Oracle Applications Security

Hi:
What do I need to know in terms of Oracle Application 11i system security?
Thanks.

user11192234 wrote:
May be it is because I don't know/haven't used API at all or don't like programming, I don't see it will be easier/faster using API than go into System Admin-->User to create/setup new users.
Please advice. (This is an interview question: how to you do when you need to enter many new users?)If you are asked to create 50 new users in EBS, you might be able to create them manually more quickly than with the API. However, you're also more likely to make data entry mistakes. On the other hand, if you take the time to create a script that uses the FND_USR_PKG API, you will have it for the next time that you need to add 50 users. :)
For what it's worth, there's also a 3rd-party utility called DataLoad that can be used to automate bulk data entry in Oracle Forms. But using the API is probably more re-usable in the long term.
Regards,
John P.
http://only4left.jpiwowar.com

Similar Messages

Oracle application security

Does anyone know where I can find more information about application security for 11i other that the standard 'system admin' user guide. I feel like there is tons of info. on database security but very little on application security issues, best practice, etc. Thanks.

Most of the non-network related services can be disabled.
cu
Andreas

Flex on Oracle Application Server 10g - security problems

Hi,
I'm working with Flex components (swf files), I'm trying to view them in a browser and i'm facing some security problems.
The server i'm trying to run the files on is: Oracle application server 10g on Unix server.
Please help me with the server's configuration to allow running swf files on it.
In the relation of Flex, there is a file that must be on the server's root named: "crossdomain.xml". This file defines which IPs can the swf object can take/get data from. Maybe there are configurations to that file that needs to be done on the server?
Thank you,
Inbal

No. Not only it isn't certified, but it is also impossible to run forms compiled with the 11g compiler with the 10g runtime. For 11g there is a install bundle for the developer suite / application server.
cheers

Security Evaluation of Oracle Application Server

Are there any published documents on security evaluation of Oracle Application Server?
Is it secure as a tool against some attacks, for example, are following vulnerabilities when applicable to the server dealt with or should be handled by application? :
failure to restrict url access,
broken authentication and session management
insecure cryptographic storage,
injection flaws
failure to restrict directory browsing
Are there available document that we can refer to on these issues?
Regards
Farbod

Thank you again.
Can you advise on this part of my message also?
"Also I see in oracle recommended architectures that there is a firewall between each http server and application server. Does the built in OHS in OAS provide the firewall? or I need to install another firewall?"
I am going to explain it but I think it is completely inconsistent with the thread title which I got some of my answers in, so let me start a new thread here:
Application Server Recommended Deployment Architectures, How to?
Thanks for your useful inputs.
Best Regards,
Farbod

Oracle Password Security - suppress messages and use an application message

We are implementing Oracle Password Security and I was wondering if the Oracle message can be suppressed?
Reason being, I would like to give an application message based on the return code from Oracle.
Thanks.

Maybe I haven't explained it properly or I'm misunderstanding something but the exception init doesn't seem to be working.
We have set up a security profile and have set the Oracle password security profile parameters:
•     failed_login_attempts
•     password_grace_time
•     password_life_time
•     password_lock_time
•     password_reuse_max
•     password_reuse_time
•     password_verify_function
As we know on connect, Oracle checks the security profile and if a users P/W will be expiring, Oracle prompts an internal message to the user, error code ORA-28002. Is there a way to suppress the internal Oracle message and somehow capture the error code?
Thanks

[SOLVED] Access denied by Application security check (3.0.1 on Oracle XE)

Cannot log in as admin. http://localhost:8080/apex/apex_admin
After entering user admin and password I receive a page that says:
Access denied by Application security check
Application access restricted to internal workspace users.
Return to application.
I can run Apex interface just fine, this only happens for the apex_admin login screen.
Help??!!??
===========
Resolution
===========
Logged on to INTERNAL workspace with admin username.
Message was edited by:
edkocol

