OID hardcoded userid/password
I have an application that enables users to self-register
and upon registration stores their information within OID.
In order to create users in oid I have to gain access to OID with a predefined userid/password. This is hardcoded in a java class.
All the java or plsql examples of directory manipulation that i have seen,hard code this username/password.
Is this the correct way to access OID as if doesn't seem very secure if you have to hard code a username /password.
Has anyone got any suggestions /solutions to make the access more secure, or perhaps I should be doing it a different way ?
You cannot get this secure (or more secure) with the approach you describe.
The alternative is to remove the possibility to self register and use the DAS feauture of the OID and use decentralized OID admins.
The main issue you face is the fact that you offer a user to self register. In theory I could get to this site and create an account for me. This is ok if the site contains data that is not sensitive, but if the data needs to be protected (access control) you cannot combine this with the self registration.
cu
Andreas
Similar Messages
-
Convert a web service which has userid/password hard coded......
Hi,
We have created a web service in our ECC 5.0 abap system. In SICF we hardcoded the userid/password, the web service works fine and can be called successfully to read the required data from SAP.
Now we wish to change the process so that the users calling the web service have to pass their userid/password, now things don't work!!
How do we change things around to the new format?
Options we are considering are as follows:
1) Change the function module so that it has import parameters of userid and password (don't think this will work!)
2) Somehow update the wsdl file so that it includes userid/password, is this possible?
3) SICF/wsconfig/wsadmin config, but don't know what to do though!!
Any ideas anyone?
Thanks.> Now we wish to change the process so that the users calling the web service have to pass their userid/password
1. Do you want to have authorize access to webservice or,
2. do you want to user supply user/password as a parameter within service.
for 1st you don't have to do anything just goto SOAMANAGER transaction and select basic http authentication for service endpoint. Every user who want to access (even url of wsdl) need to supply user/password.
for 2nd option you can integrate user/password field in FM but you need to include code which check and confirm if they are valid credential.
Regards,
gourav -
Hide UserID, Password, and Report Path when call Report from Report
Hi,
I have been able to call Report from Report using the hyperlink.
I put these code in my Field on the Report caller.
function F_3FormatTrigger return boolean is
temp varchar2(2000);
begin
temp := 'http://<computer_name>:8889/reports/rwservlet?';
temp := temp || 'server=repsrv' || '&' ||
'report=C:\MyReport\rep_detail.jsp' || '&' ||
'userid=scott/tiger@orcl' || '&' ||
'desformat=htmlcss' || '&' ||
'destype=cache' || '&' ||
'P_1=' || :ItemID || '&' ||
'P_2=' || :ItemName;
SRW.Set_Hyperlink(temp);
return (TRUE);
end;The hyperlink showed, and I can see the rep_detail.jsp showed in the same browser after I clicked the hyperlink.
The problem is, the hyperlink has to include the reports path and also userid and password.
If I did not put the userid and password, it will showed in another browse that
"The report has uncompiled PL/SQL"
How can I hide those userid, password, and the reports path?
BTW, Is there anyway to show the report callee in different page (precisely, open another IE) from the report caller?
Any help would be grateful.
Many thanks,
BuntoroHi,
Thanks for the answers.
Yet, I am still doubt about using cgicmd.dat.
I have looked around in this forum saying that it is not secure to use cgicmd.dat. Because all report request does not use authentication (the client can directly open report without login).
In Form, I can use the On-Logon to do the Oracle Form login (to do logon to the database), and then I use my own custom user login to restrict the menu for each user.
I do this since I want to restrict the user,
i.e user A can only view the sales form as well as sales report,
user B can only view the purchasing form as well as purchasing report.
Well, I am not so fond about the SSO itself.
It comes to my mind, since I don't have to re-login (to the database) each time I call another form (login database is only once at the first Form, On-Logon). It also goes to when calling the report caller.
What is RAD?
How can we use it?
Is OID = Oracle Internet Directory?
If true, maybe, I won't use it since I don't understand about it also.
Why we don't have to specify the userid and password when Form calls Report1 (using Run_Report_Object and Web.Show_Document())?
But we have to specify the userid and password when Report1 calls Report2.
Any help is appreciated.
Many thanks,
Buntoro -
How to hide Dynamic Parameter userid/password prompts on infoview
Hi,
I want to hide Userid/password for each dynamic parameter, which gets prompts while refreshing or scheduling a report
I do enter userid and password at CMC->database level but when report has dynamic parameter it still does prompts for each parameter.
Please advise.
MeghaI tried what you suggested..
Well I run into different error now while refreshing report suing dynamic prompt.
Error says 'List of Values failure: fail to get values.[Cause of error:Failed to the connetion.ProductName]
ProductName is my dynamic Parameter.
