Portal Security

How is the security maintained for pages within the portal . Is it table
driven or is it driven through some other mechanism. I have looked at the
deployment descriptors of the beans and only the ones for administration
have roles defined for SystemAdministrators. The others are relatively for
anyone to use.
Thanks,
Arijith

Jim,
I have related question - but it goes further thant explaining the difference/relation
between security groups and roles.
We have based our development on your StockPortal application (In WLP 4.0/WLS 6.1)
I have set the Security Constraint in the web.xml to secure the all url patterns
"/*" I expect that when I point the browser to any URL within the portal application
whenever I am not logged in I first receive the Login page. But the actual result
is a Runtime Error page saying "Unable to locate portlet state" if the URL was from
a webflow sequence.
I have read elswhere in the Knowlegebase that the error page that appears can be
defined through the EBCC, still it does not answer the question, how is it with the
security mechanism?
Thank you
Ales
Jim Litton <[email protected]> wrote:
Arijith,
Reference the following message from this same newsgroup.
-------- Original Message --------
Subject: Re: Roles in portal
Date: Fri, 22 Mar 2002 20:46:54 -0700
From: Jim Litton <[email protected]>
Organization: BEA SYSTEMS Inc
To: Jeff <[email protected]>
Newsgroups: weblogic.developer.interest.portal
References: <[email protected]>
Think of roles as logical groups. Roles are assigned within each web
application (in the web.xml and weblogic.xml files). Rolese are web app
specific. Groups are defined outside of the web application in a
realm. Groups may be associated across many web apps.
A good example can be found in our wlcsApp. View the files in
wlportal4.0\applications\wlcsApp\wlcs\WEB-INF. You will find a
weblogic.xml file which contains a role mapping of a group. The group
specified in the wlcs weblogic.xml mapping is wlcs_customer which is
mapped to CustomerRole. wlcs_customer is defined in a realm (our RDBMS
ENTITY and GROUP_SECURITY tables).
As you place users in a group they are associated with a role.
Roles may be created through declarations with an application.xml file.
Find the application.xml file under
wlportal4.0\applications\wlcsApp\META-INF. There you will find the
declaration of CustomerRole.
Our edocs.beasys.com site discusses these points in more detail in the
section "Security Roles and Deployment Descriptors".
Jim Litton
Jeff wrote:
Hi
Could someone please clarify the distinction between roles and groupsin the
portal? How do I create roles? How do I associate a user to a role?
Thanks
- Jeff

Similar Messages

Oracle Forms and Portal. & Portal Security

I need the following questions answered for a client who is
trying to move from IIS to Oracle Portal. any pointers would be
extremely helpful
1. How to configure Oracle Forms to run with Portal.
2. Is it possible to display forms inside a Portlet. If so, will
the forms hold the same state when the page is refresed.
3. Is it possible to display WORD/PDF/EXECL documents in their
native format inside a Portlet.
4. Any information on how IIS security integration is possible
with POrtal. i.e ( if there are ASP pages running on IIS
security, how to integrate it with Portal Security mechanism
-Thanks
ganesh

You can create roles in Oracle with the appropriate privileges to access the application. For example,
you could create a role that has only read access to all the tables in the database. You could assign this role to the menu. Also, you may want a role for a manager that whould enable him to insert data or to see a few special forms. You could assign this role to the menu associated with the form.
Using Form Builder, you can manage menu security with Oracle server roles. After defining the roles to use for a menu module, you could then specify the roles that have access to each menu item. When you set the 'Use Security' property of a menu module to 'Yes', the form enforces security. After setting the 'Use Security' property to 'Yes', you can use 'Module Roles' property to construct the entire list of roles with access to that menu module.
I hope it helps.

