Nescesary actions to make jbo.security.enforce=Must working
Hi,
We use JHeadstart 10.1.3 .3.75. Within the JHeadstart Application Definitions we configured the folowing security options:
Authentication Type = JAAS
Use Role-based Authorization? = true
Authorization Type = JAAS and Custom
Authorize Using Group Permission = true
Everything worked fine but in the database we want to know which user modifies certain data(auditing). Therefore we implemented the "setting context feature" as described by Sandra in
[JHeadstart Blog|http://blogs.oracle.com/jheadstart/2007/11/row_level_security_using_vpd_a.html#adfbc].
Then we ran into the issue that the getUserPrincipalName() method and (SessionImpl)getDBTransaction().getSession().getUserPrincipalName() were null.
In the ADF Developer guide , chapter 9.8, refers to setting the jbo.security.enforce property to Must or Auth.
I followed the guide, which resulted in the following error:
08/10/24 16:09:18 [554] Resetting AM=MedewerkersApp
08/10/24 16:09:18 [555] AMPoolMessageBundle (language base) being initialized
08/10/24 16:09:18 [556] Failed to create BindingContainer from reference :MedewerkersPageDef
08/10/24 16:09:18 [557] JBO-30003: De applicatiegroep local.achmeavastgoed.avh.model.appl.MedewerkersAppLocal kon een applicatiemodule-instance vanwege de volgende uitzondering niet uitchecken.
oracle.jbo.JboException: JBO-29000: JBO-33021: Verificatie van gebruiker null mislukt.
at oracle.jbo.common.ampool.ApplicationPoolImpl.doCheckout(ApplicationPoolImpl.java:2002)
at oracle.jbo.common.ampool.ApplicationPoolImpl.useApplicationModule(ApplicationPoolImpl.java:2793)
at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:453)
at oracle.jbo.http.HttpSessionCookieImpl.useApplicationModule(HttpSessionCookieImpl.java:233)
at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:424)
at oracle.jbo.common.ampool.SessionCookieImpl.useApplicationModule(SessionCookieImpl.java:419)
at oracle.adf.model.bc4j.DCJboDataControl.rebuildApplicationModule(DCJboDataControl.java:1543)
at oracle.adf.model.bc4j.DCJboDataControl.beginRequest(DCJboDataControl.java:1404)
at oracle.adf.model.binding.DCDataControlReference.getDataControl(DCDataControlReference.java:99)
at oracle.adf.model.BindingContext.get(BindingContext.java:457)
at oracle.adf.model.binding.DCUtil.findSpelObject(DCUtil.java:280)I saw some posts about this error but no solution was given.
Could you give me some advise with this matter?
Thanx,
Romano
Hi Ibrahim,
1) Did you set jbo.security.enforce to Must or Auth
I tried both. But the result was the same.
2) Did you configure login and security in your web.xml, and how?
I used the JHeadstart example.
