Proxy authentication with 5800

Hi, I've a 5800. With domestic WiFi all works fine. In the university WiFi I need to authenticate to a proxy server but, while the proxy address and port is present in the configuration window, username and password are asked only through web browser. This means that only web browser works while email and other programs (nimbuzz, opera mini, sport tracker, accuweather, ecc, ecc) don't.
I also tried the simple unix form usernameassword@address instead of the simple address of proxy server but the infos are ignored.
Is it possible to specify in some way this info as part of the connection? Or at least is it planned to add them in a future firmware release (At the moment I'm using release 21)?
Thanks
Walter

I totally agree with Walter.
When the Internet connection you'd like to use has a proxy that REQUIRES AUTHENTICATION, the only online application that can be used is the built-in browser because it asks for user and password.
This is a shame. It would This kind of configuration should be done at the same place you can specify the proxy address and port.
Suzuki

Similar Messages

WWSAPI - Cannot connect to web service via SSL and HTTP proxy authentication with NTLM, errorCode 0x803d0016, HTTP status 407

Hi,
I built a web service client using WWSAPI. The connection works via SSL (without HTTP proxy) and it works with SSL and proxy with basic authentication as well. When I try to connect using a proxy with NTLM authentication, then I get the errorCode
0x803d0016, HTTP status "407 (0x197)", "Proxy Authentication Required".
In WireShark I see only one HTTP request to connect to the proxy with NTLM Message Type: NTLMSSP_NEGOTIATE. The HTTP Response returns Status 407 and the connection ist closed. Comparing this to Internet Explorer - the Connection is not closed and
a second request with NTLMSSP_AUTH is sent.
Why doesn't it make the complete NTLM handshake? Why wasn't sent the NTLMSSP_AUTH directly?
I oriented in the HttpCalculatorWithKerberosOverSslClientExample.
Using WS_HTTP_HEADER_AUTH_SECURITY_BINDING,
WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_SCHEME was set to WS_HTTP_HEADER_AUTH_SCHEME_NTLM, WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_TARGET to WS_HTTP_HEADER_AUTH_TARGET_PROXY. I tried WS_DEFAULT_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE but also WS_STRING_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE.
Any idea?
Thanks

Hi,
I built a web service client using WWSAPI. The connection works via SSL (without HTTP proxy) and it works with SSL and proxy with basic authentication as well. When I try to connect using a proxy with NTLM authentication, then I get the errorCode
0x803d0016, HTTP status "407 (0x197)", "Proxy Authentication Required".
In WireShark I see only one HTTP request to connect to the proxy with NTLM Message Type: NTLMSSP_NEGOTIATE. The HTTP Response returns Status 407 and the connection ist closed. Comparing this to Internet Explorer - the Connection is not closed and
a second request with NTLMSSP_AUTH is sent.
Why doesn't it make the complete NTLM handshake? Why wasn't sent the NTLMSSP_AUTH directly?
I oriented in the HttpCalculatorWithKerberosOverSslClientExample.
Using WS_HTTP_HEADER_AUTH_SECURITY_BINDING,
WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_SCHEME was set to WS_HTTP_HEADER_AUTH_SCHEME_NTLM, WS_SECURITY_BINDING_PROPERTY_HTTP_HEADER_AUTH_TARGET to WS_HTTP_HEADER_AUTH_TARGET_PROXY. I tried WS_DEFAULT_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE but also WS_STRING_WINDOWS_INTEGRATED_AUTH_CREDENTIAL_TYPE.
Any idea?
Thanks

