
              <grant>
                <grantee>
                  <principals>
                    <principal>
                      <name>SUPPORT</name>
                      <class>oracle.security.jps.internal.core.principals.JpsXmlEnterpriseRoleImpl</class>
                    </principal>
                  </principals>
                </grantee>
                <permissions>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name> myapp.view.pageDefs.*</name>
                    <actions>view</actions>
                  </permission>
                </permissions>
              </grant>
              <grant>
                <grantee>
                  <principals>
                    <principal>
                      <name>mob_mobile_support</name>
                      <class>oracle.security.jps.service.policystore.ApplicationRole</class>
                    </principal>
                  </principals>
                </grantee>
                <permissions>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name> myapp.view.pageDefs.addapplicationPageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name>Pages.addappmsgtypPageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name>Pages.addoperationPageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name> myapp.view.pageDefs.homePagePageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name> myapp.view.pageDefs.loggingSearchPageDef</name>
                    <actions>view</actions>
                  </permission>
                  <permission>
                    <class>oracle.adf.share.security.authorization.RegionPermission</class>
                    <name>myapp.view.pageDefs.workHistoryPageDef</name>
                    <actions>view</actions>
                  </permission>
                </permissions>
              </grant>
            </jazn-policy>
          </application>
        </applications>
      </policy-store>
    </jazn-data>

    Read Frank's article http://www.oracle.com/technetwork/issue-archive/2012/12-jan/o12adf-1364748.html
    Then you have to check if the user use use to login are defined in the stand alone server. If you server is running in production mode there is no automatic user or role migration. You have to to this by yourself.
    Once you have check that the users are present, you have to check if the enterprise roles are mapped to the corresponding application roles.
    Timo

  • External Table Authentication - Not Able to Login to Presentation services

    Hi ,
    I am trying to setup External table Authentication and in Rpd file I have setup session Variable as described in the OBIEE Server Admin Guide (http://download.oracle.com/docs/cd/E10415_01/doc/bi.1013/b31770.pdf -- Page 326 ) ..
    But when I try to logon to Presentation services Iget the following error.
    State: 08004. Code: 10018. [NQODBC] [SQL_STATE: 08004] [nQSError: 10018] Access for the requested connection is refused. [nQSError: 13024] Successful completion of init block 'TableLDAP' is required. (08004)
    what am I doing wrong ? Please adivce.
    Thanks
    SS

    Hello,
    I Have setup system session User and group variables in a Initialazation block. No LDAP is tied. I have just created a table and added bunch of users and their passwords and their groups they belongs to.When I test my initialization block in rpd by suppling Uid/Pwd I see correct group they belongs to.
    But When I try in Presentation layer it doesn't work and throwing same error I mentioned.I tried various things but no luck .Not sure why intialization block is not firing off.
    Thanks
    SS

