OAS continues to fulfill requests that use expired sessions (bug???)

When I make a request against one of our OAS servers after I know my session has expired, the server responds with an HTTP response that includes a header to clear out my SSO login cookie (I think that's what it's referred to as), but it still fulfills the request as normal.
Utilizing Apache JMeter, I was able to determine the details of such a transaction.
----------the request----------
GET https://our_oas_server:443/some_resource
Cookie Data:
OHS-our_oas_server-443=(a long hexadecimal string)
----------the response----------
HTTP/1.1 200 OK
Date: Tue, 19 Feb 2008 16:54:08 GMT
Server: Oracle-Application-Server-10g/10.1.2.0.0 Oracle-HTTP-Server
Set-Cookie: OHS-our_oas_server-443=; expires=Thu, 01 Jan 1970 12:00:00 GMT; path=/
Cache-Control: max-age=0
Expires: Tue, 19 Feb 2008 16:54:08 GMT
Cache-Control: private
Keep-Alive: timeout=15, max=100
Connection: Keep-Alive
Content-Type: text/html
(the HTML)
If I allow the cookie to be removed, a subsequent request is responded to with a redirect to our Oracle SSO server.
Has anyone else experienced this? Can anyone else confirm it? Can anyone shed some light on it? This behavior appears to be a security issue as it means someone can continue to interact with the server as an authenticated user without the need to re-authenticate, even after the server has been restarted.
Gregg

Please retest with the latest patchset applied. I know some issues in this area have been fixed in the past years in the AS patchsets.
If the issue still occurs after applying the latest patchset, please ask again, then please use the Identity Management forum as it may then be config related.

Similar Messages

Using ALTER SESSION inside a stored procedure.... not a good idea?

Hi,
I have two stored procedures, both of which are used to query a database to find a particular book, based on ISBN. One sproc searches our main product catalogue and the other searches our suppliers feed catalogues. The stored procedures are called from a C# application via a search tool and the user is able to search on either our catalogue or our suppliers. The appropriate procedure is called based on the users choices.
However, the following behaviour is observed
I search for an ISBN (is a varchar2 field, as isbn's may contain an X if the checksum digit equates to 10) on a feed, so uses the FEED SPROC. The book is found and returned to the app in about 0.5 seconds. I can repeat this as often as i like on different books etc. always works fine.
I then do the same search but against our own catalogue, so uses our CATALOGUE SPROC. Again the book is found quickly, and the search can be repeated with the same results.
If i then go back and run our FEED SPROC then the search time increases to about 3 minutes !
Both the feed and our catalogue is in the same database, although different schema's the connections will be pooled through our app server.
I can repliacte this every single time. I think i have narrowed doen the cause of this behaviour to a few lines of code in our CATALOGUE SPROC:
-- store values
select value into v_vch_NLS_COMP from nls_session_parameters nsp where nsp.parameter = 'NLS_COMP';
select value into v_vch_NLS_SORT from nls_session_parameters nsp where nsp.parameter = 'NLS_SORT';
-- Ensure case insensitivity throughout
EXECUTE IMMEDIATE 'ALTER SESSION SET NLS_COMP = LINGUISTIC';
EXECUTE IMMEDIATE 'ALTER SESSION SET NLS_SORT = BINARY_CI';
do other stuff
-- restore session variables
EXECUTE IMMEDIATE 'ALTER SESSION SET NLS_COMP = ' || v_vch_NLS_COMP;
EXECUTE IMMEDIATE 'ALTER SESSION SET NLS_SORT = ' || v_vch_NLS_SORT;
If i remove this code then all is well, so i am assuming that using ALTER SESSION inside a stored procedure is the cause of the problem as it would be changing the execution plan of the FEEDS SPROC in some manner? Any ideas? I know i can just rewrite the sproc to avoid using this coding, but wanted to understand if i am doing something wrong by using ALTER SESSION in this manner?
Any pointers would be appreciated.
John Thompson
Software Architect,
play.com
Edited by: user7186902 on 27-May-2009 03:51

Hello (and welcome),
It may be a case of having to create a linguistic index to facilitate the queries once you set these session level parameters, i.e..,
CREATE INDEX idx_01 ON tab ((NLSSORT(col1, 'NLS_SORT=BINARY_CI'))It would appear that the setting of those parameters is invalidating index searching on the current indexes.

