LDAP or RDBMS for J2EE Security Configuration

I like to know if LDAP or RDBMS will be good in configuring J2EE applications Security and the reasons for that.
With LDAP, i am creating new groups as new applications come. I can very well do the same in RDBMS. Plus, the advantage of keeping groups in RDBMS give me the ability to associate those group information to any other information in RDBMS.
I do see every company going towards LDAP to store J2EE applications security groups.
I appreciate the advantage of keeping user information in LDAP so that all applications and network can share that. But keeping groups information for each application in LDAP make things impossible to associate those groups to other information in RDBMS.

ps. any to the point literature on end-to-end java-based architectures (online or printed)?Maybe you could take a look at the J2EE blueprint resources at http://java.sun.com/blueprints/enterprise/index.html.

Similar Messages

Using dynamic groups for j2ee security

Hi all,
I have my realm setup in server.xml and my standard and sun-specific deployment descriptors setup for j2ee security.
Everything seems to work fine for groups defined via uniquemember attributes (all users are specified), but I'm having trouble with dynamic groups (defined with the memberurl attribute)
How do I configure my realm in my server.xml to get this working?

Hi,
I got an official answer from SUN.
"Dynamic Groups" are not (longer) supported with SJS AS 7!
It will probably be supported with SJS AS 8 SE.
If you have a iPlanet 6.5 application that is running with dynamic groups, just wait a little bit before you migrate.

J2ee project: ldap or rdbms for users?

Hi,
I am about to design and implement a java-based product-quality (already have a working proof-of-concept) web service with the following components:
-ejb (session+entity) back end talking to a mysql db
-web client (browser) using servlets (possibly also JSF) to access session ejb.
-j2me personal profile client (using soap to talk to the back end) (PDA client)
While this service is not an online store, i suppose the design and requirements would be somewhat similar: personalized, scalable, secure and reliable. DB queries will be small in size (2-250k, vast majority 2-50k) but frequent. as with many personalized online services, users will have accounts which they will create themselves. Scalability will be important (potentially into several million users, though initially no more than 10,000), so some form of clustering will probably be needed.
Here's where i need some advice:
-should i utilize LDAP to store and access user information (e-mail, address, and encrypted passwords) or should i just these as columns to a table in my DB schema? what would be advantages of each approach?
-where should i store session information? specifically: currently i utilize stateless session beans, so session info is stored:
-in servlet's HttpSession when service is accessed through browser
-in Personal Profile application, when service is accessed via PDA
It seems to me this way i reduce load on the app server as well as network traffic (in PDA's case). Would storing session info in a stateful session bean be any better? Why?
thank you very much,
-nikita
ps. any to the point literature on end-to-end java-based architectures (online or printed)?

ps. any to the point literature on end-to-end java-based architectures (online or printed)?Maybe you could take a look at the J2EE blueprint resources at http://java.sun.com/blueprints/enterprise/index.html.

Application security for J2ee application

Hi All,
This posting is not for code help, but just to get knowledge of how can something be designed in different ways
The way the security model is implemented is mostly database driven
There are
1)USERTABLE
2)GROUPTABLE
3)ROLETABLE
4)GROUP_ROLE_ACCESSTABLE
5)USER_GROUP_TABLE
tables 4 and 5 are association tables..and the security is at menu and button level.
So when a user logs in after authenticated by LDAP process, A bean named userinfobean is created, which has a map taking role name as key and a boolean as value.
So on JSP's for button level securities somthing like this is used.
<%if(userInfoBean.hasAccess("ROLEA"){%>
show button <%}%>
where hasAcess(String role) checks the maps and return the boolean value attached to that role
My question is can someone share their experinces about what are the possible different ways to implement this using j2ee security API's or declaring them in descriptor.
Thanks in advance

Personally i would use Struts in this case and override the process roles method. Thsi way the code stays out of the JSP file
Frank

How to install and configure configure IGS for J2EE server 700

Hi,
Please help me in installing and configuring IGS for J2EE server700 as i need it to run Business Graphics for my Web DynPro application. Earlier i had installed J2EE server 640 and i didnt have to do any separate installation for IGS. I just had to configure the IGS URL from Visual Admin. But i can't find any igswd.exe running on my J2EE700 engine.
Please let me know the procedure for this.
Thanks an Regards,
Smriti.