Toplink Proxy Authentication with 10.1.3 problem

Hi,
I'm are using Toplink Proxy Authentication in a JSF application with SessionFacade pattern and have implemented a preLogin() method of oracle.itech.pil.utils.PILSessionEventManager (which implements SessionEventListener) as described in
http://www.oracle.com/technology/products/ias/toplink/doc/1013/main/_html/dblgcfg008.htm. Due to Class Loader problem while loading of SessionEventManager, I'm explicitly loading the Class by doing this:
try {
Thread.currentThread().getContextClassLoader().loadClass("oracle.itech.pil.utils.PILSessionEventManager");
catch(Exception exp) {
System.out.println("Exception while loading class oracle.itech.pil.utils.PILSessionEventManager "+exp.toString());
The SessionEventManager is loaded by doing this:
session.getEventManager().addListener(new PILSessionEventManager());
(Encountered while using <event-listener-class>oracle.itech.pil.events.PILSessionEventManager</event-listener-class> in sessions.xml file, so removed and added the same using session.getEventManager().addListener(new PILSessionEventManager()) )
But now, I'm encountering ClassCastException during the login to my application
The below pasted exception (oracle.oc4j.rmi.OracleRemoteException: java.lang.ClassCastException: oracle.itech.pil.utils.PILSessionEventManager) is coming when invoking line (Login)session.readObject(oracle.itech.pil.model.Login.class, expression);
Code :
XMLSessionConfigLoader xmlLoader =
new XMLSessionConfigLoader("META-INF/sessions.xml");
SessionManager sessionMgr = SessionManager.getManager();
DatabaseSession session =
(DatabaseSession)sessionMgr.getSession(xmlLoader, "serverSession",
SessionFacadeEJBBean.class.getClassLoader());
// Set Listener through Java code
//session.getEventManager().addListener(new PILSessionEventManager());
new PILSessionEventManager();
System.out.println("I am at getLoginDetails after the listner...>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>");
Login login = null;
LoggedInBB loggedIn = null;
ExpressionBuilder builder = new ExpressionBuilder();
Expression expression = null;
// If username is not null
System.out.println("The _uname is "+_uname);
if (_uname != null) {
expression = builder.get("uname").equalsIgnoreCase(_uname).and(builder.get("empno").equalsIgnoreCase(_empNo));
if (expression != null) {
System.out.println("expression != null >>>>>>>>>>>>>>");
//login = (Login)session.readObject(oracle.itech.pil.model.Login.class, expression);
login =(oracle.itech.pil.model.Login) (session.readAllObjects(oracle.itech.pil.model.Login.class, expression)).get(0);
System.out.println("Login Object is "+login);
Exception:
[TopLink Info]: 2006.05.02 05:04:18.703--ServerSession(21707422)--TopLink, version: Oracle TopLink - 10g Release 3 (10.1.3.0.0) (Build 060118)
[TopLink Info]: 2006.05.02 05:04:22.619--ServerSession(21707422)--serverSession login successful
06/05/02 17:04:22 I am at getLoginDetails after the listner............>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
06/05/02 17:04:22 The _uname is admin
06/05/02 17:04:22 expression != null >>>>>>>>>>>>>>
[TopLink Warning]: 2006.05.02 05:04:22.639--ServerSession(21707422)--java.lang.ClassCastException: oracle.itech.pil.utils.PILSessionEventManager
oracle.oc4j.rmi.OracleRemoteException: java.lang.ClassCastException: oracle.itech.pil.utils.PILSessionEventManager
     at com.evermind.server.ejb.EJBUtils.getUserException(EJBUtils.java:333)
     at com.evermind.server.ejb.interceptor.system.AbstractTxInterceptor.convertAndHandleMethodException(AbstractTxInterceptor.java:69)
     at com.evermind.server.ejb.interceptor.system.TxSupportsInterceptor.invoke(TxSupportsInterceptor.java:39)
     at com.evermind.server.ejb.interceptor.InvocationContextImpl.proceed(InvocationContextImpl.java:69)
     at com.evermind.server.ejb.interceptor.system.DMSInterceptor.invoke(DMSInterceptor.java:52)
     at com.evermind.server.ejb.interceptor.InvocationContextImpl.proceed(InvocationContextImpl.java:69)
     at com.evermind.server.ejb.StatelessSessionEJBObject.OC4J_invokeMethod(StatelessSessionEJBObject.java:86)
     at SessionFacadeEJB_StatelessSessionBeanWrapper2.getLoginDetails(SessionFacadeEJB_StatelessSessionBeanWrapper2.java:172)
     at oracle.itech.pil.backing.LoginBB.LoginButton_action(LoginBB.java:182)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:585)
     at com.sun.faces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:126)
     at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:72)
     at oracle.adf.view.faces.component.UIXCommand.broadcast(UIXCommand.java:211)
     at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:267)
     at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:381)
     at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:75)
     at com.sun.faces.lifecycle.LifecycleImpl.phase(LifecycleImpl.java:200)
     at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:90)
     at javax.faces.webapp.FacesServlet.service(FacesServlet.java:197)
     at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:64)
     at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._invokeDoFilter(AdfFacesFilterImpl.java:367)
     at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._doFilterImpl(AdfFacesFilterImpl.java:336)
     at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl.doFilter(AdfFacesFilterImpl.java:196)
     at oracle.adf.view.faces.webapp.AdfFacesFilter.doFilter(AdfFacesFilter.java:87)
     at com.evermind.server.http.EvermindFilterChain.doFilter(EvermindFilterChain.java:15)
     at oracle.itech.pil.utils.PILFilter.doFilter(PILFilter.java:124)
     at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:627)
     at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:376)
     at com.evermind.server.http.HttpRequestHandler.doProcessRequest(HttpRequestHandler.java:870)
     at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:451)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:299)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:187)
     at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
     at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:303)
     at java.lang.Thread.run(Thread.java:595)
     Nested exception is:
java.lang.ClassCastException: oracle.itech.pil.utils.PILSessionEventManager
     at oracle.toplink.sessions.SessionEventManager.preExecuteQuery(SessionEventManager.java:508)
     at oracle.toplink.publicinterface.Session.executeQuery(Session.java:976)
     at oracle.toplink.publicinterface.Session.executeQuery(Session.java:938)
     at oracle.toplink.publicinterface.Session.readAllObjects(Session.java:2458)
     at oracle.itech.pil.ejb.SessionFacadeEJBBean.getLoginDetails(SessionFacadeEJBBean.java:399)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:585)
     at com.evermind.server.ejb.interceptor.joinpoint.EJBJoinPointImpl.invoke(EJBJoinPointImpl.java:35)
     at com.evermind.server.ejb.interceptor.InvocationContextImpl.proceed(InvocationContextImpl.java:69)
     at com.evermind.server.ejb.interceptor.system.DMSInterceptor.invoke(DMSInterceptor.java:52)
     at com.evermind.server.ejb.interceptor.InvocationContextImpl.proceed(InvocationContextImpl.java:69)
     at com.evermind.server.ejb.interceptor.system.TxSupportsInterceptor.invoke(TxSupportsInterceptor.java:37)
     at com.evermind.server.ejb.interceptor.InvocationContextImpl.proceed(InvocationContextImpl.java:69)
     at com.evermind.server.ejb.interceptor.system.DMSInterceptor.invoke(DMSInterceptor.java:52)
     at com.evermind.server.ejb.interceptor.InvocationContextImpl.proceed(InvocationContextImpl.java:69)
     at com.evermind.server.ejb.StatelessSessionEJBObject.OC4J_invokeMethod(StatelessSessionEJBObject.java:86)
     at SessionFacadeEJB_StatelessSessionBeanWrapper2.getLoginDetails(SessionFacadeEJB_StatelessSessionBeanWrapper2.java:172)
     at oracle.itech.pil.backing.LoginBB.LoginButton_action(LoginBB.java:182)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:585)
     at com.sun.faces.el.MethodBindingImpl.invoke(MethodBindingImpl.java:126)
     at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:72)
     at oracle.adf.view.faces.component.UIXCommand.broadcast(UIXCommand.java:211)
     at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:267)
     at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:381)
     at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:75)
     at com.sun.faces.lifecycle.LifecycleImpl.phase(LifecycleImpl.java:200)
     at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:90)
     at javax.faces.webapp.FacesServlet.service(FacesServlet.java:197)
     at com.evermind.server.http.ResourceFilterChain.doFilter(ResourceFilterChain.java:64)
     at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._invokeDoFilter(AdfFacesFilterImpl.java:367)
     at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl._doFilterImpl(AdfFacesFilterImpl.java:336)
     at oracle.adfinternal.view.faces.webapp.AdfFacesFilterImpl.doFilter(AdfFacesFilterImpl.java:196)
     at oracle.adf.view.faces.webapp.AdfFacesFilter.doFilter(AdfFacesFilter.java:87)
     at com.evermind.server.http.EvermindFilterChain.doFilter(EvermindFilterChain.java:15)
     at oracle.itech.pil.utils.PILFilter.doFilter(PILFilter.java:124)
     at com.evermind.server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java:627)
     at com.evermind.server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java:376)
     at com.evermind.server.http.HttpRequestHandler.doProcessRequest(HttpRequestHandler.java:870)
     at com.evermind.server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java:451)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:299)
     at com.evermind.server.http.AJPRequestHandler.run(AJPRequestHandler.java:187)
     at oracle.oc4j.network.ServerSocketReadHandler$SafeRunnable.run(ServerSocketReadHandler.java:260)
     at com.evermind.util.ReleasableResourcePooledExecutor$MyWorker.run(ReleasableResourcePooledExecutor.java:303)
     at java.lang.Thread.run(Thread.java:595)
Any clue why this error, which i am facing since 10 days to complete my task
Thanks In Advance
Prashant