  • An issue with authentication and authorization on ISE 1.2

    Hi, I'm new to ISE.
    I have an issue with authentication and authorization.
    I have ISE 1.2 plus patch 6 installed on VMware.
    I have built-in Windows XP supplicant and 2960 cisco switch with IOS c2960-lanbasek9-mz.150-2.SE5.bin
    On supplicant I use EAP(PEAP) with EAP-MSCHAP v2.
    I created  authentication and authorization rules with Active Directory  as External Identity Source. Also I applied  authorization profile with DACL.I login on Windows XP machine under different Active Directory accounts. Everything works fine (authentication, authorization ), but only for several hours. After several hours passed , authentication and authorization stop working . I can see that ISE trying authenticate and authorize users, but ISE always use only one account for  authentication and authorization . Even if I login under different accounts ISE continue to use only one last account.
    I traied to reboot switch and PC,but it didn’t help. Only rebooting of ISE helps. After ISE rebooting, authentication and authorization start to work properly for several hours.
    I don’t understand is it a glitch or I misconfigured ISE or switch, supplicant?
    What  should I do to resolve this issue?
    Switch configuration:
     testISE#sh runn
    Building configuration...
    Current configuration : 7103 bytes
    ! Last configuration change at 12:20:15Tue Apr 15 2014
    ! NVRAM config last updated at 10:35:02  Tue Apr 15 2014
    version 15.0
    no service pad
    service timestamps debug datetime msec
    service timestamps log datetime msec
    no service password-encryption
    hostname testISE
    boot-start-marker
    boot-end-marker
    no logging console
    logging monitor informational
    enable secret 5 ************
    enable password ********
    username radius-test password 0 ********
    username admin privilege 15 secret 5 ******************
    aaa new-model
    aaa authentication dot1x default group radius
    aaa authorization network default group radius
    aaa authorization auth-proxy default group radius
    aaa accounting update periodic 5
    aaa accounting dot1x default start-stop group radius
    aaa server radius dynamic-author
     client 172.16.0.90 server-key ********
    aaa session-id common
    clock timezone 4 0
    system mtu routing 1500
    authentication mac-move permit
    ip dhcp snooping vlan 1,22
    ip dhcp snooping
    ip domain-name elauloks
    ip device tracking probe use-svi
    ip device tracking
    epm logging
    crypto pki trustpoint TP-self-signed-1888913408
     enrollment selfsigned
     subject-name cn=IOS-Self-Signed-Certificate-1888913408
     revocation-check none
     rsakeypair TP-self-signed-1888913408
    crypto pki certificate chain TP-self-signed-1888913408
    dot1x system-auth-control
    spanning-tree mode pvst
    spanning-tree extend system-id
    vlan internal allocation policy ascending
    ip ssh version 2
    interface FastEthernet0/5
     switchport mode access
     ip access-group ACL-ALLOW in
     authentication event fail action next-method
     authentication event server dead action reinitialize vlan 1
     authentication event server alive action reinitialize
     authentication host-mode multi-auth
     authentication open
     authentication order dot1x mab
     authentication priority dot1x mab
     authentication port-control auto
     authentication periodic
     authentication timer reauthenticate server
     authentication violation restrict
     mab
     dot1x pae authenticator
     dot1x timeout tx-period 10
     spanning-tree portfast
    interface FastEthernet0/6
     switchport mode access
     ip access-group ACL-ALLOW in
     authentication event fail action next-method
     authentication event server dead action reinitialize vlan 1
     authentication event server alive action reinitialize
     authentication order dot1x mab
     authentication priority dot1x mab
     authentication port-control auto
     authentication periodic
     authentication timer reauthenticate server
     authentication violation restrict
     mab
     dot1x pae authenticator
     dot1x timeout tx-period 10
     spanning-tree portfast
    interface FastEthernet0/7
    interface Vlan1
     ip address 172.16.0.204 255.255.240.0
     no ip route-cache
    ip default-gateway 172.16.0.1
    ip http server
    ip http secure-server
    ip access-list extended ACL-ALLOW
     deny   icmp any host 172.16.0.1
     permit ip any any
    ip radius source-interface Vlan1
    logging origin-id ip
    logging source-interface Vlan1
    logging host 172.16.0.90 transport udp port 20514
    snmp-server community public RO
    snmp-server community ciscoro RO
    snmp-server trap-source Vlan1
    snmp-server source-interface informs Vlan1
    snmp-server enable traps snmp linkdown linkup
    snmp-server enable traps mac-notification change move
    snmp-server host 172.16.0.90 ciscoro
    radius-server attribute 6 on-for-login-auth
    radius-server attribute 6 support-multiple
    radius-server attribute 8 include-in-access-req
    radius-server attribute 25 access-request include
    radius-server dead-criteria time 5 tries 3
    radius-server vsa send accounting
    radius-server vsa send authentication
    radius server ISE-Alex
     address ipv4 172.16.0.90 auth-port 1812 acct-port 1813
     automate-tester username radius-test idle-time 15
     key ******
    ntp server 172.16.0.1
    ntp server 172.16.0.5
    end

    Yes. Tried that (several times) didn't work.  5 people in my office, all with vers. 6.0.1 couldn't access their gmail accounts.  Kept getting error message that username and password invalid.  Finally solved the issue by using Microsoft Exchange and "m.google.com" as server and domain and that the trick.  Think there is an issue with imap.gmail.com and IOS 6.0.1.  I'm sure the 5 of us suddently experiencing this issue aren't the only ones.  Apple will figure it out.  Thanks.