Hi,
Check the below link,
<a href="http://help.sap.com/saphelp_nw04/helpdata/en/17/86c039c7811f11e10000000a114084/frameset.htm">About IGS Configuration and Adminisatration</a>
Regards,
Suresh.T

How to find solution for avoiding WARNING J2EE SECUR-00100 ********** user-manager (see application/server descriptors) will no longer be supported in the next release of this product

HI All,
We are using Oc4j version 10g 10.1.3 , and while starting conatiner getting below warning , let me know if anyone have solution for this,.
14/01/10 01:01:29 ********** user-manager (see application/server descriptors) will no longer be supported in the next release of this product!
Please take the appropriate actions to migrate to an alternative strategy! **********
2014-01-10 01:01:29.833 WARNING J2EE SECUR-00100 ********** user-manager (see application/server descriptors) will no longer be supported in the next release
of this product!

I just checked my BIOS and my current setting is set at IDE although it also mentions that the default should be AHCI. Currently I have a dual boot of Windows 7 (need it for Tax software) and Arch
So I guess, when I get the new HDD, I will first set it to AHCI and then install the OSes on it. See if NCQ helps any, and if not I will turn it back and re-install (if I have to). I am planning to have Windows only in virtualbox in the new drive.
Anyhoo, while I was in the BIOS I found two things which I had questions about :
1) Under Onboard Devices --> Integrated NIC , my setting is currently set at "On w/PXE" and it says the default should be just "On". Would it be ok to change it back to On since its a single machine and its not booting an OS on any server. I just don't want to have to re-install anything now since I will be doing that in the new HDD.
2) How would I know whether my BIOS would support a 64 bit OS in Virtualbox? I checked some setting under Virtualization, but they weren't very clear.
I will edit this post and let you know exactly what settings were present under the Virtualization sub-section.

Enable the security configuration for this panel

Why do my panels built with Configurator sometimes display
this in Ps Cs4?
"Please close all panels or restart Photoshop to enable the
security configuration for this panel"
Closing panels or restarting Photoshop does not enable the
panels but exporting from Configurator does enable them. Why do I
have to keep exporting?

I believe I have stumbled on the answer to this problem, so I
would like to pass it along to any other users who have a similar
problem.
My experience is that this is an intermittent problem, so I
asked myself what do I do from time to time that could be causing
this difficulty. The answer is I use a program called CC cleaner to
clean out temporary files (that in theory I don't need). I found
that after running CC cleaner, I have to re-export the
configuration file (as I get the error message described in an
earlier posting) so that the configurator panel subsequently opens
properly when I open up C S 4.
I immediately ran CC cleaner again and found that it wanted
to delete only one group of files that were located in the
following folder:
C:\Documents and settings\user's name\application
data\Macromedia\flash player\*.*
Accordingly, I instructed " CC cleaner", to exclude this
folder and everything in it (from deletion):
Now if I run CC cleaner to get rid of all my temporary
Internet files and other temporary files, but it leaves the above
folder untouched, and so far the configurator panel opens up
properly in Photoshop.
I don't use Windows "disk cleaner" so I'm not sure whether or
not this cleaner represents a potential problem. In any event it's
the Macromedia folder described above that causes the problem.
It's clear that Adobe configurator uses Macromedia flash to
do its thing, so hopefully I've solve this problem
long-term.

Configuration file for pkcs11 security provider

Hi all,
I'm using Mandriva 2008.0 . In the jdk 1.5.0 documentation, it is given that, the security provider pkcs11 can be configured statically by adding an entry, as shown below, in the java.security file present in the directory jre/lib/security/.
*# configuration for security providers 1-6 ommitted*
security.provider.7=sun.security.pkcs11.SunPKCS11 /opt/bar/cfg/pkcs11.cfg
Where can I get the configuration file (pkcs11.cfg) from? Please direct me how to proceed.
Thanks.

