JSF/JAAS j_security_check for role-based login pages

I'm looking for a way to take the login request after j_security_check is through and invoke logic in a backing bean somewhere to redirect the user (using Faces) to the appropriate view (via an outcome defined in the faces-config.xml, of course) based on the user's role. Is there a "JSF" (i.e. non-filter) way to do this that I'm missing? If not, I suppose I could try a filter if it will work.
I've thought of just going to the same page and displaying different components, but I don't like that a lot, even using subviews. I thought about having two web apps, but find that to be a poor option. I really don't like trusting the user to remember/get a URL right beyond http://xyz.com or something similarly simple, as much to save them from frustration as anything else.
Any ideas would be appreciated. I've scoured forums and Googled all day without much success, so I apologize if this is posted somewhere already. This seems like something that should be pretty simple and I may want to kick myself when I see the answer.

Hi Brian,
I do not believe it is j_security_check's job to check for blank
passwords.
In many security realms, it is "legal" for a user to have a blank
password. j_security_check forwards whatever password was entered so that
even users with blank passwords can be authenticated by the realm on the
backend. For this reason I believe that j_security_check is "doing the
right thing" by just forwarding whatever is presented to it, rather than
having its own logic. It is best if j_security_check just acts as a very
dumb middle man.
If behavior was altered, it is true that your particular problem would be
solved, but then many other people would have a problem with their users
with blank passwords authenticating properly...
Try looking into how to disable anonymous logins on the LDAP end of
things. Hope this helps.
Cheers,
Joe Jerry
brian wrote:
I am using the LDAP Security Realm to authenticate against an iPlanet
Directory Server. All works as expected when a user-id and password
are entered for form-based authentication.
However, when a userid is entered but no password, j_security_check
logs the user in successfully. Aparently, this is correct LDAP
behaviour as anonymous login to the LDAP server is permitted. It seems
that the j_security_check servlet should check for blank passwords
before trying to authenticate against the LDAP server and fail
authentication if this is the case.
Has anyone else experienced this problem?

Similar Messages

WLC 2504 - French characters for guest web login page

Good day,
I have recently installed a WLC 2504 and I have the following issue:
When I modify the text for the web login page (Under security/Web Auth/Web Auth page), if I use french caracters such as (é, è, à, etc...) in the message body, it does not show up correctly on users computers. As we're a bilingual country, I must put a bilingual text message. Are there any settings or workaround out there to rectify this?
We're on version 7.2.103.0
Thanks,
Eric

Thanks Scott, I'll have a look at the documentation.
Right after sending this post, I tried typing the actual HTML code for the character instead and it seems to be working. I'm curious about custom webauth page, we may be able to customize it more than we thought we could do.
Cheers,
Eric

How do I get my PHP based login page to work on my Earthlink site?

I'm new to using the server-side behavior in Dreamweaver CS4. I built and tested a PHP based login page on my localhost and it works fine, but it does not work on my Earthlink account. Tech support at EL will not help beyond a certain point.
I loaded my root folder (scc_website) to Earthlink's webdocs folder, but beyond my root folder I'm not sure what else to upload so I uploaded all the folders in htdocs to Earthlinks webdocs:
_mmServerScripts
_notes
_Connections
contrib
forbidden
restricted
scc_website
SpryAssets
xampp
Can someone please offer some advise?
Regards,
Ross H. Capaccio

By default, php suppresses error messages. If you see a blank page, you've encountered an error. During development, you need to adjust the error reporting level. I don't really do php so I'm not sure if there are other ways, but here's a site with a simple explanation.
http://www.stanford.edu/dept/its/communications/webservices/wiki/index.php/How_to_perform_ error_handling_in_PHP
David Powers or one of the other knowledgeable php developers might suggest a different method.