Please advise.
thanks
Megha -
Dear all,
I am looking to setup the use of active directory userid/password authentication instead of SAP R/3 User/Password for digital signature. We SSO to the backened ABAP AS via an SAP NW Portal to which SPNEgo kerberos authentication is setup. Today we specify R3 user id/password to digitally approvae a lot release. The idea is to have users maintain one AD password and don't have to remember the R/3 password anymore and also our Security team to avoid password maintenance.
I know there are 3 options for digital signature and
System signature with authorization by user ID and password (We use this currently)
Digital User signature with verification - (We would like to use this with AD userid/password, so the system still ask the users their AD userid/password for the authentication when they try to "sign" a document.)
User signature without verification
Do you think there is a way to configure the system in order to ask and check the active directory userid/password instead of SAP R/3 password? Where can I found documentation about it ?
I have several different versions of AS ABAP starting from NW 7.02 to NW 7.31.
My active directory is based on Windows 2008.
Thanks in advance!!
DheeActually enabling Kerberos for SSO purposes and enabling Kerberos for digital signatures are two different topics although the latter is because of the former. I'm interested in the topic as well and I'm currently looking at different options. SAP provides a BAdI for the digital signature API which can be used for external authentication but they do not provide the solution to invoke Kerberos authentication based on username and password. SAP provides a semi solution with NWSSO 2.0 SP2 which works only on Windows with classic dynpros meaning SAP GUI for Windows is assumed. The solution is based on an ActiveX component which does the actual Kerberos authentication using the Secure Login Client which is part of the NWSSO suite. Extending that implementation to non-Windows and non-GUI applications would require some sort of web enabled service that could be used to authenticate the user with username and password. In case authentication is successful, a Kerberos token would be returned to SAP which would then be validated. All the required pieces are there since SAP has Kerberos support now in both stacks of the NetWeaver Application Server, some bits are still missing though which leaves customers looking at 3rd party or custom solutions.
-
What are the userid,password, and host name for oracle 9i?
HI Guys.
I am a research student at the University and the I recently downloaded Oracle 9i for my research. But the problems is also with seting it up. Please could you show me the userid, password, and host name for oracle 9i.
Thanks in advance for your cooperations.
Malinga R
[email protected]I believe that starting with 9.2, you have to specify different passwords when you install (can't be the default).
Justin -
Dynamic UserID/Password for file Adapter
Hi,
How to use dynamic UserId/Password for file adapter ?
(Sender/Receiver)
In our case the Id/Pwd of FTP Site changes freguently.
Can anyone help.
Thanks in Advance
Regards
ChemmanzHi Chemmanz,
>>>>In our case the Id/Pwd of FTP Site changes freguently.
but do you have those passwords in the message payload?
if not then you will still have to fill it somewhere right?
BTW
the only way would be to use java proxies and write a simple ftp adapter inside it (or your own adapter)
but this is not possible in standard I believe
Regards,
michal -
How can we hide userid & password from browser
How can we hide the userid,password and connectionstring from the address bar of explorer when we run 9i forms on browser
Ok - I have 9.0.4 and I want to disable this hiding of password, as I have the follwing problem: Forms creates a temporary local file which contains javascript. Per default in xp service pack 2 it is not allowed to run javascript from local file. Is there any parameter in webforms.cfg to disabel the creation of this temporary file?
-
UserId/Password Not Given-expected to run SQL Plus
So that we may better diagnose DOWNLOAD problems, please provide the following information.
I downloaded Oracle 9i and I'm trying to run SQL Plus and its asking me for a userid, password and a host string. I don't know what the userid, password or host string would be. I wanted to see how I like Oracle for a database and just wanted to enter some SQL.
How will I know what the userid, password, host string would be?
- Server name = none
- Filename = none
- Date/Time 2/8/02
- Browser + Version = Internet Explorer
- O/S + Version = Windows 20000
- Error Msg = invalid userid/passwordcould you please suggest what could be the reasonYou are running Oracle on an unsupported operating system (Vista Home premium). You either need to change the OS or use the package meant for Windows Vista.
http://www.oracle.com/technology/software/products/database/oracle10g/htdocs/10203vista.html -
Userid/password in a popup dialog box?
When I sign on to the forums today either on an iPhone or Firefox in windows, I'm getting a popup box to enter userid/password instead of the usual Oracle single sign on page.
Is this something new?Seems to be a feature :-) Has happened many times before - it is typically corrected within a few hours
Where's my handle?
Handle not working
HTH
Srini -
Anybody done USERID/PASSWORD authentication against aWindows NT Domain
I think I'll have to write a C++ Program to the WinNT API to do it
(LogonUser). Then I'll wrap it with a service object for authentication. Has
it been done before? Or something similar? We want to validate users against
a WindowsNT Server DOMAIN.