Hi,
I went through that Java SE6 documentation link. It describes the contents of the configuration file for pkcs11. But I couldn't find the information of where can I get the configuration file for pkcs11 security provider from.
Thanks.

Configuring Internal DELL RD1000 for Oracle Secure Backup

Hi all,
I have a Dell R710 server running Solaris 10 9/10 which has an internal Dell RD1000 drive. I intend to use this as a target for Oracle Secure Backup but am so far unable to configure the solaris sgen driver to see it as a valid tape/scsi drive.
iostat -En reveals the ff
c2t0d0 Soft Errors: 0 Hard Errors: 0 Transport Errors: 0
Vendor: DELL Product: RD1000 Revision: 0053 Serial No:
Size: 160.04GB <160037691392 bytes>
Also after reboot
-bash-3.00# dmesg | grep -i RD1000
Feb 21 22:02:10 genunix: [ID 846691 kern.info] model DELL RD1000
however after following the installation guide i am still unable to see any /dev/scsi/changer or /dev/scsi/sequential directories.
Any help will be greatly appreciated.
Thanks

I don't know about this tape not appearing to the OS, some other OS related documentation would help you there. This may be due to the fact that this is a removable disk storage device, rather than actual tape.
However I have checked the OSB tape support matrix and this device is not listed, so this is not supported for use with OSB.
Thanks
Rich

Authorization check for caller assignment to J2EE security role

Dears experts, in the default.trc logs in, my Enterprise Portal NW2004s, appear this error:
#1.#0018714E4A14005E000027E1000057B8000441BB7EF2FC03#1198173451524#com.sap.engine.services.security.roles.SecurityRoleReference#sap.com/irj#com.sap.engine.services.security.roles.SecurityRoleReference#Guest#2126####46ce8210aefd11dcc68f0018714e4a14#Thread[Thread-59,5,SAPEngine_Application_Thread[impl:3]_Group]##0#0#Error#1#/System/Security/Audit/J2EE#Java###: Authorization check for caller assignment to J2EE security role [ : ] referencing J2EE security role [ : ].#5#ACCESS.ERROR#service.jms.default.authorization#administrators#SAP-J2EE-Engine#administrators#
#1.#0018714E4A14005E000027E5000057B8000441BB7F8BDC21#1198173461543#com.sap.engine.services.security.roles.SecurityRoleImpl#sap.com/irj#com.sap.engine.services.security.roles.SecurityRoleImpl#Guest#2127####46ce8210aefd11dcc68f0018714e4a14#Thread[Thread-59,5,SAPEngine_Application_Thread[impl:3]_Group]##0#0#Error#1#/System/Security/Audit/J2EE#Java###: Authorization check for caller assignment to J2EE security role [ :
Any idea about it?
Thanks friends

Hi Holger,
Thanks for the tip, it could be the case, I just checked and we are on Patch 0 for JEECOR as you can see here below:
sap.com/SAP-JEECOR 7.00 SP13 (1000.7.00.13.0.20070907082334) 20071028144036
sap.com/SAP-JEE 7.00 SP13 (1000.7.00.13.2.20071026143730) 20071203150628
Will inform some people internally to patch to atleast 3 to check if it still occures.
Anyway, Thanks again..
Benjamin Houttuin

Error :Authorization check for caller assignment to J2EE security role whil

Hi Experts,
i m working as a portal resource .
after the deployment of standered Sap e-rec package .
i m getting some error. i have assigned the recruiter role to one test user.
Now i m getting two issue:
1)All the services are appearing in Detailed Navigation Pannel but not in Portal content area..
2) I m able to see few iview for the test user but those are also in detailed navigation view.
And few ivews are giving following error :
i)Internal error
ii)error 2011-12-19 07:59:57:315 ACCESS.ERROR: Authorization check for caller assignment to J2EE security role [sap.com/com.sap.lcr*sld : LcrInstanceWriterNR] referencing J2EE security role [SAP-J2EE-Engine : administrators].
/System/Security/Audit/J2EE com.sap.engine.services.security.roles.audit n/a EP-DEV-KRT Server 0 0_97989
Full Message Text
ACCESS.ERROR: Authorization check for caller assignment to J2EE security role [sap.com/com.sap.lcr*sld : LcrInstanceWriterNR] referencing J2EE security role [SAP-J2EE-Engine : administrators].
please suggest what can be done or what is pending from my side.