Defining Business Operations using remote session EJBs for WLI2.1

Hello all,
I'm having a deployment issue with WLI 2.1. Is it true that in order to define
a Business Operation in WLI 2.1 that uses a session EJB, the EJB MUST be deployed
in the same JNDI tree (WLS instance) that WLI is running on? Is everyone just
running one admin server that hosts WLI and all other applications on the same
instance?
I'd like to have WLI running on one machine and have my applications running on
another, but at this point seems unobtainable because you cant supply a t3 URL
to that separate machine when defining Business Operations...
Any help would be appreciated,
Jon

I am new to WLPI and have run across this problem as well. Could you
provide more detail your proxy session bean and maybe include some
example code? Thanks.
Regards,
Rick H.
"Paul Rooney" <[email protected]> wrote:
>
I have come accross the same problem - solved it by using a "proxy" session
bean
that knows how to call out to all the Remote EJBS that I need. This "proxy"
session
bean is deployed with wlpi application.
"Erik Godding Boye" <[email protected]> wrote:
We would like to define business operations in WLI calling EJBs on a
remote machine.
It seems like the EJB have to be deployed locally to appear in the (JNDI)
drop-down
list when defining the business operation.
Is the only way to achieve this functionality to write (or generate)
some kind
of wrapper EJB that will be deployed locally, or do you have other suggestions?
Regards,
E
PS: We're using WLI 2.1 running on WLS 6.1 SP1

How do I renew a provisioning profile that has expired on my phone? I use an app for the company I work for and I cannot open it because it says the provisioning profile has expired.

How do I renew a provisioning profile that has expired on my phone? I use an app for the company I work for and I cannot open it because it says the provisioning profile has expired.

i'm not quiet sure atm but should normally work like this:
connect to itunes store -> log out with ur account (upper right corner where ur apple id is displayed) -> sign in with ur wifes apple id -> activate computer (store->activate this computer)
normally it should work this way but ur wife wont be able to use apps or music within itunes library purchased with the other apple id

I continue to receive message that "We could not complete your iTunes Store request. An unknown error occurred (4002). Please try again later." This has been happening every time iTunes Match runs in background. Any suggestions for a cure?

I continue to receive message that "We could not complete your iTunes Store request. An unknown error occurred (4002). Please try again later." This has been happening every time iTunes Match runs in background. Any suggestions for a cure?

Found a potential solution here:
https://discussions.apple.com/thread/4332757
Gsleeroy
Re: error 4002 in itunes match do you have a solution?
Sep 23, 2012 10:08 AM (in response to matracaelcan)
Hi All,
I had this problem today myself, and was frustrated repeatedly by the '4002' error.
I have literally just fixed the issue by doing the following steps:
1: Go to the 'Store' tab and select 'Turn Off iTunes Match'
2: Return to the 'Store' tab and select 'Update Genius'
3: Wait for this to complete succesfully, the return to the 'Store' tab once more and select 'Turn On iTunes Match'.
4: iTunes Match will now go through the motions and should succeed!
I hope this helps

I buy I phone from USA and I use this I phone in Iraq I get this message Please insert another SIM card from a supported carrier or request that this iPhone be unlocked by your carrier so I need to solve this problem

Dear ,
I buied I phone from USA and I sent to Iraq to use it there but when used it I get this message :
The SIM card that you currently have installed in this iPhone is from a carrier that is not supported under the activation policy that is currently assigned by the activation server. This is not a hardware issue with the iPhone. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked by your carrier
so I need support to resolve this problem and procedure and how I can iPhone be unlocked.
BR,
Ammar Jumaa

ammarjr wrote:
... how I can iPhone be unlocked.
Sorry... but... ONLY the US Carrier it is Locked to can unlock it.
You need to Contact them.
Note: No one here will know who that Carrier is.

My iPhone5 prompts while setting up "This iPhone is not currently setup to work with carrier you are attempting to use.Please insert another SIM card from a supported carrier" or "Request that this iPhone be unlocked" How can I unlock my new iPhone5 ?

My iPhone5 prompts while setting up "This iPhone is not currently setup to work with carrier you are attempting to use.Please insert another SIM card from a supported carrier" or "Request that this iPhone be unlocked" How can I unlock my new iPhone5 to function properly?