  • External Table Authentication

    Hi I am using OBIEE 11g.
    In my project we have to implement external table authentication. For that we have import the external table to physical layer. and build the repository variable using initialization block. In that i have written a following SQL -
    SELECT loginid
    ,grp
    ,display_name
    ,2
    FROM external_auth
    WHERE loginid = ':USER'
    and password = ':PASSWORD'.
    I have also create the variable target - LOGID, Group, Display Name and Log Level.
    and save the variable.
    My table structure like this - LoginID,Password,Grp, Display Name.
    When i am trying to save the RPD following error message raised.
    ERRORS:
    GLOBAL:
    [38095] The initialization string in the Repository Initialization Block '"Auth Variable"' contains the use of :USER or :PASSWORD.
    Any one to help to come out from this issue.
    Kindly provide any link for step by step guide.
    Thanks
    Gauthaman

    Hi Gautham,
    i think you created Repository Variable.
    Create a Session variable and Session initilization bliock. give the same query in Session Initialize block. it will work.
    Thnaks
    GSR

  • Issue With External Table Authentiaction in OBIEE 11.1.1.6.4

    Hi,
    We are trying to implement security through External table Authentication in OBIEE 11.1.1.6.4.As a part of this process,we want to pass the credential values which are entered in login screen to the below query in the GET SQL PASSWORD section of ReadonlySQLAuthentication Provider.
    select encryptfn(:USER,:PASSWORD) from Users where Username=?
    Credential values which we are entering in Analytics Answers login screen are not getting passed into :USER and :PASSWORD.
    Can anybody please help us what is the exact variable we should use in place of :USER and :PASSWORD in the function called from the above select statement?
    Thanks,
    Syam

    Hi,
    We are also facing the same issue. Any suggestions/workarounds are appreciated.
    Thanks,
    Obul

  • External table authentication not updating user group changes

    Hello
    I have a question..
    In OBIEE, i am using external table authentication. I have user and user group tables where users and groups are stores.. Every Time I create a new user and assign them to a group, these records get inserted immediately to these tables with the correct user and group ID that matches with each other.. Then in my initialization block I have the query that fetches the user name and psswd as well as groups names..
    All these are working at the initial user creation. For example, when I create user A and assign it to group A, the DB table has all of the records inserted correctly. When I log in to OBIEE using User A login, I see it is assigned to Group B.
    The problem comes when I change the user A from Group B to Group C. When I did that, although the DB table gets updated correctly, OBIEE session seems to still be the previous one. As a result, when I log in the second time, I see the user A is still assigned to Group B instead of Group C.. This seems to be cached..
    I double check these user tables in OBIEE, none of them are cache enabled.. The connection pool setting of the isolation level is set as default..
    When I reinstall OBIEE all over again and re-log in the first time, this User is now assigned to Group C..
    So seems to be that it is caching issue.
    How should I go about solving this issue
    Appreciate in advance

    Make sure you check the box for 'Required for authentication' and also 'Use caching' should not check.
    Edited by: Srini VEERAVALLI on May 15, 2013 9:05 PM

  • External Table Authentication in OBIEE 11g

    Hi ,
    I have a security table, which contains userid,displayname,group . I have imported Security table in Physical Layer. I'm creating session variables based on condition.
    When am trying to logging into analytic s getting an error, invalid username and password . I'm using 11.1.1.6.0 version
    How to handle external table authentication in OBIEE 11g version.
    Regards,
    Malli

