Restricting IP's with OWSM?

Hi guys.
Just started looking at OWSM, cause we're deploying web services by the dozen and I want to get it all into a centrally managed environment before its too late :)
Question: Is it possible with OWSM to restrict the ip's that are allowed to call a WS. In other words to make sure that WS1 can only be called from 127.1.2.3 and not from 128.3.4.5? Never mind any other security layers built into the WS call, just pure IP restrictions. I suspect it is possible to do that on the application server where the WS is really deployed, but if I put a gateway in via OWSM, then all the IP's at the application server level will be the ip of the OSWM where the gateway is running, thus defeating the purpose. Or am I completely off track? (Not an impossible scenario :) )
Eagerly awaiting your replies/comments/wild speculations.
Elmar

Hi,
OWSM can run in two different modes, as a gateway or with agents. When acting as a gateway the original webservices will be proxied via the OWSM gateway. So yes all services will be accessed via the same ip. The original ws however is still accessible if somebody knows its ip address and endpoint. In OWSM you can not restrict the ip addresses that can access the gateway, if you want that you need to do it at a network level. If using only webservices on oracle application servers (and others that have a owsm agent available, ... eg .Net does not have an agent) you can install the agent for your services which will make the webservice itself forward the requests to OWSM. Still this does not allow you to only access the services from certain ip addresses. So the conclusion is, if you need to allow only certain ip addresses to access your webservices it is best to do it at a network level.
Andre

Similar Messages

Can we restrict a formula with other characteristics?

Hello all,
I am using a structure in rows in my query designer. I have a formula in that structure now I a want to restrict that formula with particular fund ranges.
Also one option that I am thinking is can I create the same formula in the key figures section ( but the formula has characteristics in it and i tried but it does not let me) has anyone done that.
Can we do any of that or is there any other way of doing it.
Thanks in advance,
Raj

Bhanu, Stefen,
This what my query looks like ...i have a KYF structure in cloumns which has 4-5 restricted key figures.
Then i have manually created a new structure in rows, because the client requirement is very very specific, most of the lines in my rows structure are like nodes of hierarchy and sometimes that node is restricted more by some char. now when i get at the bottom 5 lines i need to create a formula (revnuesexpensetrasnfers) and restrict that by fund ranges. and this object should be added to another selection (hierarchy node) which evetually will get what client wants.
So how can I do it can you tell
Thanks,Raj

' delete an app. All apps wiggle incl. the one in questions. However the app I want to delete does not show the x button. I reseted, also restrictions are on with on for apps delete. Suggestions?

' delete an app. All apps wiggle incl. the one in questions. However the app I want to delete does not show the x button. I reseted, also restrictions are on with on for apps delete. Suggestions?

mardemar wrote:
... - the only one without an x delete button.
What is the name of this App and where did you get it...?

How can I restrict a vendor with certain value limit?

Hi Gururs,
How can I restrict a vendor with certain value limit?.
Scenario is like this
If my company was decided to purchase goods from a particular vendor upto Rs.1000, if cross the rs.1000 limit don't allow the Posting the PO and get the Message as warning/error.
Give the configuration setting's and T.codes
Thanks and regards
G.N.Rao

Hi
Go to T.Code oms4 and then select the material status BP (Blocked for purchasing)
Click on Details
In that under Purchasing select the option A= Warning or B=Error
Click on Save
Thus by doing this no further purchasing function for that material can be done. So the PO can not be issued
So as and when the value limit reaches see that purchasing option is blocked
So no further PO are generated in the future
I hope this helps you out
If found useful reward accordingly
Thanks
pavan

IP address restrictions not working with bea weblogic plugin

We want to implement IP address restrictions via the Sun Java One Web Server admin tool for our application. We are using the Sun Java One Web Server to proxy requests via the Bea Weblogic plugin. However, we cannot get IP address restrictions to work because of the leading asterisk in the following NSAPI entry for PPATH of obj.conf :
<Object name="weblogic" ppath="*/cmcsr/*"> Service fn="wl_proxy" WebLogicCluster="10.156.20.11:9010,\
10.156.20.12:9010,10.156.20.13:9010" DynamicServerList="OFF"
</Object>
Has anyone gotten IP restrictions to work with the bea Weblogic NSAPI plugin?

I'm not sure what you're asking, but each Service directive should be on its own line. It is an error to have both a <Client> tag and Service directive on a single line.