Hello Spadafore,
Thank you, for your quick answer. I found another way, and it is solved.
=========
SOLUTION:
=========
Login as sys with sqlpus (sqlplus sys as sysdba )on the database and run this script:
update flows_030000.wwv_flow_fnd_user
set change_password_on_first_use ='N'
where lower(user_name) = 'admin'
commit
However it's worked, but the whole story strange a little bit...
I tried to logon (internal, admin, xxx), then I got this: Access denied by Application security check
When I tried logon with wrong password I got this: Invalid Login Credentials
Afterwards I run the script above, and try relogon, I got the password change page, but at this time it worked, and it is working now....
Tiboir

Emulating Oracle Applications Environment in BI Publisher Enterprise Server

Hi there,
I think I know what the answer is going to be to this post but for reasons outwith my control I'm trying to understand if there is a workaround to achieve the resultant report output I require.
Background
Oracle E-Business on Demand 11.5.10.2
Oracle BI Publisher 10.1.3.2
My client has Oracle E-Biz on Demand but rather than utilising the integrated XML Publisher engine they have gone down the path of installing BI Publisher Standalone Enterprise Server for their report generation.
Now this works to an extent but I am experiencing problems trying to emulate the setting of an Apps context when I run a report so that I can utilise the Apps security within the Stanalone Enterprise Server. Is this even possible?
Example, basing a data model on PO_VENDOR_SITES (multi-org view) returns 0 (zero) rows but basing it on PO_VENDOR_SITES_ALL returns all rows (for all Orgs).
I can hear you all now yelling, "Use the Oracle Applications XML Publisher" version but in this "On Demand" arena that practice hasn't been adopted so i am raising this post in the hope that someone may be able to suggest a workaround or solution.
Actually, no BI Publisher security model has been adopted and all users use the GUEST account to run reports.
All comments and suggestions are appreciated :-)
Kind Regards,
Gary.

Gary, create a data template and call your own db function to initialise these. The beforeReport trigger will fire and set the enviro prior to the query being executed (as in Reports) Something like this below:
<dataTemplate name="BasicQueryDT" description="Simple query data template" defaultPackage="xxbi_setenviro">
 <dataQuery>
 <sqlStatement name="basicQuery">
 <![CDATA[
select max(last_update_date) today from apps.pa_projects_v]]>
 </sqlStatement>
 </dataQuery>
 <dataTrigger name="beforeReport" source="xxbi_setenviro.before_rep"/>
 <dataStructure>
 <group name="G_Main" source="basicQuery">
 <element name="TheDate" value="today"/>
 </group>
 </dataStructure>
</dataTemplate>

Oracle Application Single Sign-On

Dear All,
We have a requirement that there should be single sign-on for the users to use both the Oracle and non-Oracle Applications. We are using Oracle Application Server 10g at the back end.
How to enable single sign-on. Is there any tool that we need to install.
Pls guide us as we are entirely new to this process.
Regards,
Rajani

Hi,
You need to install and configure Oracle Internet directory and Single Sign On compontents of Oracle Application server 10g in order to have the Single Sign On working with Oracle Applications. After the Oracle Application Server Infrastructure tier installation there is addition integration steps you need to follow to integrate the Single Sign on with Oracle E-business suite. You can use DIP features ( Directory Integration and Provisiotion) to integrate with Third party directory server like Micrososft AD, Sun directory server etc. for Integrating the non oracle based application i think you have to use oracle single sign on API and you need to do bit of coding as well. You can also enble single sign on for database users but this requires advance security option enabled on the Database side and finally you can integrate Single sign on for OS users as well.
Raj

SSL test in Oracle Application Server 10.1.2

Hi ,
we are using one Oracle Application Server Web Cache 10.1.2 as our web server.This redirects users to the Application Server.(EBS 12.0.4)
Now we need to implement SSL to secure user credentials.So i am planing to implement SSL in our web cacahe server.Will this be enough to secure user credentials??I dont have any idea.Please help.
Moreover our web cache is not configured in SSL during the time of installation.Can any body suggest me a place from where i could get one demo Certificate to put it onto my web server and test the SSL confiration.EBS has provided one demo for application tier(inside $ORACLE_HOME/apache/certs/).
But we will have to implement in web cahe tier not in application tier.
We are using EBS 12.0.4 in Hp-Ux v11.23.