    Hi fiaz,
    That links talks about 10g version.
    Step1: We have imported a secutiry table in Physical layer.
    Step2: Creating a session variable by selecting initilazation block.
    Select user_name,group from security_table where user_id=':USER' and pwd=':password';
    step3: created DISPLAYNAME,GROUP & USER VARIABLES in edit target window
    After these modifications i was trying to logging with new user, which is there in security table.
    I am getting an error that is invalid user or password.
    Is there any other changes does it required here.
    Regards,
    Malli
    Edited by: user10675696 on Dec 26, 2012 9:39 PM

  • Authentication and authorization capability in weblogic application server

    Hi,
    Need input from architecture point of view -
    Requirement is typical - have to build a web center portal application with authentication and authorization capability.
    I can think of three architecture options:
    1. weblogic server (where webcenter portal application will be deployed) with oracle IDM (or any other full blown IDM suite)...
    2. weblogic server with Active Directory (or any other LDAP directory), and a LDAP authenticator is configured in weblogic...
    3. only weblogic server (users created in weblogic admin console)...
    Obviously 1st one is costliest option (product cost, infrastructure cost, maintenance cost) and most flexible. However I am discarding it purely because of cost.
    Confused between 2nd and 3rd.
    2nd option - separate user store, user can be added/deleted without touching application server, cost wise - 1 extra server and 1 LDAP directory product (or open source LDAP server)...
    3rd option - application server becomes very 'heavy' with all users information, you need to access server to add/delete users, probably cheapest option money wise... However it might affect application performance if users grow large...
    Please let me know if I should consider more parameters/points before deciding. Is there any important thing I am missing? Your input appreciated.
    Thanks.

    Hi,
    You are right your first requirement make more costly and complex environment.
    I would recommend to go with Second option instead of the third one.
    In cause in future if you want to use different server also you will have option to use external AD.
    Well now you will think why I recommend you second option instead of the third option.
    external LDAP is more secure than internal one.
    If you have any further query let me know.
    Regards,
    Kal

  • Query related to external table authentication

    Hi Gurus,
    I am new to OBIEE. When we login to the Oracle Business intelligence, we used to give user as Administrator and password as Administrator.
    At this point, can we authentication the userid and password which is stored in external table in a users schema?
    ~ John

    "Administrator" will always be a user which is registered in the repository. All other users can be authenticated by external table authentication.
    You can create an init block which sets the USER system variable by
    SELECT user FROM users WHERE user = ':USER' and password = ':PASSWORD'

  • Obiee 11g external table authentication

    Hi,
    I try to create external table authentication but it is not working.
    I have created this table
    CREATE TABLE OBI_SECURITY_USERS
    USER_NAME VARCHAR2(100 BYTE),
    USER_PASSWORD VARCHAR2(20 BYTE) NOT NULL
    and I defined Initialization Block it is below
    select USER_NAME FROM obi_security_users
    where USER_NAME=UPPER(':USER')
    and USER_PASSWORD=':PASSWORD'
    and I set Variable target for USER
    I restart services but it is not working.
    Anybody help me?

    Thanks for your reply Suman.
    it is ok I login in answer from my OBI_SECURITY_USERS tables.
    I have new problem about user groups.
    My group table like this
    CREATE TABLE OBI_SECURITY_USER_GROUPS
    USER_NAME VARCHAR2(100 BYTE) NOT NULL,
    USER_GROUP VARCHAR2(100 BYTE) NOT NULL
    I insert to this table user and Group and my Initialization Block is here.
    select 'GROUP',user_group from obi_security_user_groups
    where UPPER(user_name )= UPPER(':USER')
    I have created two application role from em.
    I want to define role this group
    how can i do?
    Thanks

  • How Can We Achieve External Table Authentication

    Hai Guru's
    I want Know The External Table Authentication By Step By Step
    Thanks

    Hi Friend,
    For External table authentication you can follow this link:
    http://obieeblog.wordpress.com/2009/06/18/obiee-security-enforcement-%E2%80%93-external-database-table-authorization/
    Thanks
    Don

  • Authentication and Authorization question.

