JSF restricting direct URL access

I have created a servlet that checks to see if the user is logged in and hidden it in a .jspf and included that fragment into each page. It seems to work ok in most pages but.....
If I have a page that contains selectOne lists that are populated via another managed bean. The program seems to be trying to process out the entire page before the redirect occurs, and if the list is based on a logged in user I of course am getting a nullpointer exception.
My question is: Is there a way to short-curcuit the JSF lifecycle based on the fragment. If the user is not logged in I do not want the lifecycle to continue but to redirect to the logon screen.
Any ideas will be appreciated. If anyone knows of a better way by all means let me know. This is the first major JSF project I have been involved with.
Thanks,
Thom

Hi Suvidha,
thanks for your reply. Indeed I tried using this technique already. On our project we are using this to send links in Emails. This way the user can directly access all information in CRM.
For the interested reader: SAP has at least some documentation on this one. It is freely available form the [Service Market Place|https://websmp203.sap-ag.de/crm-inst]. [DirectLink|https://websmp203.sap-ag.de/~sapdownload/011000358700001715762008E/Cookbook_Ex_Comp_CRM2007.pdf]
Anyhow, the result for me can be described as rather odd:
- WebClient opens in a new session. --> Logon necessary
- WebClient opens not just the single component, but the whole UI Frame. Meaning: NavBar, WorkArea, Header, BreadCrumbs, MessageArea
- As I tried to put the result into a DIV, it rendered not as 800*600 as statically specified but as some thumbnail
What I do need is just the component as the test in the component workbench does open it. It has to be same session.
I got a little spare time today so I guess I will start fiddling around again. My best guess is, that I can somehow initialize a component usage and then open it via a bsp call an a page with flow logic. For this it is no problem to get a URL
cheers Carsten

Similar Messages

I accessed the page protected by ADF security using direct url access attac

hi,
I played with my application which is based on SRDemo code (with added ADF security handling protection of resources) using direct url access scenarios. I was able to access a protected page as authenticated but not authorized user. I'll try to explain what I did.
There are two folders/web resources in my application, faces/folderA/* and faces/folderB/*.
roleA only is configured to access first web resource and the roleB is configured to access the second resource.
I used ADF security to authorize only roleA for page in folderA and to authorize only roleB for page in folderB.
I configured error pages in web.xml:
<error-page>
<error-code>400</error-code>
<location>faces/error/error400.jspx</location>
</error-page>
<error-page>
<error-code>401</error-code>
<location>faces/error/error401.jspx</location>
</error-page>
<error-page>
<error-code>403</error-code>
<location>faces/error/error403.jspx</location>
</error-page>
<error-page>
<error-code>404</error-code>
<location>faces/error/error404.jspx</location>
</error-page>
<error-page>
<exception-type>java.lang.Throwable</exception-type>
<location>faces/error/error500.jspx</location>
</error-page>
Other config params are:
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>infrastructure/ABLogin.jspx</form-login-page>
<form-error-page>faces/error/error401.jspx</form-error-page>
</form-login-config>
</login-config>
<security-constraint>
<web-resource-collection>
<web-resource-name>AB Prototype</web-resource-name>
<url-pattern>faces/ABAbout.jspx</url-pattern>
<url-pattern>faces/ABHelp.jspx</url-pattern>
<url-pattern>faces/ABLogout.jspx</url-pattern>
<url-pattern>faces/ABWelcome.jspx</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>A</role-name>
<role-name>B</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>AZone</web-resource-name>
<url-pattern>faces/folderA/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>A</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>BZone</web-resource-name>
<url-pattern>faces/folderB/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>B</role-name>
</auth-constraint>
</security-constraint>
<filter>
<filter-name>adfBindings</filter-name>
<filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
<init-param>
<param-name>unauthorizedErrorPage</param-name>
<param-value>faces/error/error401.jspx</param-value>
</init-param>
</filter>
<filter>
<filter-name>adfFaces</filter-name>
<filter-class>oracle.adf.view.faces.webapp.AdfFacesFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<url-pattern>*.jspx</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<url-pattern>*.jsp</url-pattern>
<dispatcher>FORWARD</dispatcher>
<dispatcher>REQUEST</dispatcher>
<dispatcher>ERROR</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<url-pattern>*.jspx</url-pattern>
<dispatcher>FORWARD</dispatcher>
<dispatcher>REQUEST</dispatcher>
<dispatcher>ERROR</dispatcher>
</filter-mapping>
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet>
<servlet-name>resources</servlet-name>
<servlet-class>oracle.adf.view.faces.webapp.ResourceServlet</servlet-class>
</servlet>
<servlet>
<servlet-name>adfAuthentication</servlet-name>
<servlet-class>oracle.adf.share.security.authentication.AuthenticationServlet</servlet-class>
<load-on-startup>2</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>/faces/*</url-pattern>
</servlet-mapping>
Once I authenticated as user in roleA I was trying to directly access URLs accessible only by users in roleB. In the beginning everything worked OK: I was dispatched to error401.jspx page with message Not authorized... etc.
But I kept trying to access different URLs, like http://localhost:8988/AB/faces, http://localhost:8988/AB/faces/folderB, http://localhost:8988/AB/faces/folderB/pageB.jspx, http://localhost:8988/AB
(not necessarily in that order, I played for a couple of minutes and the system would always dispatch to error401.jspx page if unauthorized attempt. But all of sudden, to my surprise, I got the pageB.jspx page while logged in as user belonging to roleA!)
Not sure how that happened but the connectedUser on pageB (#{userInfo.authenticated}) shows that I am logged in as user whose role is A.
I checked Authorization in ADF security and it is still correct: pageB is only accessible to roleB and pageA is only accessible to roleA.
I hope I made some stupid mistake in my configuration?