How to configure a form based login page with entitlement role

We need to have login page to our portal app.
When using "form based" authentication is it possible to map the security on a
"entitlement role" ?
Our need is to be abled to give direct url acces to some pages of the portal (for
exemple by sending urls like "http://server/appcontextpath/appmanager/myportal/mydesktop?_nfpb=true&_pageLabel=mypage")"
by email to portal users) and need a simple mecanism of authentication before
redirecting to the portal page.
Inste

Olivier,
You can't reference WLP visitor roles in weblogic.xml, but you can
reference global roles (created using the WLS console):
- <security-role-assignment>
<role-name>PortalSystemAdministrator</role-name>
<externally-defined />
</security-role-assignment>
-Phil
"Olivier" <[email protected]> wrote in message
news:[email protected]..
>
We need to have login page to our portal app.
When using "form based" authentication is it possible to map the securityon a
"entitlement role" ?
Our need is to be abled to give direct url acces to some pages of theportal (for
exemple by sending urls like"http://server/appcontextpath/appmanager/myportal/mydesktop?_nfpb=true&_page
Label=mypage")"
by email to portal users) and need a simple mecanism of authenticationbefore
redirecting to the portal page.
Inste

Need Help for role based authentication

Hi,
I am creating a web application which will run on Linux-apache using jsp and oracle as database.
This web application will show information about customers.
I want to create role based authentication, which has read only access for cuatomers so they can see
only there data, users having readonly access to all customer information also admin user to
add/update/delete information.
please help me.

Can you please explain more on this ? or any resource on internet to help
me.
thanks.

SSL and login form for form based login over ldap

Hello,
i have configured an apache reverse proxy with virtual named host and the the webgate is also running on this server.
On a second server i have configured a webserver with the login form.
Access to the protected ressources is working when i use the following parameters in my Authentication schema
form:/form/login.html
action:/dummy
creds:userid password
ssoCookie:httponly
passthrough:no
SSL Required No
Challenge Redirect http://dummyserver.dummy.org
Changing the SSL required to yes and the url to https has the following result.
After filling out the login form and pressing the submit button "the requested URL /dummy was not found on this server"
Any hints are welcome.
Kind regards

Hi Colin,
Yes the dummy url is protected. Otherwise it should not work when using http.
I assume that i am not redirected back to the origin source. The obSSOCookie should do this in some way, when i remember that correctly.
I can see that the obSSOCokkies are created for both urls but the content is "loggedoutcontinue". Thats the difference to the http communication.
Is there anything else to configure when using SSL with a form based login. Have i missed some basics?
In the documentation it looks really simple - just trning it on - looking for access - and everything works :-)
KR

Changing the default layout , theme for the default login page

Hi All,
I am new to the Portal development.
I would like to change the default themes , and layout of the portal login page,
How to do it. Required to Add or display some News or FAQ's to the unauthenticated users before login itself.Can any body tell me , what is the procedure, How to implement these above functionality
Regards
Vijay

Hi,
Now that the anonymous access solution has been provided, you may like to refer to these links for changing the logon screen and the themes.
Talking about the login page, it depends on what kind of customization do you want to do.
1) Do you want to change it entirely ?
2) Or you want to keep the same layout but change the images ?
Incase you wan to change it entirely, then refer to this weblog : Modifying The Logon Par(or customising the Logon Screen)
And incase you want to change just the images, then go to System Administration -> System Configuration -> UM Configuration -> Direct Editing and change the following paramaters:
ume.logon.branding_image
ume.logon.branding_text
To change the themes and applying them, refer to this document:
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/8d9d9c90-0201-0010-e9a4-ed82031e1908
Hope this helps.
Cheers,
Sunil
PS: Reward points for helpful answers.