Hi susmit;
Please chekc below note which could be helpful for your issue:
SSL Primer on Using OpenSSL as a Certificate Authority with E-Business Suite (with a Windows Example) [ID 1175193.1]
Enabling SSL in Release 12 [ID 376700.1]
R12.0.6+ : Oracle Application Object Library SSL Test Transaction Data Test [ID 732282.1]
R12.0.[3-4] : Oracle Application Object Library SSL Test Transaction Data Test [ID 564066.1]
Regard
Helios

How To View a Discoverer Report In Oracle Applications

Hi All
I have 1 problem...
Im using Oracle Discoverer 4i.
I have connected to Oracle Applications through Discoverer Administration and created a Business Area and created a report and able to see the report in Desktop Edition, which i connected to Oracle Applications in Desktop Edition also.
But now my question is how to see that Report in Oracle Applications when i connect to Oracle Applications through explorer and selecting a responsibility
when i connected to Oracle Applications im not getting the report which i have created.
Is it possible to view a report in Oracle Applications using Discoverer 4i..
Please can any 1 help it out ..its very urgent..
Thanks in Advance..

Hi,
You need to have an Apps mode EUL so that you logon with an Applications username and password. You then need to grant privileges to your responsibilities and also set security on your Business Areas so that they can be accessed by your responsibilities.
Once that is set up, you can create form functions so that you can add links to Discoverer reports in your Applications menus. Metalink Note 278095.1 explains how to do this.
Hope that helps,
Rod West

Client-cert auth impl in web.xml does not work in Oracle Application Server

Hi,
I am new to implementing security features on the web applications.. I have developed a new web service using jdev1012 and deployed in OAS 10.1.2. Its working fine according to the business requirements, but I am in need of implementing client-cert authentication to enable the web service available to only those who have client certificate.
My server details are:
Oracle Application Server 10g Release 2 (10.1.2)
Server certificate is in place and SSL mode have been already enabled.. able to access my web service through https://<mydomain.com>/myws/TreqWS as well able to see the WSDL file through https://<mydomain.com>/myws/TreqWS?WSDL.
I tried to include the following in my web.xml file as part of implementing CLIENT-CERT authentication.
<security-constraint>
<display-name>SecurityConstraint</display-name>
<web-resource-collection>
<web-resource-name>WSCollection</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>CLIENT-CERT</auth-method>
<realm-name>WSCollection</realm-name> 
</login-config>
It is not woking as expected, though I have restarted my oc4j container after including this content to the web.xml file. i.e, I am able to invoke the web service though my sample java client program, though I donot have client certificate/keystore.
I believe I am missing something..Can anyone help me in this regard to implement CLIENT-CERT authentication successfully?
Thanks,
Ms

I am having the same problem with doc and xsl. I have added this
<mime-mapping>
<extension>xls</extension>
<mime-type>application/vnd.ms-excel</mime-type>
</mime-mapping>
<mime-mapping>
<extension>doc</extension>
<mime-type>application/msword</mime-type>
</mime-mapping>
to my web.xml. I even restarted the server. I still see doc and xsl in binary.
Is there some other setting that needs to take place?
I am using WL6.1 with fixpack 1.
I can see the doc and excel files in the browser if I don't go through the weblogic
server. That just confirms it's not my browser.
Kumar Allamraju <[email protected]> wrote:
<!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
It works fine for me in 6.1 SP1.
 