James, what Venkat and Prashant are trying to do is something like this...
1. If I connect to the DB using scott/tiger then in the preLogin method of the Toplink Session Listener class, the proxy user will connect using something like admin/welcome1 and in the database audit view, the name that shows up SHOULD BE that of admin and NOT of scott. This is called proxy authentication if it works fine.
We developed the above scenario but in the audit logs, we still see scott instead of admin as the user who connected.
2. This feature is available in the DB but our objective is to use it through TopLink
Also see Toplink Proxy Authentication Not Working
I hope I was able to explain the scenario clearly.
Any help will be appreciated
Regards,
Amit

Proxy Authentication with JDBC Datasource instead of JDBC URL?

Hello,
A requirement for my current project (ADF 10g) is that a user should be able to log in with his regular database account. For the moment, this is implemented using Proxy Authentication, as described in the following article:
http://blogs.oracle.com/jheadstart/2008/01/using_proxy_authentication.html
For now, we are using a JDBC URL defined in the application module config for the BC. In short: a ProxyAuthConnectionPoolManager class was created that overrides the default ConnectionPoolManagerImpl. The getConnection method has been overridden to create a standard connection (with the username/pw defined on the AM), and additionally, create a proxy connection within this connection with the specific user credentials. The (simplified) code:
    public Connection getConnection(String key, String url, Properties props, String username, String pwd) {
        // first fetch a default connection from the pool through the superclass
        Connection connection = super.getConnection(key, url, props, username, pwd);
        // cast into an OracleConnection
        OracleConnection oraConnection = (OracleConnection) connection;
            // close any proxy sessions that would still exist on the connection
            if (oraConnection.isProxySession()) oraConnection.close(OracleConnection.PROXY_SESSION);
            // get a handle on the session scope
            Map sessionScope = ADFContext.getCurrent().getSessionScope();
            if (sessionScope != null) {
                // find the user object in the session (the account the user logs in with)
                ProxyAuthUser user = (ProxyAuthUser) sessionScope.get(ProxyAuthUser.JHS_USER_KEY);
                if (user != null) {
                    // create a property map with the end user credentials
                    Properties proxyProps = new Properties();
                    proxyProps.put(OracleConnection.PROXY_USER_NAME, user.getDbUsername() + "/" + user.getDbPassword());
                    proxyProps.put(OracleConnection.PROXY_USER_PASSWORD, user.getDbPassword());
                    // open the proxy session
                    oraConnection.openProxySession(OracleConnection.PROXYTYPE_USER_NAME, proxyProps);
            return oraConnection;
    }Now, this works perfectly when using a JDBC URL. But when I switch the JDBC Datasource the ProxyAuthConnectionPoolManager class is not called anymore. This is all done in code in the Application Server. While using a JDBC Datasource is actually necessary: otherwise for each environment (dev, test, production,...) a different WAR file is needed.
What class can I override with code similar to the piece above, to open a proxy connection inside the existing connection, when using a JDBC Datasource?
Your help would be greatly appreciated!
Chris