<?xml version = '1.0' encoding = 'windows-1252'?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee">
<description>Empty web.xml file for Web Application</description>
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>client</param-value>
</context-param>
<context-param>
<param-name>javax.faces.CONFIG_FILES</param-name>
<param-value>/WEB-INF/faces-config.xml,/WEB-INF/JhsCommon-beans.xml,/WEB-INF/MedewerkersApp-Breadcrumb-beans.xml,/WEB-INF/Medewerkers-beans.xml,/WEB-INF/faces-config-menu.xml,/menu/beanconfig/MenuAdminService-Breadcrumb-beans.xml,/menu/beanconfig/UserInterfaceSkins-beans.xml,/menu/beanconfig/JhsModules-beans.xml,/menu/beanconfig/JhsRootMenuItems-beans.xml,/menu/beanconfig/JhsChildMenuItems-beans.xml,/menu/beanconfig/MenuTranslationLov-beans.xml,/WEB-INF/faces-config-security.xml,/security/beanconfig/SecurityAdminService-Breadcrumb-beans.xml,/security/beanconfig/Users-beans.xml,/security/beanconfig/UserRoleGrants-beans.xml,/security/beanconfig/Roles-beans.xml,/security/beanconfig/RoleUserGrants-beans.xml,/security/beanconfig/RolePermissionGrants-beans.xml,/security/beanconfig/Permissions-beans.xml,/security/beanconfig/PermissionsLov-beans.xml</param-value>
</context-param>
<context-param>
<param-name>CpxFileName</param-name>
<param-value>local.achmeavastgoed.avh.view.DataBindings</param-value>
</context-param>
<filter>
<filter-name>adfFaces</filter-name>
<filter-class>oracle.adf.view.faces.webapp.AdfFacesFilter</filter-class>
</filter>
<filter>
<filter-name>adfBindings</filter-name>
<filter-class>oracle.adf.model.servlet.ADFBindingFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfFaces</filter-name>
<url-pattern>*.jspx</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<url-pattern>*.jspx</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>
<filter-mapping>
<filter-name>adfBindings</filter-name>
<servlet-name>ordDeliverMedia</servlet-name>
</filter-mapping>
<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet>
<servlet-name>ordDeliverMedia</servlet-name>
<servlet-class>oracle.jheadstart.ord.html.OrdPlayMediaServlet</servlet-class>
<init-param>
<param-name>releaseMode</param-name>
<param-value>Stateful</param-value>
</init-param>
</servlet>
<servlet>
<servlet-name>resources</servlet-name>
<servlet-class>oracle.adf.view.faces.webapp.ResourceServlet</servlet-class>
</servlet>
<servlet>
<servlet-name>JhsLoginErrorServlet</servlet-name>
<servlet-class>oracle.jheadstart.controller.LoginErrorServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>Faces Servlet</servlet-name>
<url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>ordDeliverMedia</servlet-name>
<url-pattern>ordDeliverMedia</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>resources</servlet-name>
<url-pattern>/adf/*</url-pattern>
</servlet-mapping>
<servlet-mapping>
<servlet-name>JhsLoginErrorServlet</servlet-name>
<url-pattern>/loginErrorServlet</url-pattern>
</servlet-mapping>
<session-config>
<session-timeout>35</session-timeout>
</session-config>
<mime-mapping>
<extension>html</extension>
<mime-type>text/html</mime-type>
</mime-mapping>
<mime-mapping>
<extension>txt</extension>
<mime-type>text/plain</mime-type>
</mime-mapping>
<security-constraint>
<web-resource-collection>
<web-resource-name>AllPages</web-resource-name>
<url-pattern>*.jspx</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>ADMIN</role-name>
<role-name>USER</role-name>
</auth-constraint>
</security-constraint>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/faces/security/pages/Login.jspx</form-login-page>
<form-error-page>/loginErrorServlet</form-error-page>
</form-login-config>
</login-config>
<security-role>
<role-name>ADMIN</role-name>
</security-role>
<security-role>
<role-name>USER</role-name>
</security-role>
</web-app>3) If you're running your app in the JDeveloper embedded OC4J, how is your system-jazn-data.xml configured for the local app?
I am not sure what you mean by this question. However, the jazn-data.xml file is added to the META-INF source directory.
Whithin that file the users SKING, AHUNOLD and some databaseusers are present.
Within the embeded oc4j preferences, the users SKING and AHUNOLD are present in the Current Workspace section. In the global section the users anonymous, oc4jadmin and JtaAdmin are present.
FYI: There seems nothing wrong with this configuration. When setting jbo.security.enforce to None, I am able to login with the SKING account.