If the following doesn't work , can you
 try application/winword instead of application/msword?
--
 Kumar
Siming Mu wrote:
<blockquote TYPE=CITE>Hi,
I setup in my web.xml a mime mapping as follows,
<mime-mapping>
 <extension>doc</extension><mime-type>application/msword</mime-type>
 </mime-mapping>
When I specify a test.doc url, the doc file appears in my browser
as
binary data
 instead of download.
Please reference change request 055002, which decribes this problem.
According
 to edocs, it has been fixed in wls6.1sp1.
But I am seeing it fixed. Am I doing anything wrong? Thanks.
Siming</blockquote>
</html>

Oracle Application Server 10g Release 2 (10.1.2.0.2) on 64bit RHEL

HI,
EBS-12.1.3
DB 11gR1
I am Facing following Error: while installing Oracle Application Server 10g Release 2 (10.1.2.0.2) on 64bit RHEL
pwd
pwd
/shared/bishiphome/Disk1/install/linux64
[oravis@erptest linux64]$./runInstaller -ignoreSysPreReqs
Starting Oracle Universal Installer...
Preparing to launch Oracle Universal Installer from /tmp/OraInstall2011-07-20_08-52-57AM. Please wait ...The Java RunTime Environment was not found at /tmp/OraInstall2011-07-20_08-52-57AM/jdk/jre/bin/java. Hence, the Oracle Universal Installer cannot be run.
Please visit http://www.javasoft.com and install JRE version 1.3.1 or higher and try again.
: No such file or directory
Should i install JRE in the Server
Thanks
Vishwa
Edited by: Vi**** on Jul 19, 2011 10:18 PM
Edited by: Vishwa on Jul 25, 2011 3:30 AM

HI,
Change the above to the following and see if you get any error:
$ /shared/bishiphome/Disk1/install/linux64/runInstaller ignoreSysPrereqs -jreLoc /usr/shared/bishiphome/Disk1/install/linux64/runInstaller ignoreSysPrereqs -jreLoc /usr
Starting Oracle Universal Installer...
Preparing to launch Oracle Universal Installer from /tmp/OraInstall2011-07-26_08-46-15AM. Please wait ...[oravis@erptest ~]$ Exception in thread "main" java.lang.ClassFormatError: oracle.as.install.engine.modules.install.exception.InvalidInventoryPointerException (unrecognized class file version)
at java.lang.VMClassLoader.defineClass(libgcj.so.7rh)
at java.lang.ClassLoader.defineClass(libgcj.so.7rh)
at java.security.SecureClassLoader.defineClass(libgcj.so.7rh)
at java.net.URLClassLoader.findClass(libgcj.so.7rh)
at java.lang.ClassLoader.loadClass(libgcj.so.7rh)
at java.lang.ClassLoader.loadClass(libgcj.so.7rh)
at oracle.sysman.oio.oioc.OiocOneClickInstaller.main(OiocOneClickInstaller.java:488)

How to use JavaMail 1.4 with Oracle Application Server 10g (9.0.4.0.0)

Hi all,
I'd like to know if it's possible and how to use JavaMail 1.4 with Oracle Application Server 10g (9.0.4.0.0), Windows version.
With the following code, I can see that the mail.jar used by the server is the one included in the jdk installation :
// I'm testing InternetAddress.class because I want to use commons-email-1.2.jar that requires mail.jar 1.4 (or higher) and activation.jar 1.1 (or higher)
// and I know that inside the commons-email-1.2.jar file, I need to call the InternetAddress.validate() method that throws a java.lang.NoSuchMethodError: javax.mail.internet.InternetAddress.validate()V if it is used with mail.jar 1.2.
Class cls = javax.mail.internet.InternetAddress.class;
java.security.ProtectionDomain pDomain = cls.getProtectionDomain();
java.security.CodeSource cSource = pDomain.getCodeSource();
java.net.URL location = cSource.getLocation();
System.out.println(location.toString());
This code returns : file:/C:/oracle/app/jdk/jre/lib/ext/mail.jar and this mail.jar file has an implementation version number: 1.2
- I've tried to include my own mail.jar (1.4.2) and activation.jar (1.1.1) files in the war file that I deploy, but it doesn't work (the server still uses the same mail.jar 1.2)
- I've tried to put the mail.jar (1.4.2) and activation.jar (1.1.1) files in the applib directory of my OC4J instance, but it doesn't work (the server still uses the same mail.jar 1.2)
- I know that a patch exists : I've read the following document: How to Make Libraries such as mail.jar and activation.jar Swappable ? [ID 552432.1]
This article talks about the Patch 6514136, but this patch only applies to : Oracle Containers for J2EE - Version: 10.1.3.3.0
Can you please help me ?
Thanks in advance for your answers,
Laurent

I strongly suggest to upgrade to AS 10.1.3 to get this.
Think of future support of AS 9.0.4. You will get not critical patch updates anymore.
--olaf

How to call a web Service from Oracle Applications?