Hello Krasimir,
Frank Nimphius gave me the solution to this problem. The prepareSession is indeed the best place to put the code:
   private OracleConnection oconn = null;
   public void prepareSession(SessionData SessionData) {
      super.prepareSession(SessionData);
      oconn = ((PrxyTransactionImpl)this.getDBTransaction()).getPrxyConnection();
      // Specify the user that connects through the proxy user and its roles
      Properties prop = new Properties();
      prop.put(OracleConnection.PROXY_USER_NAME,"hr");
      prop.put(OracleConnection.PROXY_USER_PASSWORD,"hr");
      //prop.put(OracleConnection.PROXY_ROLES, roles);
      // Open the proxy session (DB-authenticated users)
      try {
         oconn.openProxySession(OracleConnection.PROXYTYPE_USER_NAME, prop);
      catch (SQLException e) {
         // Close the connection, to avoid connection to remain open after exception
         oconn.abort();
         e.printStackTrace();
   }But Frank also created the following helper classes to extend the ADF BC behavior:
   package oracle.sample.dbprxy.adfbc;
   import oracle.jbo.server.DBTransactionImpl2;
   import oracle.jbo.server.DatabaseTransactionFactory;
    * TransactionFactory that returns PrxTransactionImpl, which is a subclass of
    * DBTransactionImpl2
    * @author Frank Nimphius
   public class PrxyDatabaseTransactionFactory extends DatabaseTransactionFactory {
      public PrxyDatabaseTransactionFactory() {
         super();
       * Override the create method to return an instance of PrxyTransactionImpl instead
       * of DBTransactionImpl2
       * @return PrxyTransactionImpl
      public DBTransactionImpl2 create() {
         return new PrxyTransactionImpl();
   package oracle.sample.dbprxy.adfbc;
   import oracle.jbo.server.DBTransactionImpl2;
   import oracle.jdbc.internal.OracleConnection;
   public class PrxyTransactionImpl extends DBTransactionImpl2 {
      public PrxyTransactionImpl() {
         super();
       * The DBTransactionImpl2 does not expose the connection in a public
       * method. This class is a wrapper to expose the connection to the
       * BC app, so it can be accessed in the ApplicationModuleImpl class
       * @return OracleConnection - SQL Connection
      public OracleConnection getPrxyConnection() {
         return (OracleConnection) this.getJdbcConnection();
   }In the configuration of your Application Module, you have to set the property "TransactionFactory" (normally the last one in the list) to oracle.sample.dbprxy.adfbc.PrxyDatabaseTransactionFactory. This way, the DBTransaction() of your AM will have a getPrxyConnection() method and you will have the connection at your disposal. You won't need the createPreparedStatement in your code anymore.
To close the connection, this is the code behind my "logout button" on the backing bean. Application Module Pooling and Connection Pooling will take care of the rest for you!
   ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
   HttpSession session = (HttpSession)ectx.getSession(false);
   session.invalidate();Another thing: be sure to set the internalconnection property to a different JDBC Datasource (or file based) than the one you are using to connect to the database (the default value). Otherwise connection pooling will be confused and there will be too much pending database connections.
This works for me, all sessions are closed in time and logging out seems secure. I do not have my complete, adjusted code here at my disposal, but next week, when I'm back at work, I'll have a look to see if there is anything I forgot to mention. So this should get you started, but I'll keep you posted!
A huge thank you to Frank again for helping me (/us) out with this problem!! And sorry I forgot to post the answer here sooner. I was too busy with testing it. :-)
Regards,
Chris

Proxy authentication with WebStart

I am trying to understand how WebStart handles proxy authentication for HTTP between my WebStart client and the server.
WebStart prompts the user for the proxy userid/password when my application starts. This occurs when WebStart attempts to download the jars.
However, now my application starts and wants to start communicating with the host. I am using URLConnection to make HTTP requests back to the same server.
My question is: "How does WebStart help with the proxy authentication for MY http requests?"
Does it insert the correct Authentication header on every HTTP request I create?

I am trying to understand how WebStart handles
WebStart prompts the user for the proxy
userid/password when my application starts. This
occurs when WebStart attempts to download the jars.
However, now my application starts and wants to start
communicating with the host. I am using URLConnection
to make HTTP requests back to the same server.
My question is: "How does WebStart help with the proxy
authentication for MY http requests?"
Does it insert the correct Authentication header on
every HTTP request I create?Let's split this in two topics.
1. How is proxy authenication supposed to work
2. What does Web Start
Easiest way to figure out Web Start's behaviour is to do some network monitoring. On a Unix box use something like tcpdump to monitor the raw packet traffic and strings|grep for URLs. (There is more advanced monitor software available). Fire up Web Start, authenticate. Watch. You need admin priviledges of course.
Second method would be to analyse Web Start sources, which is available under the Sun community license.
Now comes the interesting question, who proxy authentication is supposed to work.
I had this problem some years ago, when our application was tested from within a corporate network that used a proxy that demanded authentication.
The tricky part was, that our database server asked for an authentication too!
So one would have to provide a (user:password) pair to the proxy and another (user:password) pair to the web server in front of the database.
At that time I found no solution.
To my best knowledge there is only one http-authentication header in the HTTP header section possible, that carries the base64 encoded (user:password) pair. But I would need two and some means to tell which header of the two is for the proxy and which for the destination web server.
Second, HTTP is a stateless protocol. This means every HTTP request has no state in common with the HTTP requests before and after.
Analysis of the just open sourced Mozilla code base showed that Netscape handles proxy authentication against this design rule. Netscpae just issues the same HTTP request for the doc two times. The first time with authentication for the proxy, then the proxy seems to memorize that particular request (so much for the statelessness), and when Netscape fires the second HTTP request, this time with authentication for the destination server, the proxy just lets this request through (BIG BIG security hole here) and the authentication is not fished out by the proxy but will arrive at the destination server.
I was not able to find out at that time, if this behaviour was handled by any standard/RFC. What would happen if 5 proxies with authorization request were between me and the target server?
Hope this helps somehow.
Marc

How to pass Proxy user dynamically in Toplink proxy authentication?