How to get current IUser (com.sapportals.portal.security.usermanagement)

Hi,
does anybody know how to get IUser for the current user?
I know how to get current IUser from com.sap.security.api package:
IWDClientUser wdcu = WDClientUser.getCurrentUser();
IUser sapUser = wdcu.getSAPUser();
but I need to have IUser from com.sapportals.portal.security.usermanagement package.
Regards,
Ladislav

Ladislav,
Try this:
Get the IUser uisng the API com.sap.security.api.IUser and store it in a variable, say <i>sapUser</i>.
Then,
// Convert the logged in user to old EP5 usermanagement API
com.sapportals.portal.security.usermanagement.IUser user = null;
try
com.sapportals.portal.security.usermanagement.IUser user = WPUMFactory.getUserFactory().getEP5User(sapUser);
catch (UserManagementException e)
e.printStackTrace();
Bala

How to set portal security context for a procedure

Hi, I have procedure that needs to call some of the PDK APIs (WWSBR_API), but outside the scope of the web browser, i.e, automatically via a DBMS_JOB or queue. There is no HTML outputted, but rather a log entry made to a custom table.
The schema that this custom pkg belongs has all the necessary grants made to it from provsyns so that it should run.
How do I programatically set the context of the portal security so as to make the PDK APIs think it has been invoked by a Portal Adminstrator or a user with sufficient privs to perform the actions against the PDK and therefore not bomb out with security exceptions? I have seen this documented quite some time ago, but cannot find the details.
Regards
John

You need to use the wwctx_api.set_context procedure.
http://portalstudio.oracle.com/pls/ops/docs/FOLDER/COMMUNITY/PDK/plsql/doc/sdk11scp.htm

Doument Access - using Portal security or Document Database security

I originally posted this on the Security Form, but realized that it might be solved using the PDK.
I have a table in my database that contains information about a document (Name, Rev, Author, groups that have access). I want users to login to my portal and in a portlet, I want them to be able to click which docs they have access to see; based on who they are logged on as.
Would I use the PDK for this? If I use portal security, I think I will be maintaining the security twice (database and portal).

          Hi Wendell,
          There is a patch available for this known problem. Please contact BEA support and
          ask for patch CR075892_70.jar for WLS 7.0.
          Thanks!
          Deb
          Wendell Nichols <[email protected]> wrote:
          >I have the opposite problem. My ejb always is denied access to the adapter
          >resource. I'm a Weblogic novice, (but the adapter works on other servers,
          >I'm testing on WL to ensure it works there).
          >How do I get the minimum security in place to test my adapter?

Import com.sapportals.portal.security.usermanagement.IUser; is deprecated

import com.sapportals.portal.security.usermanagement.IUser; is deprecated
Is there any alternative???

Hi,
could please tell me, what kind of jar-file I have to add to the project to use
com.sapportals.portal.security.usermanagement.IUser ?
Thank you in advance.
Kind regards, Patrick.

IUser problem with com.sapportals.portal.security.usermanagement

I am trying to get the current user so I have written
IUser user = request.getUser();
I have imported com.sap.security.api.*;
The compiler insists I need com.sapportals.portal.security.usermanagement.IUser
I thought that version was deprecated or at least not the preferred method?
It keeps saying my classpath is incomplete. Why can't it use the IUser from the com.sap.security.api?
Any help would be greatly appreciated.
Thanks
Paul

Update
The offending line appears to be IResourceContext myContext = new ResourceContext(user);
when this line is added it causes the above error which I can only assume is because ResourceContext(user) accepts a different kind of user object. does anyone know if there is another way to do this? Here is the rest of the code to see where i am headed:
IUser user = req.getUser();
RID rid = RID.getRID("/temp");
IResourceFactory factory = ResourceFactory.getInstance();
IUserFactory uf = UMFactory.getUserFactory();
IResourceContext myContext = new ResourceContext(user); //this is the line causing the problems.
IResource resource = factory.getResource(rid, myContext);
if(resource.isCollection())
ICollection collection = (ICollection)resource;
IResourceList children = collection.getChildren();
Iterator i = children.listIterator();
the point is i am trying to get the ACL permissions on the children of the rid

Package com.sapportals.portal.security.usermanagement : No javadoc ?

Dear all,
I tried to find the javadoc concernig this package "com.sapportals.portal.security.usermanagement" but I did not find it.
Does anyone have any clue where to find it please ?
Thank you advance.
Best Regards.
Greg.