Prajakta2602 wrote:
Hi Experts,
>
> the previous issue got solved..
> it was due to servies pack miss match and applying notes
> the Basis guy checked the SLD logs and accordingly found that the base components J2EECORE and JTECHS required paching as per
> notes 1445294 and 1175239 were applied.
> now the issue is:
>
>
> After implemetation and i assigning the standerd sap roles
> 1)Recruiter Administrator
> 2)Recruiter
> to the test user .
> but for few iview it is showing error as in
> 1) you are not a authorized user
> 2) internal error
>
> please help experts.
>
> i m working on portal side have i to assign any role to that test user..
>
>
> Thnaks & Regards,
> Prajakta
You can run a quick check using the below steps:
1. Check in backend whether there is any authorisation errors... you may use transactions SU53 or ST22 for any ABAP errors
2. Also check in NWA -> log viewer -> last 24 hours log for the particular user to see any java related issues.
Regards,
Mahesh

Network security: Configure encryption types allowed for Kerberos-Windows 2008

If below setting has been enabled in domain policy on Windows 2008 R2 DC ; what is the effect on Windows 2008 Member server . that seeting is not present in Windows 2008.
Network security: Configure encryption types allowed for Kerberos:
Please advice & if possible please provide more info.
AliahMurfy

Hi,
I found some related information is some type of the encrypt not supported on the server 2008, such as AES128_HMAC_SHA1.
More detail information please refer the following KB:
Network security: Configure encryption types allowed for Kerberos
http://technet.microsoft.com/en-us/library/jj852180(v=ws.10).aspx
Hope this helps.
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Any docs or guide for OpenSSO secure Ldap with Opends

Any docs or guide for OpenSSO secure Ldap with Opends
Cheers
Blacknasa

Hi,
it seems to be a JRE Problem. When I use the Kerberos implementation from "Vintela Single Sign-On for Java" I can establish a "aes256" secured LDAP connection to the AD Server.
This LDAP connection allows to change the passwords of the users stored in the AD.
The problem is that "Vintela Single Sign-On for Java" is not free, so it would be nice to have a solution which works with the Kerberos implementation of the JRE.
The error is the same for "aes128" and "aes256" encryption.
And with Wireshark I can not see any differences in the packets send to the AD and received from the AD.

Secure Configuration Guide for Lion?

Is Apple going to release a secure configuration guide for Apple, as it has for its past OS X operating systems? It doesn't yet exist on the Secure Configuration Guide page on Apple's site.

i'm also interested in reading this document.
i posted the same question before reading your post.
https://discussions.apple.com/message/19256352#19256352