Hi,
ADF Security is JAAS permission based and not container managed. Note that unless you explicitly configured ADF Security you don't use ADF Security but container managed security, which is all that I can see in your configurations.
Not sure which version fo JDeveloper you use, but if you could change the following setting
<security-constraint>
<web-resource-collection>
<web-resource-name>AZone</web-resource-name>
<url-pattern>faces/folderA/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>A</role-name>
</auth-constraint>
</security-constraint>
<security-constraint>
<web-resource-collection>
<web-resource-name>BZone</web-resource-name>
<url-pattern>faces/folderB/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>B</role-name>
</auth-constraint>
</security-constraint>
to contain jspx file references instead of wildcards like in faces/folderB/* then what you see should no longer be possible. There was a known issue with the security settings in SRDemo that was caused by a defect in OC4J container managed security. I would expect this issue to be fixed in a more recent version of OC4J.
However, the work around until then is to protect all JSPX files in a directory instead of using wild card matches
Frank

SRM 7.0 business object / individual procurement document direct URL access

Hello,
While our Basis team is configuring the Portal integration with our newly upgraded SRM 7.0 system, I am wondering if it's possible to take a sneak peak at the business object on the WebDynpro screen, for example, via SICF webdynpro service, such as
/default_host/sap/bc/webdynpro/sapsrm/wdcc_v_rfq_puchaser
After activating all relevant services (as far as I understand), I tried to access the following URL directly on the browser:
https://<server;domain>:<port>/sap/bc/webdynpro/sapsrm/wdcc_v_rfq_purchaser?sap-client=010&sap-language=EN?
I encountered the "Access via 'NULL' object reference not possible" exception on the web page. I think it's due to the missing object type and object id reference on the HTTP parameters. But what are the parameter name(s) that are required on the URL? Does anybody have the experience in accessing an individual document through direct URL?
Thanks,

This question has been answered by the following blog:
/people/ulli.hoffmann2/blog/2009/10/07/srm-70-running-it-without-the-portal

Content Administration - KM Content workset direct url access

Hi,
As we know we have KM Content workset under Content Administration. When I right click and select "Open in new Window" for "KM Content" again Home page is opening.
How can I get the url to access directly "KM Content" page?
Please let me know if any body has an idea to get this.
Thanks

KM Content is a workset under Content Administration role
You can directly acess the workset using Quick Links.
Navigate to content admin->portal content. in that pcdcontent->content provided by SAP->Admin content-> conent administrator->worksets.
There you find the KM content. dupicate that in to your folder and open as object
and Set the 'quick links' property as km_content
then below url will directly access the KM content (provided you are having conent admin role).
http://<FQDN>:<port number>/irj/portal/km_content
Raghu

Open project Activities tab by direct URL in P6 8.1 Web Access

Hello!
I'm trying to access project workspace in P6 Web Access v 8.1 by direct URL from another HTTP resource.
But P6 redirects me to another dialog (for choosing project from the list) if project is not opened before by clicking command Open from menu.
Does anyone know how to prevent the opening of a project selection dialog and go directly to the page of the project activities?
Now im using this format of URL:
http://primavera:7777/p6/action/pm/activities?projectId=1000&wbsId=20000&ProjectName=null&checkTabs=true

I face similar issue and as work around i copied the user profile and created new user.
It works fine with new user profile.
I think it happens sometimes we check new tab before loading previous one and because of that user profile get corrupt.