Regards,
Romano
Similar Messages
-
Jbo.security.enforce and FORM Auth
i have web application on JHeadStart with FORM based auth.
when i change jbo.security.enforce = None to
jbo.security.enforce = Auth i ha exception:
Authentication failed:
User null does not exist in system.
why?This sounds like a OC4J/J2EE issue that is not related to JHeadstart. To simplify the test case, you could create a simple drag-and-drop ADF application without JHeadstart, use that as the 2nd application, and see if the same problem occurs there. Can you please log a TAR at MetaLink ( http://metalink.oracle.com/ ), or ask this question at the OC4J/J2EE forum at OC4J ? Thanks.
kind regards,
Sandra Muller
JHeadstart Team
Oracle Consulting -
Jbo.security.enforce and JHeadStart
i have web application on JHeadStart with FORM based auth.
when i change jbo.security.enforce = None to
jbo.security.enforce = Auth i ha exception:
Authentication failed:
User null does not exist in system.
why?repost
i use web auth. -
Suddenly I have problems moving files to the trash... get a dialog saying Finder wants to make changes and I must provide the password... Any explanation or ideas how I can get this to stop?
Please take these steps if you're prompted for a password when moving items in your home folder to the Trash.
1. Triple-click anywhere in the line below on this page to select it:
~/.Trash
2. Right-click or control-click the highlighted line and select
Services ▹ Show Info
from the contextual menu.* An Info dialog should open.
3. The dialog should show "You can read and write" in the Sharing & Permissions section. If that's not what it shows, click the padlock icon in the lower right corner of the window and enter your password when prompted. Use the plus- and minus-sign buttons to give yourself Read & Write access and "everyone" No Access. Delete any other entries in the access list.
4. In the General section, uncheck the box marked Locked if it's checked.
5. From the action menu (gear icon) at the bottom of the dialog, select Apply to enclosed items and confirm.
6. Close the Info window and test.
*If you don't see the contextual menu item, copy the selected text to the Clipboard by pressing the key combination command-C. Open a TextEdit window and paste into it (command-V). Select the line you just pasted and continue as above. -
Make a security profile available to device
Hello! Newbie question here.
I thought I'd try to get a few IP phones configured to encrypt their media streams. Seems I needed
to create a security profile that the phones could be configured with. That seemed to work. But then when I access the phones' device properties page I can not select the security profile. In fact, I only seem to be able to see one profile in the drop down list. So how would I make that newly created security profile available?
ThanksThe whole procedure is here
Configuring the Cisco CTL Client
http://www.cisco.com/en/US/partner/docs/voice_ip_comm/cucm/security/8_0_2/secugd/secuauth.html
Before you configure the Cisco CTL Client, verify that you activated the Cisco CTL Provider service and the Cisco Certificate Authority Proxy Function service in Cisco Unified Serviceability. Obtain at least two security tokens; the Cisco certificate authority issues these security tokens. The security tokens must come from Cisco. You will insert the tokens one at a time into the USB port on the server/workstation. If you do not have a USB port on the server, you may use a USB PCI card.
HTHjavaIf this helps, please ratewww.cisco.com/go/pdihelpdesk -
I have created a Oracle Form.
I transfered this form onto Oracle Apps Server.
Its working fine.
This is a simple FORM.
Functionality of the user_unlock FORM is as follows:
Its allows user to unlock account.
This FORM base on all_users table.
when user run this form.
First user need to serach the name on
enter the name in the text field.
when user clicks on the button its unlock the user account.
I have wrote a procedure in my database.
execute this procedure on when_button_pressed trigger.
For this process make little secure.
I have created a user abc with create session privileges.
I have granted above procedure to the new user.
I add one database logon FORM in this process as below:
Now our non-oracle help desk user browse the url.
database logon FORM popup,
all username/password/strings values are already there.
They need to click on logon button will bring unlock FORM.
And helpdesk user will unlock the account.
Here are my worries:
What is to prevent someone from unlocking the privileged accounts that have
well known default passwords that are now shipped as locked?
The search facility makes it possible for a hacker to l
earn all the usernames on the database with a wildcard search.
How can I make it secure?