    Hi All,
    I require your help in getting validated my understanding on Authentication and Authorization. This is wrt to WebLogic Server and WebLogic Portal.
    Authentication.
    1. The custom authentication provider can authenticate(user and group) against any datastore(LDAP OR DB). The LoginModule is a kind of blockbox and it can return true/false depending on authentication.
    2. The end result of this process is true/false.
    Authorization.
    1. The custom authorization providers can authorize the authenticated user based on role. All these entities ie(user,group,role) can be either in LDAP OR DB.
    2. The end result of this process is true/false.
    Role mapping.
    1. The custom role mapper can put all the roles that a user belongs and returns all Role. This can happen agaist LDAP OR DB.
    2. The end result is list of roles for a user.
    Security policy configuration.
    Is it mandatory that a user/group/role should be existing in WebLogic Server LDAP server(OR Portal LDAP server) to create these policies and authorization rules. What i mean by is that can user,group,role can exist in application specific database and still can be used for creatiing security policies??
    Thanks,
    Prashanth Bhat.

    The Security Providers are useful/can be used for developing a standard j2ee application , which will be deployed as standard j2ee application.
    The DA means Delegated Administrator, which is way how portal components are restricted to different types of administrators.
    The VE means Visitor Entitlemens, which is way how portal components are restricted to end users.
    My question is whether thess(DAs and VEs) can also be put
    our datastore for access rights??
    Thanks,
    Prashanth Bhat.

  • How to implement Custom Authentication and Authorization in Oracle SOA 11g

    Can anyone please tell me, how to implement Custom Authentication in Oracle SOA 11g ?
    Because in Oracle SOA 10.1.3.4 , i have implemented this custom authentication and authorization by implementing BPMAuthenticationService, BPMAuthorizationService, BPMIdentityService to verify againt my database systems.
    implementation classes like the mentioned below
    1).
    public class SampleAuthenticationService extends SampleServiceBase implements BPMAuthenticationService {
    2).
    public class SampleAuthorizationService extends SampleServiceBase implements BPMAuthorizationService {
    3).
    public class SampleIdentityService extends SampleServiceBase implements BPMIdentityService {
    Please help me to implement the authentication and authorization in Oracle SOA 11g .
    thanks in advance

    To start with please go through following document
    http://docs.oracle.com/cd/E21764_01/integration.1111/e10231/adptr_jms.htm
    http://docs.oracle.com/cd/E23943_01/integration.1111/e10231/adptr_file.htm
    Regards
    Arpit

  • Please guide me for user authentication and authorization in WebDynPro App

    Hi,
        I just study the WebDynPro to develop the SAP Portal. I've ever developed the Web-based App using J2EE. So when i developed the Web-based App i have to develop the control of the user authentication and authorization on each page for example ,checking the session of the user whether they can access this page or whether session is expired or not,. So i have no idea with the WebDynPro and the SAP Portal because i never had experience for both WebDynPro and Portal.
    I need to ask you some question to clarify my doubt :
    1. SAP Portal  is web page that include every enterprise application with in one page and user log-in to them just on time, isn't it?
    2. If i integrate WebDynPro with SAP Portal, which one will do the authentication and authorization?. I mean that, Do i have to develop the code to check authentication and authorization in the WebDynPro App or Let the SAP Portal manage them?
    3.Could you please suggest the best practice for authentication and authorization in webDynPro.
    Many Thanks
    Noppong J

    in most case you don't have to write code to deal with session, authentication and authorization.
    1. yes,
    2. no, no code needed. you just set an attribute to your application, which make the the authentication required. when user access this page, portal will display the logon page
    3 you can put some authorization related code in web dynpro for specific requirement, search this doc "Protecting Access to the Web Dynpro Car Rental Application Using UME Permissions"

Maybe you are looking for