Navigation Target : Nav URL : Accessing an Iview directly

Hi,
I have a BI portal as producer fedearetd to NWP consumer.
I want to provide a direct URL of an iview located on producer portal to the customer accessing consumer portal.
I can see there is this way, creating a nav URL...but not sure how can I do that?
http://<xyz>/irj/portal?NavigationTarget=navurl://<f1bfd4df279ecf27d95ce39cd28d307c>
can anyone please guide,
How to access producer portal iview directly on consumer portal
How to get the nav url ie. <f1bfd4df279ecf27d95ce39cd28d307c>...what is this keycode stands for?
Awaiting reply!
Thanks,
Smita Thorat

Hi Smita,
As shown below, the PCD path of the portal object is the Navigation target.
http:/myServer:50000/irj/portal?NavigationTarget=ROLES://portal_content/myFolder/myRole
This can be hashed and shortened to form the Short URL as shown below
http:/myServer:50000/irj/portal?NavigationTarget=navurl://b3d6d9ebac16a46574d62757803b05d4
Short URL can be enabled and disabled depending upon the requirements.
Check the links below for detail description to enable short URL:
http://help.sap.com/saphelp_nw70ehp2/helpdata/en/43/014421d21d6fade10000000a11466f/frameset.htm
http://help.sap.com/saphelp_nw70ehp2/helpdata/en/49/330b66fd695aa8e10000000a42189d/frameset.htm
Hope it Helps.
Regards,
Khushboo

Unauthorised users accessing iviews through a direct URL

Hi,
How do you prevent unauthorised users from accessing iviews through a direct URL? e.g. From the BeX Web Template on testing a query a URL is known, this URL can then be used by user who have no rights to view/ execute this report (after portal logon).
Can security zones be defined for the BeX iviews? If yes, how? Does setting the parameter Dcom.sap.nw.sz=true solve the problem?
Appreciate your input.
Many thanks,
Dharmi

Hi Bharath,
Thank you for the input.
Can you please be more specific as to which BW component ?
I navigated to
Go to permission editor: 'System Administration' -> 'Permissions' -> 'Portal Permissions'.
folder: 'Security Zones' -> 'sap.com' -> 'NetWeaver.Portal' -> 'high_safety'
There the rights are ok.
Best regards,
Dharmi

Restrict URL Access when linking from report

I have an application that will be a little like a wizard in that I need to control how users get to a form, so I would like to prevent them from being able to just going straight to that page and entering data into the form. I tried using various session state security options, including No URL Access, but that blows up when I try to link from a report to that form for editing purposes.
Is there some way I can link from the report if the target page restricts URL access, and can get a get a brief overview (or point me to some documentation) on the various branch types? I can't find a good explanation anywhere and I'm hoping that solves my problem.
thanks.

Hi,
1.
What about using an Authorization Scheme and then using Security of Page Attributes.
In fact it is schema of users, roles, and passwords.
2.
f?p=App:Page:Session:Request:Debug:ClearCache:itemNames:itemValues:PrinterFriendly
f?p=6000:6004:&SESSION.::NO:6003:MY_ITEM1,MY_ITEM2,MY_ITEM3:1234,,5678
This example:
* Runs page 6004 of application 6000 and use the current session ID
* Clears the current session's cache for items on page 6003
* Indicates debug information should be hidden (NO)
* Sets the value of MY_ITEM1 to 1234, sets the value of MY_ITEM2 to null
(indicated by the comma used as placeholder), and sets the value of MY_ITEM3 to 5678
- Into Column Attributes/Column Link/Link Text pick an icon.
- Select for Attributes/Column Link/Target “URL” for table Emp_Address and into URL field type:
javascript: popupURL('f?p=&APP_ID.: 6004:&SESSION…………');
You can use the value of any Item. Then in the URL link page check that item.
Moreover, you can use f?p=&APP_ID.: 6004:&SESSION…..My_Item:#ReportColumnName#.......
I hope this would help.
Konstantin

Accessing the Permission,Properties and Subscription tab with Direct URL.