Create a Secure Client for a Secure Web Service- is failing

Hi,
This is actually with reference to the webservice tutorial.I am trying the example on Create a Secure Client for a Secure Web Service and have followed all the steps mentioned,however I am getting the following error:
D:\JDev11gTp\jdk\bin\javaw.exe -client -classpath D:\Jdev11gTpInstance\mywork\WebServiceApplications\.adf;D:\Jdev11gTpInstance\mywork\WebServiceApplications\WebServiceProjects\classes;D:\JDev11gTp\webservices\lib\jaxws-api.jar;D:\JDev11gTp\webservices\lib\jws-api.jar;D:\JDev11gTp\webservices\lib\orawsmetadata.jar;D:\JDev11gTp\webservices\lib\wsclient.jar;D:\JDev11gTp\j2ee\home\lib\activation.jar;D:\JDev11gTp\j2ee\home\lib\ejb.jar;D:\JDev11gTp\j2ee\home\lib\jms.jar;D:\JDev11gTp\j2ee\home\lib\jta.jar;D:\JDev11gTp\j2ee\home\lib\mail.jar;D:\JDev11gTp\j2ee\home\lib\servlet.jar;D:\JDev11gTp\webservices\lib\jaxrpc-api.jar;D:\JDev11gTp\webservices\lib\wsserver.jar;D:\JDev11gTp\webservices\lib\wssecurity.jar;D:\JDev11gTp\webservices\lib\wsdl.jar;D:\JDev11gTp\webservices\lib\orasaaj.jar;D:\JDev11gTp\webservices\lib\saaj-api.jar;D:\JDev11gTp\webservices\lib\orawsdl.jar;D:\JDev11gTp\webservices\lib\orawsrm.jar;D:\JDev11gTp\webservices\lib\orawsrel.jar;D:\JDev11gTp\webservices\lib\jaxr-api.jar;D:\JDev11gTp\webservices\lib\orajaxr.jar;D:\JDev11gTp\webservices\lib\relaxngDatatype.jar;D:\JDev11gTp\webservices\lib\xsdlib.jar;D:\JDev11gTp\webservices\lib\mdds.jar;D:\JDev11gTp\webservices\lib\wsif.jar;D:\JDev11gTp\webservices\lib\fabric-common.jar;D:\JDev11gTp\webservices\lib\fabric-interceptors.jar;D:\JDev11gTp\jlib\jaxen.jar;D:\JDev11gTp\jlib\oraclepki.jar;D:\JDev11gTp\jlib\ojpse.jar;D:\JDev11gTp\jlib\jsr106.jar;D:\JDev11gTp\jlib\jsr105.jar;D:\JDev11gTp\jlib\osdt_xmlsec_jce.jar;D:\JDev11gTp\jlib\osdt_wss_jce.jar;D:\JDev11gTp\jlib\osdt_saml_jce.jar;D:\JDev11gTp\jlib\osdt_saml2_jce.jar;D:\JDev11gTp\jlib\osdt_core.jar;D:\JDev11gTp\jlib\osdt_cert.jar;D:\JDev11gTp\jlib\osdt_xmlsec.jar;D:\JDev11gTp\jlib\osdt_wss.jar;D:\JDev11gTp\jlib\osdt_saml.jar;D:\JDev11gTp\jlib\osdt_saml2.jar;D:\JDev11gTp\jlib\ojmisc.jar;D:\JDev11gTp\j2ee\home\lib\http_client.jar;D:\JDev11gTp\j2ee\home\jazncore.jar;D:\JDev11gTp\j2ee\home\oc4jclient.jar;D:\JDev11gTp\rdbms\jlib\xdb.jar;D:\JDev11gTp\j2ee\home\lib\javax77.jar;D:\JDev11gTp\lib\java\api\jsr173_api.jar;D:\JDev11gTp\lib\java\shared\sun.jaxb\2.0\jaxb-impl.jar;D:\JDev11gTp\lib\java\shared\sun.jaxb\2.0\jaxb-xjc.jar;D:\JDev11gTp\lib\java\shared\sun.jaxb\2.0\jaxb1-impl.jar;D:\JDev11gTp\j2ee\home\lib\oc4j-schemas.jar;D:\JDev11gTp\jlib\ojdl.jar;D:\JDev11gTp\jlib\ojdl2.jar;D:\JDev11gTp\jlib\fmw_audit.jar;D:\JDev11gTp\j2ee\home\lib\jmxri.jar;D:\JDev11gTp\j2ee\home\lib\jmx_remote_api.jar;D:\JDev11gTp\j2ee\home\lib\adminclient.jar;D:\JDev11gTp\j2ee\home\lib\jmxframework.jar;D:\JDev11gTp\j2ee\home\lib\jmxspi.jar;D:\JDev11gTp\j2ee\home\lib\xmlcfg.jar;D:\JDev11gTp\jlib\dms.jar;D:\JDev11gTp\jlib\orai18n.jar;D:\JDev11gTp\j2ee\home\lib\commons-digester.jar;D:\JDev11gTp\j2ee\home\lib\spring.jar;D:\JDev11gTp\lib\java\shared\oracle.wsm\11.1.1.0\wsm-policy-core.jar;D:\JDev11gTp\lib\java\shared\oracle.wsm\11.1.1.0\wsm-pmclient.jar;D:\JDev11gTp\lib\java\shared\oracle.wsm\11.1.1.0\wsm-pap.jar;D:\JDev11gTp\lib\java\shared\oracle.wsm\11.1.1.0\wsm-agent.jar;D:\JDev11gTp\lib\java\shared\oracle.wsm\11.1.1.0\wsm-secpol.jar;D:\JDev11gTp\lib\java\shared\oracle.javatools\11.1.1.0.0\javamodel-rt.jar;D:\JDev11gTp\lib\java\shared\oracle.javatools\11.1.1.0.0\javatools-nodeps.jar;D:\JDev11gTp\lib\java\shared\oracle.toplink\11.1.1.0.0\toplink-sdo.jar;D:\JDev11gTp\lib\java\api\jaxb-api.jar;D:\JDev11gTp\lib\xmlparserv2.jar;D:\JDev11gTp\lib\xml.jar;D:\JDev11gTp\jakarta-taglibs\commons-logging-1.0.3\commons-logging.jar -Dhttp.proxyHost=localhost -Dhttp.proxyPort=8099 -Dhttp.nonProxyHosts= -Dhttps.proxyHost=localhost -Dhttps.proxyPort=8099 -Dhttps.nonProxyHosts= HelloPolicyPortClient
Feb 1, 2008 5:13:43 PM oracle.j2ee.ws.common.context.ContextInterceptor init
INFO: Context provider properties file not found
Feb 1, 2008 5:13:44 PM oracle.wsm.audit.Auditor <init>
INFO: Created J2SE auditor for componentType=OWSM-AGENT busstop=D:\oracle\product\10.2.0\client_1\auditlogs\OWSM-AGENT filter=false auditor=oracle.security.audit.Auditor@143a083
Feb 1, 2008 5:13:44 PM oracle.wsm.audit.Auditor <init>
INFO: Created J2SE auditor for componentType=OWSM-PM-LIB busstop=D:\oracle\product\10.2.0\client_1\auditlogs\OWSM-PM-LIB filter=false auditor=oracle.security.audit.Auditor@15af049
SEVERE: WSM-04514 An MDS error occurred.
SEVERE: WSM-09012 No key, WSM-06002, was found in the resource bundle oracle.wsm.resources.policyvalidation.PolicyValidationMessageBundle.
javax.xml.ws.WebServiceException: oracle.fabric.common.PolicyEnforcementException: PolicySet Invalid: WSM-06002 PolicyReference Invalid policy reference
at oracle.j2ee.ws.client.jaxws.DispatchImpl.invoke(DispatchImpl.java:466)
at oracle.j2ee.ws.client.jaxws.WsClientProxyInvocationHandler.invoke(WsClientProxyInvocationHandler.java:204)
at $Proxy28.sayHello(Unknown Source)
at HelloPolicyPortClient.main(HelloPolicyPortClient.java:35)
Caused by: oracle.fabric.common.PolicyEnforcementException: PolicySet Invalid: WSM-06002 PolicyReference Invalid policy reference
at oracle.integration.platform.common.InterceptorChainImpl.createPolicyEnforcementException(InterceptorChainImpl.java:217)
at oracle.integration.platform.common.InterceptorChainImpl.processRequest(InterceptorChainImpl.java:104)
at oracle.j2ee.ws.client.mgmt.runtime.SuperClientInterceptorPipeline.handleRequest(SuperClientInterceptorPipeline.java:91)
at oracle.j2ee.ws.client.jaxws.DispatchImpl.handleRequest(DispatchImpl.java:309)
at oracle.j2ee.ws.client.jaxws.DispatchImpl.handleRequest(DispatchImpl.java:290)
at oracle.j2ee.ws.client.jaxws.DispatchImpl.invoke(DispatchImpl.java:444)
... 3 more
Process exited with exit code 0.
Can anyone please give any clue as to why this error is coming?
Thanks.

Hi
Please refer to this thread
Re: Can I create a login/password protection in Muse for a HTML5 page or two?

LDAP or RDBMS for J2EE Security Configuration

Similar Messages

Maybe you are looking for