Hi Greg,
I think the reason you're not able to find is because com.sapportals.portal.security.usermanagement is now deprecated. For EP 6.0, the old classes have been re-written to map to the new UME 4.0 classes and methods contained in com.sap.security.api.
please see the document below for details...
USING THE NEW USER MANAGEMENT API IN EP 6.0
https://www.sdn.sap.com/irj/sevlet/prt/portal/prtroot/docs/library/uuid/91f0cd90-0201-0010-a190-c4d7cbd5b463
hope this helps,
harman

DC for com.sapportals.portal.security.usermanagement .IUser

Hello all,
When developing a local application I can reference class com . sapportals . portal . security . usermanagement . IUser via NWDS local libraries using ECLIPSE_HOME variable and referencing jar file com.sap.security.api.ep5.jar.
There is a standard DC that has this class or jar file?
Or should I add this JAR to an external library.
Regards,
Mauricio

Hi,
You will have to add this jar as an enternal library.
Ashu

Portal Security with existing JSP Applications

Hello,
we have some existing JSP Applications an want to include them into out portal. They are currently running on iAS as standalone applications. But we also want to protect them using portal security.
How is it possible to use Portal Security for those JSP Applications.
Regards,
Frank

Hello,
currently I don't need to include them as portlets.
I included the first Page as jsp Report... because of that, this jsp is secured. But my application has more jsps.
Probably I could set an sessionvariable in the first protected jsp and check it in all other jsps. If this sessionvar is not existing, the user is not allowed to see this application.
Currently I have no other idea.
Regards,
Frank

Portal Security 7.x documents

Hi
Can anyone please point me the link about Enterprise Portal Security document based on EP 7.x.
Thanks again

Hi Suresh,
Please refer the below link for Security, SSO, and Authentication. It would be of great help.
Award good points for useful answers.
http://help.sap.com/saphelp_erp2005/helpdata/en/42/ea2fcfb2201bdae10000000a11466f/frameset.htm
Regards,
Ramesh
Message was edited by: RAMESH PARAMESWARAN

Oracle Poratal Security Or Portal Security Infrastructure

We need to implement the Oracle Portal Application user for Authentication and Authorization. We have different pages for different user roles, so please help me how can I use "Oracle Poratal Security Or Portal Security Infrastructure" for securing porlets or pages from unauthorized accesss.

I suggest taking a look at chapter 6 - "Securing your Portal" of the OracleAS Portal Configuration Guide to get an idea of the security architecture and at the security-related information in the Portal User's Guide.
You can find these guides in the Application Server documentation library on OTN at http://www.oracle.com/technology/documentation/appserver101202.html

External Portal - Security Best Practice

We will be initiating an external portal for ESS access. For those using ESS from home, what type of additional security access is anyone using if the person happens to lock themselves out of their ESS account? Do you have a security question built into ESS? Are you using a security grid to reset their password? I'm looking to see what other alternatives people are using.
Thanks
Pam Major

Hi Tim: Here's my basic approach for this -- I create either a portal dynamic page or a stored procedure that renders an HTML parameter form. You can connect to the database and render what ever sort of drop downs, check boxes, etc you desire. To tie everything together, just make sure when you create the form, the names of the fields match that of the page parameters created on the page. This way, when the form posts to the same page, it appends the values for the page parameters to the URL.
By coding the entire form yourself, you avoid the inherent limitations of the simple parameter form. You can also use advanced JavaScript to dynamically update the drop downs based on the values selected or can cause the form to be submitted and update the other drop downs from the database if desired.
Unfortunately, it is beyond the scope of this forum to give you full technical details, but that is the approach I have used on a number of portal sites. Hope it helps!
Rgds/Mark M.