Approval work flow for Role based and Resource based

Hi All,
We have to implement approval work flow for the following things in OIM 9.1.0.1
Approval work flow for Functional Roles (Groups in OIM) (Approvalsrequired for users to get these roles)
IT Roles (Resources in OIM) (Approvalsrequired for users to get these resource)
Functional Role (Group) contains policy1,polici2. Polciy1 contains res1,res2 and Policy2 contain res3,res4.I want to create approval work flow for this Functional Role to achieve the following
User raise a request for the functional role, then it should wait to get manager approval. then once its gets approval, that user account should create on all resources which are involved in that group.
And, I have to define approoval work flow for all individual resources to get users account creation on target with approvals. These resources may include in the groups as well.
After getting approval for functional role (Group), then Will OIM starts the approval flow for all resources involved in the group? becase, all resources have approval workflow at resource level also.
My Goal: Approval work flow for Group, should not process the approval work flow for resource. can we do it in OIM 9.1.0.1?
And can we do the same in OIM 11g also?
Please help me and do let me know, if you need any information from my end.
Thanks.

Thats configurable buddy ! ! And possible in 10G and 11G both versions.
Functional Roles : These are the groups/roles in OIM 10g/11g with access policies attached at the backend.
- Create a dummy resource and name it Request Role or anything as you like. Attach an Object Form to it and have form field for Role Name, this would be a lookup type field linked to all OIM groups (leave system values using lookup query). So a user can select any OIM Group in this request as per configuration. Have approval workflows defined on this dummy resource Request Role and in its Provisioning Process make user/s a part of the requested group.
- Now once the user is made a part of the group, the associated access policy would be invoked automatically and thereby provisioning. The only thing you need to keep in mind is that create the access policy without approval (there is a check box). If you do this the approvals would never be invoked even if you assign a group manually to the user coz it suppresses all the approvals in this access policy.
IT Roles : These would be linked to the resource and you can define individual approvals on the resources as required.These approvals would be required if someone raises a request for these resources individually.
Thanks
Sunny

Does anyone have the source code for doing a login page?

I need to do a login page with capture the input from the username and password's textbox on webpage then validate the username and password in the database. If correct then direct the user to the main page, if not, will display a error page.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body bgcolor="#ccff99">
<form name="form1" method="post" action="customercheck.jsp" target="_self">
<p align="center"><strong><font size="5"><U>Customer Login</U></font></strong></p>
<table width="75%" align="center" cellpadding="0" cellspacing="0">
<tr >
<td width="38%" rowspan="2" border="2" bordercolor="#000000" ><div align="center"><strong>New
User? Click here.</strong></div></td>
<td width="21%"><strong>User Name : </strong></td>
<td width="41%"><input type="text" name="username"></td>
</tr>
<tr>
<td><strong>Password :</strong> </td>
<td><input type="password" name="password"></td>
</tr>
<tr>
<td width="38%" bordercolor="#000000"> </td>
<td colspan="2"><div align="center">
<p> </p>
<p>
<input type="submit" name="Submit2" value="Login">
</p>
</div></td>
</tr>
</table>
</form>
</body>
</html>
<%@ page contentType="text/html; charset=iso-8859-1" language="java" import="java.sql.*" errorPage="" %>
<%@ include file="Connections/conn1.jsp" %>
<%
String Recordset1__username = "%";
if (request.getParameter("username") !=null) {Recordset1__username = (String)request.getParameter("username");}
%>
<%
String Recordset1__password = "%";
if (request.getParameter("password") !=null) {Recordset1__password = (String)request.getParameter("password");}
%>
<%
Driver DriverRecordset1 = (Driver)Class.forName(MM_conn1_DRIVER).newInstance();
Connection ConnRecordset1 = DriverManager.getConnection(MM_conn1_STRING,MM_conn1_USERNAME,MM_conn1_PASSWORD);
PreparedStatement StatementRecordset1 = ConnRecordset1.prepareStatement("SELECT cust_id,username, password FROM customer WHERE username='" + Recordset1__username + "' AND password='" + Recordset1__password + "'");
ResultSet Recordset1 = StatementRecordset1.executeQuery();
boolean Recordset1_isEmpty = !Recordset1.next();
boolean Recordset1_hasData = !Recordset1_isEmpty;
Object Recordset1_data;
int Recordset1_numRows = 0;
if(Recordset1_isEmpty) response.sendRedirect("loginagain.html");
String hi = Recordset1.getString(1);
session.setAttribute("id",hi);
session.setAttribute("right","hello");
session.setAttribute("emp_right","tt");
response.sendRedirect("availability.jsp");
//response.sendRedirect("vacancytemp.jsp");
%>
<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
</body>
</html>
<%
Recordset1.close();
StatementRecordset1.close();
ConnRecordset1.close();
%>