Hi,
I'm using Toplink Proxy Authentication with my ADF JSF application and want to pass the Proxy user dynamically to the preLogin(..) method of mySessionEventListener (Currently proxy user is hard coded).
This is to make my application user as the Proxy user.
I have tried to do this in two ways:
1) In my Login screen Backing Bean, I retrieve the session as
session = sessionFactory.acquireSession(); and set the application user in it as
session.setProperty("proxyUser1", inputText1.getValue());
But,
session.getProperty("proxyUser1") returns null in the preLogin(..) method
2) I add a loginUser property to the mySessionEventListener class and create a constructor to set it.
Then I call the constructor from my Login Backing Bean as
mySessionEventListener eventMgr = new mySessionEventListener(<proxy_user>);
session.getEventManager().addListener( eventMgr );
But, the loginUser property seeems to be transient and does not retain value when retrieved in preLogin(..) method.
Please indicate if anything is wrong. Also, is there any other way to get this done?
Thanks in advance.
Vikas

Hi Vikas,
Probably your sessions.xml defines a ServerSession, and acquireSession method returns a ClientSession. ServerSession is the object that connects to the database, it may have any number of ClientSessions associated with it - all of them use connections provided by ServerSession's connection pools.
So if you'd like to alter the serverSession before login, acquireSession is too late - it triggers login of the ServerSession and returns a ClientSession.
To get the ServerSession before login:
// the first param indicates that the session shouldn't be connected
Session serverSession = sessionFactory.getSharedSession(false, false);Now you have a serverSession on which login hasn't been called yet.
You can set the property into the session, or directly into its login.
In fact you may choose to do whatever you wanted to do in preLogin right here - in this case no preLogin event would be required of course.
Finally to get a ClientSession, call the same api did:
// the first param indicates that the session shouldn't be connected
Session clientSession = sessionFactory.getSession();On the first such call the ServerSession will be connected.
Note that because all the ClientSessions will connect through the connections provided by the same ServerSession they will all use proxyUser1.
If you are interested in using different proxy users for different ClientSessions http://www.oracle.com/technology/products/ias/toplink/doc/1013/main/_html/dblgcfg008.htm#BABDABCF lists several scenarios for that.
Andrei

N-Tier proxy authentication.

I need to implement N-Tier proxy authentication, could some one point me to right link. I found some on the Oracle Doc, buts not helping me , because it does not provide any code or example.
http://download-west.oracle.com/docs/cd/B13789_01/network.101/b10777/authuser.htm#1006352
and
http://download-west.oracle.com/docs/cd/B10501_01/appdev.920/a96590/adgsec03.htm#1004584
We have 9iAS, OID and 9iDB Rel2 and some other application server ie Cold Fusion etc, application are written in Cold Fusion and user login , I would like them to be authenticated via OID. I donot want to create a dtabase user for every application user too. We would like to use OID, however, we are also planning to use Fine Grained Security Control ( FGSC) too for row level security.
Thanks
Suhail

Bad news
Basically it is only supported when via Oracle Portal. I am not sure of the exact implementation and how it may work with providers for oracle portal.
Now the good news,
I have a way by implementing a couple of simple internal pl/sql packages that mod_plsql utilizes you can support n-tier proxy authentication with certs with or without Oracle SSO.

My app store is not working after installing mavericks. When I open app store it repeatedly asking me to login with apple ID and to provide User name and Password for proxy authentication in a loop.I am a newbie to mac,Please help me.

My app store is not working after installing mavericks. When I open app store it repeatedly asking me to login with apple ID and to provide User name and Password for proxy authentication in a loop.I am a newbie to mac,Please help me.

Hmmmm... would appear that you need to be actually logged in to enable the additional menu features.
Have you tried deletting the plists for MAS?
This page might help you out...
http://www.macobserver.com/tmo/answers/how_to_identify_and_fix_problems_with_the _mac_app_store
Failing that, I will have to throw this back to the forum to see if anyone else can advise further.
Let me know how you get on?
Thanks.

Administration of APEX in SQL Developer with Proxy Authentication impossibl

Hello!
We are using latest version of SQL Developer to administer APEX. We are connecting to the database with proxy authentication. The syntax is:
personal_user[apex_ws_owner]
e.g.: mdecker[apex_demo]
When trying to deploy APEX application I go to "Database Object" -> Application Express -> Application1 [100] -> right mouse click: "Deploy Application". Then I select the appropriate database identifier and next, I am presented with a screen showing import options. In second line, it says: "Parsing Schema: MDECKER".
This is wrong: it has to be Parsing Schema: APEX_DEMO. It seems that managing APEX with SQL Developer does not support Proxy Authentication.
Could you please confirm?
Is there a way to formally ask for this enhancement?
Best regards,
Martin
Update:
I found out that if I check the flag "Proxy Authentication" in the connect details and provide both passwords, the deploy application parsing schema is set to the correct APEX_DEMO account. However, we are using Proxy Authentication in order to avoid having to know the application password.
Edited by: mdecker on Jan 28, 2013 4:48 PM

There is a write-up about connecting to APEX here: <a href ="http://www.oracle.com/technology/products/database/application_express/html/sql_dev_integration.html" >SQL Dev Oracle APEX Integration</a>
<p>You do need to have updated to Oracle APEX 3.0.1.
<p>Regards <br>
Sue