DNDN, you asked this before I answered it.
Re: How to give limited privileges to the user to perform required duties?
If you don't like that answer, please say so and why. Another alternative you might consider if you don't have an application user table and must use ALL_USERS is to create a role for your application and grant that role (without admin) to your application users. You can then join ALL_USERS with USER_ROLE_PRIVS in your block and eliminate all but the users of your application. -
How do you make a secure pdf form editable?
How do you make a secure pdf file editable?
The best way is to apply a digital signature to the file. Any other way can
be manipulated quite easily. -
Why can I not make a secure connection using safari?
why can I not make a secure connection using safari?
I have the exact same problem. I just updated to 4.3.3 and now my inline controls on my earphones don't work. The earphones work, but the controls don't. It doesn't even recognize that there is a mic attached. Even with the earphones in it still uses the built in mic. Why did my controls stop working?!
-
Dear all
How to make adf security?
I am new adf security.
I'm facing security issue. Now i need to secure me application (User, Group, Role etc...)
Oracle recommend me use WebLogic internal LDAP or OID. How to manage User, Group, Role deploy after?
Thanks LhagvaHi,
once you deployed an application, users and roles are no longer in the domain of ADF Security. So the administration is
WLS console - if users and groups are in the WLS LDAP
Identity Management - if users and roles are in OID, RDBMA, Active Directory etc.
Enterprise Managers - to manage application roles and granting permissions or application roles to enterprise groups
Frank -
Is it possible to make a secure pdf unsecure using Adobe Acrobat Pro?
Basically, I am trying to add text using the Edit Document Text tool, but I cannot and I believe it is because it is secure.Everything Dave Merchant has said is reasonable and I have nothing against protecting intellectual property or copyright. But I am not talking about unsecuring a pdf in order to
copy content. I am talking about adding an image filee to a pdf so that it can
contain my signature.
I do not doubt that the ingenuity of Adobe engineers cannot find a way to protect the contents of a document, prevent them from being copied, altered, etc., while still allowing a third party user to add a signature to that document. I cannot see how anybody is harmed by allowing a
signature on a document, and surely there can be a nuanced approach to
protecting intellectual property without banning all modifications to a document.
I am also discouraged in having discovered that Bluebeam Revu is also taking an approach similar to Adobe. With Revu v7, I was able to add my signature to secured documents. Now, with v11, which I just spent a lot of money on, I can do nothing but view a secured document. That’s another pdf company that is not taking a nuanced approach to pdf protection … -
ITunes is extremely slow and I cannot make a secure connection
When I connect to iTunes my computer is extremely slow, and when I try to connect to the iTunes store I get the error message cannot make a secure connection. I have internet access and I have ran the iTunes diagnostics test and all the tests passed except making a secure connection. I have disabled all of my security systems including my firewall and Norton. I am not running any proxy settings. This has been an ongoing problem for over a month and I am at a loss.
Check out this Apple article -> iTunes: Advanced iTunes Store troubleshooting
Blocked by configuration: (Mac OS X/Windows)
Configure Internet Options (for Windows computers only):
Run iTunes Diagnostics. If the "Secure link to iTunes Store" section does not pass, do the following.
Open Internet Explorer.
From the Tools menu, choose Internet Options.
Click Connections.
Under "Dial-up and Virtual Private Networking," choose "Never dial a connection." It may not be possible to choose this if you’ve never used dial-up Internet; if this is the case, skip to the next step.
Click LAN Settings.
In the window that opens, enable the option to "Automatically detect settings" if it is not enabled.
iTunes uses Internet Options proxy settings. Apple recommends removing proxy settings that interfere with access to the iTunes Store if needed.
Click OK.
Click the Advanced tab.
Scroll down to the Security section and look for the option to "Check for server certificate revocation." If it is enabled, disable it.
Look for Use SSL 3.0 and Use TLS 1.0. Make sure at least one of those two checkboxes is selected and click OK (You can select both checkboxes).