Design pattern for role based workflows

Hello,
I'm new to APEX and I am wondering whether it is easily possible to design a multi role workflow application without creating a new page for each workflow step.
I'll try to explain what I mean:
Assume we have 2 roles and a workflow with several steps. The 2 roles work on one single document, and they complete it step by step. In each step, additional information is added to the document by one of the roles while information already entered is visible, but cannot be changed any more (except if the user goes one step back to a state where the information can be edited).
Is there an easy way to define such a flow of steps (which can be modeled by a state machine) ?
Is there an easy way to define which fields in a page are visible or editable depending on the current step (i.e. on the state of the document) ?
Is there an easy way to define which fields in a page are visible or editable depending on the role of the user ?
Maybe you can point me to some documentation or give me some APEX specific key words as a hint.
Thank you,
Markus

I am wondering whether it is easily possible to design a multi role workflow application Depends on your definition of easily ;-)
>
I'll try to explain what I mean:
Assume we have 2 roles and a workflow with several steps. The 2 roles work on one single document, and they complete it step by step. In each step, additional information is added to the document by one of the roles while information already entered is visible, but cannot be changed any more (except if the user goes one step back to a state where the information can be edited).
Is there an easy way to define such a flow of steps (which can be modeled by a state machine) ?
>
Not clear on what's really involved here. Could you expand on what you mean by "document"? What's involved in completing a step? Do you have an existing implementation of a "state machine"?
without creating a new page for each workflow step.Can you clarify this requirement? All steps in a workflow are shown on one page? Or you want a generic workflow application (based on an underlying flexible data model/"state machine"?) rather than an APEX application that automates one particular workflow?
Is there an easy way to define which fields in a page are visible or editable depending on the current step (i.e. on the state of the document) ?Yes. See Conditional Rendering and Processing and Displaying Read Only Page Items.
Is there an easy way to define which fields in a page are visible or editable depending on the role of the user ?Yes. See Authorization.

How to access sys owned objects for role based web user?

Hi,
we have tables and packages etc owned by test schema user, and we access the applications using mod pl/sql though DAD. we created a webuser role and granted the execute privillages to webuser role. we have some packages that we access sys owned such as dbms_random, which test user has execute privillage. how i can get these privillages to webuser? I dont like to give webuser execute privillages over web. any other thoughts and insights would appreciated.
Thanks for the help!

use invokers rights instead of definers rights and you won't need 'direct' grants anymore.
create or replace procedure foo authid current_user is
begin
dbms_random....
end;
Sybrand Bakker
Senior Oracle DBA

Design Pattern for Role-based GUI

Hi,
I'm looking for a java design pattern to provide different GUI according to the user role.
For example, If logon user has general user role, the GUI would disable some administrator related menu items...
I think, this kind of functionality is now in use at many applications..
Thanks in advance..
Habin

Hi
I try to explain with some more detail (sorry for my bad english) :
I write a complete hotel reservation app with Java+Bd (relational). This app is used by diferent users types.
The administrator has all privileges (can do every action) and other users can do only some actions (make a reservation, check-in, check-out etc but not modify a
room price for example).
The app is a MDI app, there are a menu and menuitems
and when a user do an actionEvent over a menuItem an InternalFrame is activated and so on. These InternalFrame make possible some actions at app level (ex. : do a check-in).
The menuItems set is controled by the App (is the Controller in MVC design pattern) and the model is represented by a set of user possible actions; so there are a class (UserConfig) with these set of possible actions.
the Controller ask UserConfig abouth the posible action
set and do the enable/disable job. There are a 1 to 1
relationship : each possible actions has a menuItem. And
there are a M to N relationship from User/Action perspective.
With this design (I think is an MVC design) the Controler mantain a UserConfig (via a Relational Database) and the Administrator (via the App) can create or modify the UserConfig objects.
At implementation level, each menu item has a name, and
for each registered user there are the name/id_user pair
of actions. These info (stored in BD) is used to create
the UserConfig objects (via username/password).
Bye

Is JSF a good candidate for Login pages?