-martin ([email protected])Hi Martin & All,
Yes you are right, wrap the API in C++/C then write a PEX file for interface to Forté and use the method to invoke the WinNT API authentication. Do not forget to validate the return values from the methods. They are very crucial in handling exceptions etc., in forte.
I've done the same to provide the mail user authentication in MAPI API wrapper for Forté.
Is this what you looking for????
Regards,
Sivaram S Ghorakavi mailto:[email protected]
International Business Corporation http://www.ibcweb.com/
From: Martin G Nystrom
Sent: Wednesday, November 26, 1997 1:53 PM
To: [email protected]
Subject: Anybody done USERID/PASSWORD authentication against a Windows NTDomain?
I think I'll have to write a C++ Program to the WinNT API to do it
(LogonUser). Then I'll wrap it with a service object for authentication. Has
it been done before? Or something similar? We want to validate users against
a WindowsNT Server DOMAIN.
-martin ([email protected]) -
Chang system userid/password for another server instance
It it possible to change the system userid/password for another server
instance. If so , how ?
I would like to allow certain groups to be able to start and stop ONLY their
server without giving out the system account.
Thanks in advance!the relationship between the infrastructure nodes and the application server nodes is a one to many relationship. The infrastructure home should be the only home that the EMWebsite service has been started for.
the user to log in to em console is ias_admin/<password> if it does not accept the password that you set for this user then try it with caps lock on as you may have had it one when setting the password.
As 9ias release 2 has been designed with a multiple machine install in mind, if you install more than one instance (multiple oracle homes) on the server then you will end up with multiple apache processes and oc4j processes. This means you will be able to connect to 2 apache server homepages under different ports. That is why you get the same page. -
Customise Userid/Password rule
HI
I want to set my own userid/password rule to the users.As per the standard, As per the requirement userid should be like below..
1) Only First letter should be Alphabet
2) Rest are Numeric.
3) Length should be 7.
Is it possible through configuration or I need to do some custom code ????
Thanks
ShashankHi Shashank,
Please check this link.
http://help.sap.com/saphelp_nw04s/helpdata/en/43/3d77734ae830f3e10000000a11466f/frameset.htm
Regards,
Siva
P.S: Award points if you find this useful. -
Invalid userid/password message
<p>We're using external authentication (Oracle), when the user'saccount is locked or expired, portal displays generic message"Invalid userid/password", we need to be able to tellthem why their login was denied so they can take the appropriateaction</p>
<p>Chris,</p><p> </p><p>I too have looked into this since my apps too have theseissues.</p><p>I have checked all documentation and contacted hyperion supportand I havent found a way to do it.</p><p> </p><p>If we write custom logon pages and then pass thevariable(username/password) to hyperion products , then we shouldbe able to do it. I havent done it but it definitely isplausible.</p><p> </p><p>If you get it to work without writing custom logon pages, pleaselet me know too.</p><p> </p><p>Good Luck !</p><p>thanks</p>
-
hi guise.
when i run oracle designer it's ask me user id / password...
i dont's know the userid password can u plz help me..When the repository was installed, it was installed under a repository owner which is an Oracle user in the repository's database. The repository owner in turn can use the Repository Administration tools to grant access to other Oracle users in the same database. These are given various levels of access, one of which allows them to create new containers using the Repository Object Navigator. They can then grant access to their containers to other users.
So you must go to your database administrator for the database containing your repository and ask for a username and password, then to the repository administrator and ask for that username to be granted access to the repository, and finally to the owners of any containers to which you need access. Fortunately, these are often all the same person - maybe you?
Maybe you are looking for
-
Every mac operating system software until Lion had the ability to use up/down arrows in the scroll bar. This makes it easy to move up and down in small increments. In Lion, it is impossible to move up and down in small increments. Click on the scr
-
Motion won't export just hangs
I've been using Motion more recently and was wondering about a few things. When exporting I often get a hang during exporting an HD project using the Sequence settings (ProRes 444). Motion just sits at frame 1 and doesn't advance. I have to force qui
-
Hi Experts, I have a PR and a PO with wrong cost center used. I'm trying to edit the cost center ( under account assignment tab ) but the field cannot be edited. The status of the PO was not yet released. Kindly advise if it's still possible to edit
-
I need to determine if an archive originated (created) on Windows or UNIX. This will give me a clue as to what the maximum path name length is for where the archive originated. Problem is when a UNIX archive gets decompressed on Windows and exceeds t
-
Incorrect dates on email message
Hi there, I've got my own email classes, and am formatting the date/time for the email as follows: EEE, d MMM yyyy HH:mm:ss Z The problem is that any email sent from this class arrives in my email box with a date/time 5 hours after the actual time. N