Portal security import/export errors ORA-01653

When doing a security export after a few attempts we are getting the following error
ORA-01653: unable to extend table PORTAL30.WWUTL_SEC_TX_PERSON$ by 2362205 in tablespace PORTAL
Details below
We referred the note related to ORA-01653 on metalink Note:151994.1 and tried the approaches mentioned but nothing seems to fix it.
Is there an isssue with the way the Portal scripts clean up the transport tables.
We are using pORTAL V 3.0.9.8.1 WITH 8.1.7 release of database
Connected to:
Oracle8i Enterprise Edition Release 8.1.7.1.0 - Production
With the Partitioning option
JServer Release 8.1.7.1.0 - Production
Extracting Security Data to transport tables...
Activity Log:
Clearing any existing security data from transport tables
Truncating table WWUTL_SEC_TX_GROUP$
Truncating table WWUTL_SEC_TX_MEMBER$
Truncating table WWUTL_SEC_TX_SYS_PRIV$
Truncating table WWUTL_SEC_TX_PERSON$
Truncating table WWUTL_SEC_TRANSPORT_TABLE$
Begin extracting security data of Portal
Extracting Security Data...
Global Privilege export flag set to: on... (ON = export global privilege, OFF =
do not export global privilege)
...Extracting Users...
WWUTL_API_SecurityTransport.ExtractPerson: ORA-01653: unable to exte
nd table PORTAL30.WWUTL_SEC_TX_PERSON$ by 2362205 in tablespace PORTAL
Disconnected from Oracle8i Enterprise Edition Release 8.1.7.1.0 - Production
With the Partitioning option
JServer Release 8.1.7.1.0 - Production
Export of Security Data Complete

Sudip,
Ravi is the authority in this area. I understand he is already working with you on this issue.
Thanks,
PE

WDA + External Portal + Security

Hello friends!
@Moderator, sorry if I post it in a wrong forum, but I think the wda experts should have already faced this issue.
I've been reading all forums regarding to this subject. As you are going to see, I'm not used to work with WDA Portal integrations and I'm studying hard for it.
Could you please just guide me what I have be aware to connect WDA from a ERP server to another server, which has installed the Portal? (portal is accessed externally/internet)
I'm afraid about security, as the employees will access the portal by internet (it's already working fine, today they can access the portal externally and can use some Webdynpros Java) But for now, we are going to rewrite these WDJ to WDA.
1) The portal server connecting WDA's from a ERP server, isn't it a best practice?
2) As it is already working (external access to the portal), for now I have just to create the iViews to the WDA's from ERP server?
3) What would be the security risk when people access the external link to the Portal and the Portal redirected it to the ERP?
I would greatly appreciate your help in only guide me.
Thanks in advanced!

Hello Alexandre,
Please find the answers to your queries.
Alexandre Mendes wrote:
> 1) The portal server connecting WDA's from a ERP server, isn't it a best practice?
Not at all, The composition Environment CE is intended for this purpose only.
Alexandre Mendes wrote:
> 2) As it is already working (external access to the portal), for now I have just to create the iViews to the WDA's from ERP server?
First you need to create a system connection in portal to the ERP server. Later you need to create the iViews
Alexandre Mendes wrote:
> 3) What would be the security risk when people access the external link to the Portal and the Portal redirected it to the ERP?
As per my knowledge there is no security risk involved because while accessing the WDA application from ERP the request will be authenticated again.
BR, Saravanan

Portal Security and ECC 6.0

I had posted this in another form, but was directed as I should go to post my questions:
I work with SAP security and I've been asked to look at portal roles. Specific questions I've been asked are:
Can user id's be export from SAP to the portal? If so, is there a SAP delivered program to use.
If a user logs into the portal via SSO or just logging into the portal, but doesn't have a user id in SAP; is there a SAP delivered process that will create an user id in SAP?
If the portal id is xxx and the SAP id is yyy, where is mapping done to allow the user access to SAP?
I'm hoping to find information to answer the above questions via white papers, URL's, or books.
Any help would appreciated,

Hi Stabley
The portal uses the Java system's UME settings for user management. One option is to point the Java UME to an ABAP system (6.20 or higher) and then the SU01 data is used for portal autherntications.
There is a self registration process, but I don't think you want it to create SAP users in the above scenario. Even if you did, the users would have no useful roles in SAP.
Having a different username for the portal and SAP is supported through user mapping, but it is messy to maintain.
Try search SDN for UME and ABAP to get some good information or try the portal wiki pages (link at the top of the forum)
Cheers

Portal Security

Similar Messages

Maybe you are looking for