Hi all,
In a JSF-based web app, should the login page be JSF-based at all? It seems any JSF page assumes we have a live session, with the component tree and all that stuff. But before a user is logged in, there may not be a session. If a JSF login paged is used, I encounter problems with my session timing out, causing the page to simply refresh itself when you login. Then the user has to login a 2nd time to be successful.
Should I use a simple JSP page? Is there any way a JSF-based login page will work?
Thanks,
Eric.

Eric, JSF works just fine building a login page. If you have webserver sessions enabled, as soon as an user requests a page a session is created, so there will be a session active for the first view of the login page.
Sessions timing out have little to do with JSF per se; is the user waiting for longer than your timeput period before clicking OK on the login page? Are you mixing JSP/JSTL/JSF in non-allowed ways?
As an aside, consider saving an authentication token client-side so you can restart sessions (with checks for IP, etc), and using a servlet filter to check for logged-in ness
Regards,
--A

Role based data visibility is not working in Round manager

I am looking for role based data visibility in Syclo round manager application where technician will see the data which is assigned to his name only (not all the data) I have created one custom role in SAP system and it's working fine .It's showing the below message :
Now I want to implement the same in syclo round manager .So I went to the SAP configuration panel and set the same user role on the security setting in class handler .Z_SYCLO_RM_ROLE is the custom role which I mentioned earlier .I tried with different option in this tab but it's not working .
Please let me know if I missed something to mention or is there any other process I need to follow .
Tags edited by: Michael Appleby

is not working Insufficient information. In what way is it "not working"? The page doesn't render as required? There's an error message? The browser crashes? The server room has been trampled into dust by a herd of buffalo?
>
I am unable to make it as page form / report.
v1 := v1 || ' ' ||'<input inline type =submit style="color:BLUE;background-color:RED" value='||c2.plot_id||'>';
...It is not possible to generate form elements in an APEX page in this way. The [APEX_ITEM API|http://download.oracle.com/docs/cd/E14373_01/apirefs.32/e13369/apex_item.htm#CACEEEJE] is the only way to create APEX items in PL/SQL. However it contains no procedures to generate button items, so an alternative design is required in this case, e.g. a report with links.
(Also what is the intention of "inline" in the above code? [There is no *inline* attribute|http://www.w3.org/TR/1999/REC-html401-19991224/interact/forms.html#h-17.4].)

Tomcat problem with form based login

Hi,
I have a page for form-based login, but the problem is that the image and css files dont load on the login page request. What I gather from other discussions is that this is because these are still protected when the page is requested. How do I exclude them from being protected.
Nirav

Hi tolmank,
Earlier I just filtered out the login page and images based on the extension, but now I am trying the second approach i.e. making a protected directory, but my application does not start. When i start it from the tomcat manager, it gives me this error,
FAIL - Application at context path /<app dir> could not be started
<web-resource-collection>
     <web-resource-name><app dir></web-resource-name>
     <url-pattern>/protected/*.jsp</url-pattern>
</web-resource-collection>
<login-config>
     <auth-method>FORM</auth-method>
     <form-login-config>
          <form-login-page>Login.jsp</form-login-page>
          <form-error-page>Error.jsp</form-error-page>
     </form-login-config>
</login-config>
what could be wrong?

JSF/JAAS j_security_check for role-based login pages

Similar Messages

Maybe you are looking for