Hello,
I am trying to accessing the permission tab with direct url, but i could not able to find a way to access it.
we can access this permissions tab browsing through Details - > Settings -> Permissions , the similar way Details - > Settings -> subscriptions.
But i wanted to use a single(i.e direct url) which can open these tabs.
Could you please help me on this.
Thanks
Best Regards
Manoj K

Hello,
I have resolved this issue by myself.
You can access the subscription interface directly using the below url.
http://<hostname>:<port>/irj/go/km/details/documents?isp=subscription&Standalone=true&StartPage=StandaloneDetailsPage
or
https://<hostname>:<port>/irj/go/km/details/documents?isp=subscription&Standalone=true&StartPage=StandaloneDetailsPage
And for the properties interface by using the below url.
http://<hostname>:<port>/irj/go/km/details/documents?isp=properties&Standalone=true&StartPage=StandaloneDetailsPage
For the permissions interface.
https://<hostname>:<port>/irj/go/km/details/documents?isp=permissions&Standalone=true&StartPage=StandaloneDetailsPage

Access Web Dynpro Java application through direct URL

Hi Guys,
we have a requirement that there is a link in web dynpro abap screen, click on it will open a new ie window running web dynpro java application, so what i did is i have given direct url link for that web dynpro java application:
as this:
https://servername:50001/webdynpro/dispatcher/sap.com/ess~lea/TeamView
but after i clicked on this url, it pop up 1 window, after i entered id & passoword, it is showing this wd java appl, but there is 1 grey image on top of the view & "welcome xxxx"; below that is the actual view from wd java.
the layout is :
grey image----
welcome xxxxxxxx
Teamview
actual ivew
how to remove the grey image & the "welcome xxx"? it looks like masthead but we dun need it.
thanks

Hi Feng,
Actually what you are seeing using the application URL and after giving the credentials on Portal is a portal screen which carries the theme as well. Therefore, you will be able to see the masthead with header and Portal User Name. So, use the URL generated by preview of a web dynpro iView in your component to avoid the masthead.
Regards,
Tushar Sinha,
Infosys,
Hyderabad

Filter on the reports created using DIRECT DATABASE ACCESS in obiee 10g

How do i filter on the report that is created by using DIRECT DATABASE ACCESS in obiee 10g?
I have reprot A with link to report B, report B is created using DIRECT DATABASE ACCESS. so it is just a table, but i need to filter out 2 columns.
here is the query in REPORT B:
select strm, acad_group, crse_id, class_section, count(emplid) from v_crse_enrl
group by crse_id, strm, class_section, acad_group;
the link in REPORT A:
'<a target="_blank" href="'||VALUEOF("bi_link")||'Go&Path=CF_CROSS_TEACHING_LIST&ACTION=Navigate&col1=STRM&val1='||view1_DIMEN.STRM||'&col2=CLASS_SECTION&val2='||TRIM(view1_DIMEN.CLASS_SECTION)||'">' ||view1_dimen.class_id||'</a>'
from this link to report B.
thank you!!

I didnt tested using url, but the same works with using presentation variables.
To your direct sql add where clause for those two columns like WHERE col='@{col1}' and col ='@{col2}'
and try to run from url.
let me know updates

I want to display a jsf page directly.

I want to display a jsf page directly. In my project I am using jsf frame work and we are using org.apache.myfaces.component.html.util.ExtensionsFilter to redirect the request to the login.jsf. please any one help me on this.

my requirement is I have to display a jsf page which is there in the project directly, without going through login page. Right now Iif i am trying to open it in browser directly, it is redirecting to login.jsf. I have following 'extensionsFilter' content in web.xml
<filter>
<filter-name>extensionsFilter</filter-name>
<filter-class>org.apache.myfaces.component.html.util.ExtensionsFilter</filter-class>
<init-param>
<param-name>uploadMaxFileSize</param-name>
<param-value>100m</param-value>
<description>Set the size limit for uploaded files.
Format: 10 - 10 bytes
10k - 10 KB
10m - 10 MB
1g - 1 GB
</description>
</init-param>
<init-param>
<param-name>uploadThresholdSize</param-name>
<param-value>100k</param-value>
<description>Set the threshold size - files
below this limit are stored in memory, files above
this limit are stored on disk.
Format: 10 - 10 bytes
10k - 10 KB
10m - 10 MB
1g - 1 GB
</description>
</init-param>
</filter>
<filter-mapping>
<filter-name>extensionsFilter</filter-name>
<url-pattern>*.jsf</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>extensionsFilter</filter-name>
<url-pattern>/faces/*</url-pattern>
</filter-mapping>