That means that the phone is locked to a carrier other than the one you are trying to use.
ONLY the carrier it is locked to can authorize unlocking it.
Where exactly did you get this "new" iPhone 5?

Problem while using an adobe form "Unable to fulfil request for memory"

Hi Experts,
When I try to call a Adobe Form from the porta,l the system encounters a problem and the error message is "Unable to fulfil request for 3665920 bytes of memory space.".Could yopu please provide you valuable suggestion to resolve the issue.
Thanks.
Arun.

Hey fellow ADS developer,
I had this issue once and had hard time to figure out from where it was coming!
In fact, check the free space on your SAP Server hard disk (or ask admin guys). It might be that there is no more hard disk! Because every time you generate a form, it is stored on your server harddisk. You need to flush all that temp stuff regularly.
Hope this helps
Yann

Using Mail under iOS 5 Mail continues to suggest addresses that have been removed from Contacts. How do I remove old adreesses?

Using Mail under iOS, 5 Mail continues to suggest addresses that have been removed from Contacts. How do I remove old, obsolete adreesses no longer in Contacts?

If you open Mail and then in its File menu at the top, click on Window and choose Previous Recipients, you'll get a popup window listing them. At that point, you can highlight and delete any/all.

Please help! I am trying to change my Apple Id that used to be my mother to Mine- Every time i have it changed and i go and try and do an update it continues to ask for her old password. I really need help with this!

Please help! I am trying to change my Apple Id that used to be my mother to Mine- Every time i have it changed and i go and try and do an update it continues to ask for her old password. I really need help with this!

Phil0124 wrote:
Apps downloaded with an Apple ID are forever tied to that Apple ID and will always require it to update.
The only way around this is to delete the apps that require the other Apple ID and download them again with yours.
Or simply log out of iTunes & App stores then log in with updated AppleID.

HT1937 The SIM card inserted in this iPhone does not appear to be supported. This iPhone is not currently setup to work with carrier you're attempting to use. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked.

The SIM card inserted in this iPhone does not appear to be supported.
This iPhone is not currently setup to work with carrier you're attempting to use. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked.
what does it mean?

Have a look in Settings>Carrier
Again YOU cannot unlock it - only the original carrier can do it

HT5163 The SIM card inserted in this iPhone does not appear to be supported. This iPhone is not currently setup to work with carrier you're attempting to use. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked.

The SIM card inserted in this iPhone does not appear to be supported.
This iPhone is not currently setup to work with carrier you're attempting to use. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked.

Sounds like you are trying to use an iPhone that is locked to a particular
wireless carrier with the sim from another wireless carrier. Contact the wireless
provider that the iPhone is locked to and ask if they offer unlocking and if
you qualify. Only the wireless carrier that the iPhone is locked to can unlock
it.

Hi i updated my iphone but it says that This iPhone is not currently setup to work with carrier you're attempting to use. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked. how can i unlock this one?

hi i updated my iphone but it says that This iPhone is not currently setup to work with carrier you're attempting to use. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked. how can i unlock this one?

Your iPhone was hacked or jailbroken before and through the update it locks back to the original carrier. Only the original carrier can unlock the iPhone. You have to contact them and find out what the procedure you needs to follow.

HT201328 This iPhone is not currently setup to work with carrier you're attempting to use. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked.

This iPhone is not currently setup to work with carrier you're attempting to use. Please insert another SIM card from a supported carrier or request that this iPhone be unlocked.

In your other post https://discussions.apple.com/thread/5001329?tstart=60
you say the iPhone originally was on contract with Orange UK. You will have
to work with Orange UK to get the iPhone unlocked.

I get an error message saying itunes could not sync mail accounts. because the mail accounts are in use by the iPhone. It asks that i close the mail accounts settings on the iPhone and sync again. Is it requesting that i delete my email accounts?

i get an error message saying itunes could not sync mail accounts. because the mail accounts are in use by the iPhone. It asks that i close the mail accounts settings on the iPhone and sync again. Is it requesting that i delete my email accounts?

just as i've posted the same issue here hope that someone could give us a hand. I have just swtched from nokia to iPhone for my company cell and i have more than 1000 contacts... it would be murder to create those contacts one by one )))))

OAS continues to fulfill requests that use expired sessions (bug???)

Similar Messages

Maybe you are looking for