Hi friends,
I've posted this question on OA Framework forum , but may be it's more appropiated put it here. Sorry for do it again:
It's about how to call a web service from a Form or a .sql (via Request) in Oracle Applications:
Could you please explain here the detailed steps (with code example if it's possible) to invoke a webservice from Oracle Applications?.. how did yo do it...?
I've read differents posts here and the 33097.1 metalink note (by the way, the first recommended link in this note is broken...), but there are lots of theorical concepts and no real examples to see how/from where invoke the WS
I'll have to call one webservice (I suppose the customer will give me the interface implementation)...but I've never did it with Applications so that's why I ask you for all the detailed steps...
I work with Forms 6i, Apps 11.5.10.2 and DB 9.2.0.7.
Thanks a lot.
Jose.

Hello Jose,
I did using java program to call BPEL web services in 11.5.10.
I pasted below the metalink note for your reference (Note:250964.1)
The idea is first write a java program to call the webservice (in my case it is calling an BPEL web service, so this may not help directly), test it.
Then port the java program as specified in the note, so that you could call your web service through concurrent manager scheduler.
Is this ok?
Thanks
Arun.
======================================================
Checked for relevance on 25-Apr-2007
Application Install - Version: 11.5.8 to 11.5.10
Goal
====
How to register and create a Java concurrent program for Oracle Applications
Release 11i
Solution
========
1. Create your Java Concurrent Program (JCP) , using a text editor.
/*===========================================================================+
| Concurrent Processing Sample Code |
| |
| FILENAME |
| Hello.java |
| |
| DESCRIPTION |
| Sample Java concurrent program |
| About the simplest possible program, just writes a message to the |
| logfile and output file. |
| |
| HISTORY |
| $Log$ |
| |
+===========================================================================*/
package oracle.apps.fnd.cp.sample;
import oracle.apps.fnd.cp.request.*;
public class Hello implements JavaConcurrentProgram {
public static final String RCS_ID = "$Header$";
public void runProgram(CpContext ctx) {
ctx.getLogFile().writeln("-- Hello World! --", 0);
ctx.getOutFile().writeln("-- Hello World! --");
ctx.getReqCompletion().setCompletion(ReqCompletion.NORMAL, "");
=======================================
End Sample
=======================================
2. Create a sample directory under $JAVA_TOP:
$ mkdir $JAVA_TOPoracle/apps/fnd/cp/sample
3. Copy Hello.java into $JAVA_TOP/oracle/apps/fnd/cp/sample:
$ cp $HOME/Hello.java $JAVA_TOP/oracle/apps/fnd/cp/sample
4. Compile your java program:
javac $JAVA_TOP/oracle/apps/fnd/cp/sample/Hello.java
5. Test at the command line with following syntax:
jre -Ddbcfile=$FND_TOP/secure/your_dbc_file.dbc \
-Drequest.outfile=./outfile \
oracle.apps.fnd.cp.request.Run \
oracle.apps.fnd.cp.sample.Hello
6. Register your custom java concurrent program with Oracle Applications.
a. Navigate: Concurrent > Program > Executable
b. Enter details into the form
Executable: JCPHELLO
Shortname: JCPHELLO
Application: Application Object Library
Execution Method: Java Concurrent Program
Execution File Name: Hello (Insert a name that does not contain space or period)
Execution File Path: oracle.apps.fnd.cp.sample
c. Save the details
d. Navigate: Concurrent > Program > Define
e. Enter details into the form
Program Name: JCPHELLO
Program Shortname: JCPHELLO
Application: Application Object Library
Executable: Choose JCPHELLO from LOV
Executable Options :
f. Save the details
7. Add this new concurrent request to your responsibility request group.
a. Navigate > Security > Responsiblity > Request
b. Query System Administrator
c. Add new row and choose TestJava
d. Save the changes.
8. Run your new Hello Java Concurrent Program
Navigate: Request > Run
References