Proxy Authentication Error in Web Service with SAAJ on Weblogic 9.2 MP3

Hi,
I have encountered a problem with proxy authentication in SAAJ web service (WS) calls on Weblogic 9.2 MP3.
My WS client (which uses SAAJ's SOAP classes) should use a proxy that requires authentication to call the external web services.
However, it does not perform the authentication and receives HTTP Error 407 - Unauthorized.
The reason seems to be that Weblogic's Http Handler (weblogic.net.http.Handler) ignores the proxy authentication.
I was able to work around it by setting sun's http handler explicitly in the WS endpoint URL. Sun's handler (sun.net.www.protocol.http.Handler) makes use of the Authenticator class I provided.
1. Please see my code below and let me know if this is the only solution or if I'm doing something wrong. While testing on Tomcat I did not have to set the handler.
2. I have seen that there are also System properties for http.proxyUser and http.proxyPasword, however if I use these and ommit setting the SimpleAuthenticator, it also fails (with either handler!). An explanation of that is welcome.
Thanks in advance.
Code:
===========================================================
System.setProperty("http.proxySet", "true");
System.setProperty("http.proxyHost", "localhost");
System.setProperty("http.proxyPort", "808");
//System.setProperty("http.proxyUser", "myuser");
//System.setProperty("http.proxyPassword", "mypw");
Authenticator.setDefault(new SimpleAuthenticator("myuser", "mypw"));
String urlString = "http://someurl:8080/webservice..";
URL endpoint1 = new URL(urlString);
URL endpoint2 = new URL(null, urlString, new sun.net.www.protocol.http.Handler());
SOAPConnectionFactory soapfactory = SOAPConnectionFactory.newInstance();
SOAPConnection connection = soapfactory.createConnection();
connection.call(message, endpoint1); // Gives Exception with HTTP Error 407
connection.call(message, endpoint2); // Works and uses the proxy
For reference:
===========================================================
public class SimpleAuthenticator extends Authenticator {
     private String username, password;
     public SimpleAuthenticator(String username, String password) {
          this.username = username;
          this.password = password;
     protected PasswordAuthentication getPasswordAuthentication() {
          return new PasswordAuthentication(username, password.toCharArray());
}

Sorry for the 3 posts.
Administrator, delete this thread please!!

Proxy User Authentication with SQL Developer

Hello,
I realized that there are 2 methods for configuring SQL Developer to user Proxy User Authentication.
1) one-session method with Syntax:
personaluser[appuser]
2) two session-method with dialog "Proxy Connection"
For me it is unclear, why anybody would want to use the two-session-method.
a. you need username/password for both user acocunts (personaluser and appuser)
b. it is unclear which operations in SQL Developer are using the personaluser account. It seems that the SQL Window is only using appuser account.
What was the motivation to implement Two Session Method?
Best regards,
Martin

I found the possibility that proxy authentication of both accounts can be enforced:
SQL> alter user appuser grant connect through personaluser AUTHENTICATION REQUIRED;
I guess that this is the motivation for implementing the 2-session proxy connection method in SQL Developer.
Regards,
Martin