Remote connection via http connection-URL access

Hello all,
I would like to connect to the customer Business object system from our solution manager. The customer has configured http connection and has opened the connection in marketplace and has maintained http connection-URL access. The URL has also been maintained.
I have added the corresponding entry also in my hosts file. But i am not able to access the customer URL.
Anyone please tell me how to do remote connection for the connection type "http connection - URL access".
Thanks,
Aishwarya.

Hi Tim,
I am getting "The page cant be displayed" error while trying the BO system's URL in my browser.
Please tell me which of the below methods i can use:
1. By directly connecting to the BO system URL from the browser (is it possible?)
2. By using VPN connection
3. By installing diagnostic agent in solution manager
4. By following the steps in this link:
Establishing a Connection Using a Destination (SM59) - Components of SAP Communication Technology - SAP Library
Regards,
Aishwarya.

Can't activate direct data access for VProvider

I try to activate direct data access for BC VirtualProvider 0TR_CM_1. When I open "Activate Direct Access" dialog I don't see any assigned source systems in "Source Syst. for InfoSource 3.x" nor any in "Data Transfer Processes" tabs. Does it mean what non of source systems don't have direct access data sources? Or in other words - why I can't assign any source system for the BC VProvider?

Hi,
While creating datasource there is an option for direct access.This option shows if the DataSource supports direct access to data.
A RemoteProvider in BI can only get data from a DataSource that supports direct data access.
It is only useful to access data directly if the quantity of data to be extracted can be restricted to a suitable selection.
Hope this helps
Regards
Karthik

URL Access Policy - Administration Guide

Hi,
I'm working my way thru the Administration Guide and I'm looking at the URL
Access Policy. I added a URL to allow (http://www.yahoo.com) and a URL to
deny (http://www.sportsline.com) for my user fooUser in MyDomain_1. I then
login the IP Portal as fooUser.
What form of the URL is the Bookmarks URL entry box expecting? I have tried
the following and gotten the corresponding results:
http://www.sportsline.com access allowed
http://www.yahoo.com access allowed
http://myServer:myPort/http://www.sportsline.com page cannot be found
http://myServer:myPort/http://www.yahoo.com page cannot be found
http://myServer:myPort/www.sportsline.com page cannot be found
http://myServer:myPort/www.yahoo.com page cannot be found
I also tried http://myServer:myPort/MyDomain_1/www.sportsline.com and got
page cannot be found
Can someone shed some light on this for me?
Mike

You should be able to just put in the URL as you normally would.
Now, if you are running through the SRAP gateway (versus "open mode")
the url that should be launched in your browser should automatically append
the url to your gateway, with some characters escaped, so it would be (I hope
this doesn't get converted to a link!)
http://myServer:myPort/http%3A//www.sportsline.com
But! (I'm not 100% on this). If the website is not in your domain, the gateway
does not care. It will let you access it, as it is implicit that you could open
a separate browser window and access the site directly.
In open mode (without the gateway), basically, everything is open, so
it doesn't make much sense to be able to block it. If you don't put it
in the URL Bookmarks box, then you could just open a new browser
window and access it directly!
ws
Mike Wallach wrote:
Hi,
I'm working my way thru the Administration Guide and I'm looking at the URL
Access Policy. I added a URL to allow (http://www.yahoo.com) and a URL to
deny (http://www.sportsline.com) for my user fooUser in MyDomain_1. I then
login the IP Portal as fooUser.
What form of the URL is the Bookmarks URL entry box expecting? I have tried
the following and gotten the corresponding results:
http://www.sportsline.com access allowed
http://www.yahoo.com access allowed
http://myServer:myPort/http://www.sportsline.com page cannot be found
http://myServer:myPort/http://www.yahoo.com page cannot be found
http://myServer:myPort/www.sportsline.com page cannot be found
http://myServer:myPort/www.yahoo.com page cannot be found
I also tried http://myServer:myPort/MyDomain_1/www.sportsline.com and got
page cannot be found
Can someone shed some light on this for me?
Mike

JSF restricting direct URL access

Similar Messages

Maybe you are looking for