Apply any changes, and restart your computer if you modified the option to "Check for server certificate revocation" (step #11). -
Safari cannot make a secure connection to Google or Youtube--but only on my home network
Recently, when I am on my home network, I cannot connect to Google or Youtube. When I try to, I get an error message that says that Safari can't make a secure connection to the site. (I can connect to these sites with Firefox at home though) However, when I am at work, both Google and Youtube load just fine on Safari. Any idea what could be causing this? I suspect that it's the repeater that my landlord installed in my apartment, but I really have no idea.
I am running Mavericks (10.9.4) on a 15-inch, late 2011 MacBook Pro.Hello Punxsutawney Phyllis,
Thanks for using Apple Support Communities.
See the article below to troubleshoot this error message you are receiving.
Mac OS: "Unable to establish a secure connection" or "can't verify identity" messages in Web browsers
http://support.apple.com/kb/TA20405
Take care,
Alex H. -
Can I make iPad Security Copies on Time Capsule?
Can I make iPad Security Copies on Time Capsule?
Sorry, I am not sure what a Security Copy might be, but if you are asking about backups, the iPad and other iOS devices back up to iTunes on your computer.
Then, if you have the computer setup to backup to the Time Capsule, the backups of the iPad are copied over from the computer.
So, the iPad backs up indirectly to the Time Capsule.
The iPad can also back up directly to iCloud if you prefer.
See this Apple support document for more details abut iOS backups.
http://support.apple.com/kb/ht1766 -
A prompt comes up on my TV screen when I try and purchase a movie "before you can make any purchases you must go to Itunes store on your computer and verify your account information". Have tried to do this to no avail - all my purchase and address details
it is a problem with the latest update. nothing you can do will fix it, besides rolling your apple tv back to the last update.
-
HOWTO: create a extension from jbo.security.loginModule
Hi,
I would like to extend the jbo.security.loginmodule to get the autorisation data not from the jazn-data.xml, but from a set of tables in the database.
Anybody any idear on how to implement this???Marc,
The following tutorial has a sample loginmodule implementation.
http://java.sun.com/security/jaas/doc/api.html
http://java.sun.com/security/jaas/doc/module.html
You need to create a config file similar to sample_jaas.config in the tutorial. If in your config file you have
Sample {
then you need to set jbo.security.loginmodule=Sample. You also need to set the following Java runtime option to specify the location of your config file (full path to the sample_jaas.config or whatever you name it)
-Djava.security.auth.login.config=sample_jaas.config
You don't need specify login.configuration.provider in jdk\jre\lib\security\java.security when using your own login module. It should be commented out with "#" or remove it.
#login.configuration.provider= ....
Thanks,
Yvonne
Maybe you are looking for
-
Can print over network, but scan over network doesn't work
Scanner communication cannot be established from Windows 7 PC to 1536dnf MP. Printing from that computer is fine. scanning from other computers over the network is fine also. I have uninstalled and reinstalled HP software, but that didn't fix the is
-
any information will help greatly
-
Enter GL account error while using BAPI_PO_CREATE
Hello All, I am using BUS2012 for uploading Account assignment PO through LSMW.I have filled the GL account field also but I am getting the error 'Enter Gl account'.Please let me know what could be the problem. Thanks, Rakesh.
-
Coldfusion 8,cfdocument, cfpdf, watermark, blank page output?
I'm using cfdocument. No matter whether I use PDF or Flashpaper as the type, if I specify the "name" attribute it results in an outputted page that is blank. If I remove the name attribute, it renders the pdf or flashpaper page. Why is this happening
-
[Solved] where is the gtk-config menu in kde?
Hi, i am a kde user and i have ever used kde-gtk-config to configure gtk application on kde desktop. Yesterday i have seen that the voice of gtk configuration in the settings menu of kde is disappeared. What happened to this package? Last edited by b