SCCM 2012 R2 ADR issue with proxy authentication

Hi,
We're migrating SCCM 2007 to SCCM 2012 R2.
In SCCM 2007, the proxy server is configured with user authentication, and this works.
In SCCM 2012 R2, the Software Update Point is installed locally and connected with a local WSUS 4.0 (Server 2012)
We use a proxy with user authentication for Update Deployment. (This user is the same as configured in SCCM 2007.)
The Proxy Server is Blue Coat SG.
The proxy account is used for:
The Synchronization works, but Automatic Deployment Rule (ADR) doesn't work.
When an Automatic Deployment Rule is started, it tries to authenticate 3 times.
The Patchdownloader.log shows:
Trying to connect to the root\SMS namespace on the <servername> machine.        Software Updates Patch Downloader        11/8/2013
12:19:06        3608 (0x0E18)
Connected to
\\<servername>\root\SMS        Software Updates Patch Downloader        11/8/2013 12:19:06        3608
(0x0E18)
Trying to connect to the
\\<servername.domain>\root\sms\site_ECM namespace on the <servername.domain> machine.        Software Updates Patch Downloader        11/8/2013
12:19:06        3608 (0x0E18)
Connected to
\\<servername.domain>\root\sms\site_ECM        Software Updates Patch Downloader        11/8/2013 12:19:06        3608
(0x0E18)
Download destination =
\\<servername.domain>\dp_wks_ms_updates$\3208bb5e-bcd9-4389-a0c9-02ef33ccb998.1\XPSEPSC-x86-en-US.exe .        Software Updates Patch Downloader        11/8/2013 12:19:07        3608
(0x0E18)
Contentsource =
http://wsus.ds.www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/xpsepsc-x86-en-us_7ae70ca1330a099080c6c41c4d5b7f19b30dc0cd.exe .        Software Updates Patch Downloader        11/8/2013
12:19:07        3608 (0x0E18)
Downloading content for ContentID = 16819067,
FileName = XPSEPSC-x86-en-US.exe.        Software Updates Patch Downloader        11/8/2013 12:19:07        3608 (0x0E18)
Try username <domain\ProxyAccount>        Software Updates Patch Downloader        11/8/2013 12:19:07        8364
(0x20AC)
Proxy enabled proxy server <proxyserver>:8080        Software Updates Patch Downloader        11/8/2013
12:19:07        8364 (0x20AC)
HttpSendRequest failed HTTP_STATUS_PROXY_AUTH_REQ        Software Updates Patch Downloader        11/8/2013
12:19:07        8364 (0x20AC)
Download
http://wsus.ds.www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/xpsepsc-x86-en-us_7ae70ca1330a099080c6c41c4d5b7f19b30dc0cd.exe to C:\Windows\TEMP\CAB6FD2.tmp returns 407        Software Updates
Patch Downloader        11/8/2013 12:19:07        8364 (0x20AC)
ERROR: DownloadContentFiles() failed with hr=0x80070197        Software Updates Patch Downloader        11/8/2013
12:19:07        3608 (0x0E18)
Then the proxy user account is locked:
Trying to connect to the root\SMS namespace on the <servername> machine.        Software Updates Patch Downloader        11/8/2013
12:20:11        3608 (0x0E18)
Connected to \\ <servername>\root\SMS        Software Updates Patch Downloader        11/8/2013
12:20:11        3608 (0x0E18)
Trying to connect to the
\\<servername.domain>\root\sms\site_ECM namespace on the <servername.domain> machine.        Software Updates Patch Downloader        11/8/2013
12:20:11        3608 (0x0E18)
Connected to
\\<servername.domain>\root\sms\site_ECM        Software Updates Patch Downloader        11/8/2013 12:20:11        3608
(0x0E18)
Download destination =
\\<servername.domain>\dp_wks_ms_updates$\e0a54221-3ff2-4129-b7cf-89bf5cd1f726.1\Windows-KB943729-x86-ENU.exe .        Software Updates Patch Downloader        11/8/2013
12:20:12        3608 (0x0E18)
Contentsource =
http://wsus.ds.download.windowsupdate.com/msdownload/update/software/updt/2009/10/windows-kb943729-x86-enu_e174c41ce3dcbd5c8922d6d1c39df1be425a70e0.exe .        Software Updates Patch Downloader        11/8/2013
12:20:12        3608 (0x0E18)
Downloading content for ContentID = 16824262,
FileName = Windows-KB943729-x86-ENU.exe.        Software Updates Patch Downloader        11/8/2013 12:20:12        3608 (0x0E18)
Try username <domain\ProxyAccount>        Software Updates Patch Downloader        11/8/2013 12:20:12        12480
(0x30C0)
Proxy enabled proxy server <proxyserver>:8080        Software Updates Patch Downloader        11/8/2013
12:20:12        12480 (0x30C0)
HttpSendRequest failed HTTP_STATUS_FORBIDDEN or HTTP_STATUS_DENIED        Software Updates Patch Downloader        11/8/2013
12:20:12        12480 (0x30C0)
Download
http://wsus.ds.download.windowsupdate.com/msdownload/update/software/updt/2009/10/windows-kb943729-x86-enu_e174c41ce3dcbd5c8922d6d1c39df1be425a70e0.exe to C:\Windows\TEMP\CAB6E4B.tmp returns 403        Software Updates
Patch Downloader        11/8/2013 12:20:12        12480 (0x30C0)
ERROR: DownloadContentFiles() failed with hr=0x80070193        Software Updates Patch Downloader        11/8/2013
12:20:12        3608 (0x0E18)
The RuleEngine.log shows:
Failed to download the update from internet. Error = 403 SMS_RULE_ENGINE 11/8/2013 16:18:25 3608 (0x0E18)
Failed to download ContentID 16824467 for UpdateID 16819978. Error code = 403 SMS_RULE_ENGINE 11/8/2013 16:18:25 3608 (0x0E18)
It seems that the ADR uses a wrong password when authenticating with the proxy, but this same user works when synchronizing with WSUS.
We performed the following actions with no result:
run the ADR manually and automatic,
reinstalled WSUS and SUP,
changed proxy user account.
Regards,
Matthias

Currently, the command shows:
Current WinHTTP proxy settings:
    Direct access (no proxy server).
We've been testing with:
upddwnldcfg.exe /s:<proxyserver>:<port> /u:<user> /allusers
psexec -i -s iexplore.exe, set Internet Explorer proxy manually
All with same result, proxy user getting locked when ADR runs.
(These settings have been removed after the test.)
I think dekac99 would suggest netsh winhttp set proxy or import proxy.
then turn off proxy use on the role SUP (this way not SCCM will send auth but all winhttp will use proxy)
the problems with that for me are:
- if MS implemented role-based proxy usage, why set at http layer - of course this might work as a workaround for the time being so it might be a good idea but I'm just not sure what unwanted issues it may cause
- the other thing is where I'm not sure, with set proxy you cannot define authentication account. if you use import from IE and the IE prompted for proxy auth, the stored credential will be used on winhttp layer (though I'm not 100% sure of that) - so this
is just too uncontrolled for me
- upddwnldcfg.exe will need to run in the name of system account (it stores credentials under HKCU so far I know it will be a per user based setting)
--> what confuses me, the catalog synch works which should use the same configured proxy and account(?), only ADR does not work. shouldn't they both use the same process for sending account auth info?

Strange behaviour when using connection pooling with proxy authentication

All
I have developed an ASP.NET 1.1 Web application that uses ODP.NET 9.2.0.4 accessing Oracle Database 8i (which is to be upgraded to 10g in the coming months). I have enabled connection pooling and implemented proxy authentication.
I am observing a strange behaviour in the live environment. If two users (User 1 and User 2) are executing SQL statements at the same time (concurrent threads in IIS), the following is occurring:
* User 1 opens a new connection, executes a SELECT statement, and closes this connection. The audit log, which uses the USER function, shows User 1 executed this statement.
* User 2 opens the same connection (before it is released to the connection pool?), excutes an INSERT statement, and closes this connection. The audit log shows User 1, not User 2, executed this statement.
Is this a known issue when using connection pooling with proxy authentication? I appreciate your help.
Regards,
Chris

Hi Chris,
I tried to reproduce your complaint, but was unable to. I didnt use auditting however, just a series of "select user from dual" with proxy authentication. You might want to see if you can put together a small complete testcase for this and open a sr with support.
Cheers
Greg