~~~~~~~~~~~
Oracle Applications Developers Manual for Release 11i A75545-01
====================================================

Configuring Oracle Application Server to use a user friendly url

Hi All,
I am having trouble configuring the apache httpd.conf file within an applicaton server to be able to use user-friendly urls for the infrastructure identity management tools server. I also need this for security reasons as well as hardware reasons - loadbalancing.
At the moment I have a standard setup, whereby the sso application server is using port 7777. I would like the user not to enter the port, but to enter just a standard url, like http://login.<company>.com.au, so that if the user needs to modify oid using the oiddas web application, they can enter something like http://login.<company>.com.au/oiddas/ rather than http://<machine host name>:7777/oiddas/. This would also be used by portal for sso logins.
From the standard installation, Apache was configured as follows:
Port 7777
Listen 7777
ServerName <machine host name>
DocumentRoot <root document folder>
Now reading the documentation from the Oracle Application Server Installation notes for the Http Server, they document how to do this (in the loadbalancer section - this will eventually be used in the hardware setup):
Port 80
Listen 7777
Listen 80
# Virtual Hosts
# This section is mandatory for URLs that are generated by
# the PL/SQL packages of the Oracle Portal and various other components
# These entries dictate that the server should listen on port
# 7777, but will assert that it is using port 80, so that
# self-referential URLs generated specify www.oracle.com:80
# This will create URLs that are valid for the browser since
# the browser does not directly see the host server.oracle.com.
NameVirtualHost <machine ip>:7777
<VirtualHost <nameofmachine>:7777>
ServerName login.<company>.com.au
Port 80
</VirtualHost>
# Since the previous virtual host entry will cause all links
# generated by the Oracle Portal to use port 80, the server.company.com
# server needs to listen on 80 as well since the Parallel Page
# Engine will make connection requests to Port 80 to request the
# portlets.
NameVirtualHost <machine ip>:80
<VirtualHost <nameofmachine>:80>
ServerName login.<company>.com.au
Port 80
<VirtualHost>
Note that I used slightly different names for the url's rather than the oracle names www.oracle.com and server.oracle.com
Now after applying this, I noticed not only could I not go to the oiddas from the original machine name, but also couldnt go there from the new machine name.
Also I was not even able to go to the standard index page whereby you can go to the enterprise manager for the application server, from either names.
The following urls provide me with "The Page Cannot Be Displayed" error message:
http://login.<company>.com.au:7777/
http://<nameofmachine>:7777/
The following urls provide me with "Page Under Construction" error message:
http://login.<company>.com.au/
http://<nameofmachine>/
Could someone please tell me why this is the case, considering I am using the installation procedures Oracle has published within the Oracle Http Server Admistrators Guide (http://download-west.oracle.com/docs/cd/B14099_19/web.1012/b14007/netconf.htm#sthref379).
Cheers
Rodney

Hi Rondey,
Ik think that I can see your probleem.
Just change the following line at your httpd.conf, then restart the component.
First of all if the port is installed with nr. 7777. then the listen process will be on port 7778
the second thing is just try to do the following steps
((Port 80 to Port 7777)))
Listen 7778
%%%% In loadbalancer section %%%%%%
just add the following lines
Listen 80
Listen 8103
Listen 8102
NameVirtualHost *
NameVirtualHost *:8103 or 80
If you want to use this ports (8103 or 8102) for other site (url), then
<VirtualHost *:80>
ServerName <machine ip> or (host name)
Hear from U,
Regards,
Hamdy

Oracle Applications Security

Similar Messages

Maybe you are looking for