Proxy user authentication with BC4J

On my webapp i have a connections pool and a MyApplicationModule.
I can obtain a OracleConnection instace by overriding the method prepareSession()
into the application module.
I need to associate the OracleConnection with the ApplicationModule object to execute my queries with the application module and the proxy user.
The application module is created by this code:
appMod = (MyApplicationModule)Configuration.createRootApplicationModule("xx.xxx.MyApplicationModule", "MyApplicationModuleLocalTest1");
The prepareSession ovverride is done by this code:
protected void prepareSession(Session session) {
Statement st = null;
try {
st = getDBTransaction().createPreparedStatement("rollback",0);
OracleConnection oConn = (OracleConnection)st.getConnection();
Properties props = new Properties();
props.put("PROXY_USER_NAME", "USERTEST");
oConn.openProxySession
(OracleConnection.PROXYTYPE_USER_NAME,props);
catch (SQLException s) {
//ignore
finally {
if (st != null) {
try {
st.close();
catch (SQLException s) { }
super.prepareSession(session);
Tanks and sorry for my poor english.

I found the possibility that proxy authentication of both accounts can be enforced:
SQL> alter user appuser grant connect through personaluser AUTHENTICATION REQUIRED;
I guess that this is the motivation for implementing the 2-session proxy connection method in SQL Developer.
Regards,
Martin

Proxy authentication doesn't work with JSSE

Hello,
Seems like there is no common way to authenticate with proxy for HTTP and HTTPS.
Connecting to http://... - works fine, but https://... returns error message:
Unable to tunnel through 111.111.111.111:8080. Proxy returns "HTTP/1.0 407 Proxy Authentication Required"
(IP address is intentionally changed in the message above)
I'm using JSSE with VAJ JDK 1.2 and here is a Java code snippet that works well with HTTP connections:
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
System.setProperty("java.protocol.handler.pkgs",
"com.sun.net.ssl.internal.www.protocol");
System.setProperty("https.proxyHost", proxyHost);
System.setProperty("https.proxyPort", proxyPort);
System.setProperty("http.proxyHost", proxyHost);
System.setProperty("http.proxyPort", proxyPort);
try {
URL url = new URL("https://www.sun.com");
URLConnection connection = url.openConnection();
String authString = proxyUserID + ":" + proxyPasswd;
String encodedAuthString =
"Basic " + new sun.misc.BASE64Encoder().encode(authString.getBytes());
connection.setUseCaches(false);
connection.setRequestProperty("Proxy-authorization", encodedAuthString);
Listening to the network traffic helped me to understand that there is a difference between the way HTTP and HTTPS is handled. For some reason HTTPS ignores all the headers that I specify using setRequestProperty().
Here is example of request and responses sent by HTTPS handler:
Request:
CONNECT 198.175.98.32:443 HTTP/1.0
User-Agent: JSSE
Proxy response:
HTTP/1.0 407 Proxy Authentication Required
Date: Wed, 07 Nov 2001 22:04:11 GMT
Content-Length: 233
Content-Type: text/html
Server: NetCache (NetApp/5.1R2D4)
Proxy-Authenticate: basic realm="NETCACHE2"
Please note that there is no Proxy-authorization header in the request above.
Compare it with HTTPS request sent by Netscape browser:
Request to proxy:
CONNECT www.sun.com:443 HTTP/1.0
Proxy-authorization: Basic am0vbDphrGxHa22lLg==
User-Agent: Mozilla/4.76 [en] (Windows NT 5.0; U)
Response:
HTTP/1.0 200 Connection established
Proxy-Agent: NetCache NetApp/5.1R2D4
So, the question is:
What is the best way to pass "Proxy-authorization" header to proxy server??
Thanks in advance for your time.

Hi Guys,
Just like, i assume, all of you, i've had my battles with javas' handling of https comms from behind a firewall. I'm actually amazed at how something that is a simple combination of protocol and security should become so messy.
Luckily , i managed to get all my requirements met, but the sad thing is after all that hard work, i'm not much closer to understanding why the standard java sdk (im using 1.4) forces us to endure such painful tasks.
Really, Java is quite a mature language now, and one of its touted benefits is its applicability to web and internet technologies... so why the messy proxy code when dealing with ssl?
Anyway, i didn't really come here to b**tch, but rather to point you all to a handy library from apache - httpClient - http://jakarta.apache.org/commons/httpclient.
After implementing ssl proxy tunnelling and all the fun that goes with it, i found this tool, and subsequently deleted all that ugly code, and let http client deal with all that for me.
Its seriously simple, heres a snippet:
httpClient = new HttpClient();
httpClient.setTimeout(responseTimeoutMillies);
Protocol myHttps = new Protocol("https", new SSLContextBasedSocketFactory(sslContext), targetServerPort);
httpClient.getHostConfiguration().setHost(targetServerHost, targetServerPort, myHttps);
if (useProxy)
     httpClient.getHostConfiguration().setProxy(proxyHost, proxyPort);
        httpClient.getState().setProxyCredentials("my-proxy-realm", proxyHost, new UsernamePasswordCredentials(proxyUser, proxyPassword));
}This initialises the client, and after this, making http requests is simple:
String response = null;
PostMethod postMethod = new PostMethod("/secure/blah.jsp"); // A HTTP Post
postMethod.setRequestBody("Hello there"); // this is the data in the http post body
int responseCode = httpClient.executeMethod(postMethod);
if(responseCode == 200)
    response = postMethod.getResponseBody();...
As you can see, its alot less painful. It certainly makes me feel better, knowing i don't have to support/maintain the ugly proxy tunnelling code. Give it a shot on your next project.
Hope it helps.
Regards
Marcus Eaton

Proxy authentication with 5800

Similar Messages

Maybe you are looking for