Osb proxy service with owsm policy auth slow when soap request very large

I have a proxy service which is security with owsm policy: oracle/wss_username_token_service_policy, the proxy service simply route to Business Service which directly invoke a bpel exposed web service, when I call the proxy service with soap envelope large than 15MB(not attachment), waiting about 4~5 minutes, the bpel instance created ; but when I remove the security policy:oracle/wss_username_token_service_policy, it will cost only 20 seconds, why authentication cost so long? How can I deal with the problem?
My English is poor, please don't mind!
besides, with my OSB version is 11.1.1.6.0

I finally figured it out. The nullpointer exception is related to the SAML assertion. The SAML assertion in my requests is signed with embedded signature and this seems to be not supported with the used OWSM policy. Without the signature is the exception gone.
Marian

Secure OSB10g with owsm 10g

Hi,
I have a customer who have some flows exposed as webservices via proxy services on OSB 10g, he would like to implement authentication and authorisation, what is the best architecture to do it ? he is thinking to use OWSM 10g but don't know what is the best implementation architecture ?
He is also asking this questions : OWSM 10g is it compatible with OSB 10g or not ?
Thanks for your help.

OSB 10g is compatible with OWSM ( 10.1.3.x and later & 11.1.1). Please refer to the following links for more details:
http://docs.oracle.com/cd/E13159_01/osb/docs10gr3/security/owsm.html
http://docs.oracle.com/cd/E13159_01/osb/docs10gr3/interopmatrix/matrix.html (Refer to Platform Interoperability section)
Hope this helps.
Thanks,
Patrick

How to restrict a KF with 1st two characters of a row char.?

We know how to restrict a KF (e.g. quantity) with a row char. by dragging these two to the Column section in Query Designer. But now we want to restrict this KF with only 1st two char. of a row char., then what's the best way of doing this?
Thanks in advance and we will give you reward points!

Hi,
I have never been able to restrict to anything else than a characteristic in Bex....
So, Create a new Characteristic that is the 1st 2char of a row char....
PY

Mail wants to use the restricted Service "Search With Google."

This is the response/error I see when I try to do a Google search from an email message - "Mail wants to use the restricted Service “Search With Google.”"

Interesting - I just created a new user account I named "Test", and tried "Search With Google" in Notes and it worked fine in this new account. Without any additional change, I went back into my normal user account, and tried to use "Search with Google" on the highlighted word, and it pulled up the Google search fine as well. No reason I can think of that these actions would have resolved the problem - e.g., either the creation of the "Test" account, or switching between this "Test" account and my normal account. Possibly creating new account caused a cleanup of the Safari preferences to point to version 6.0.(essentially reset the default)
Would be curious if droow007 solution works for others. Definitely quicker than the route I went :~)

Problems with Custom Assertions in OSB with OWSM

Hi all, I try to get the custom assertion example from the documentation to work:
I have used the example about ValidateIpAssertions, and I have attached to a proxy service. I can debug it with eclipse, but I see that it's not running ok. I realize that the 'context message' is not informed in correct way in my debug tool.
I’m using OSB 11g Patch Set 2 with OWSM extension and Enterprise Console (SOA Suite is not installed). The admin server and managed server are running in the same domain (only one server).
Any suggestion?

I want to say that when I do a request trough a soapUi by example, the method getremoteAddr by example is null. one of the things more importants to me is to get the soap message. With version 10 I used the next expression with steps in order to get the message.
msgContext.getRequest().getAxisMessage().getSOAPPartAsString();
but now with assertions I dont know how to extract the soapmessage for working with it.

Restrict Equipment Master (with serial numbers) creation

Hello All,
I am faced with an issue where the client will be using Serial Numbers for 2 sets of materials. I have assigned a Serial Number profile to these materials in Material Master.
I am able to create equipment master data for these materials with serial numbers without any issue.
However, I am also able to create equipment master data (with serial numbers) for materials to which I have not assigned a Serial Number profile.
Is there a way to restrict the creation of equipment master data (with serial numbers) to only those material that have a Serial Number profile assigned in material master data...?
Thanks
Jensi

Thanks for the reply Amuthan.
Unlike what you wrote in the reply, the system does allow me to create/save a equipment number for those serial numbers that I assign to materials that do not have a serial number profile.
Is there any validation, any check or something of that sort that I can activate so that the system will prevent assignment of serial numbers (and in turn creation of equipment master data) for those materials which do not have a serial number profile assigned in the material master data?
Thanks
Jensi

Authorizations to restrict Query Designer with Only Display option

Hello,
I have looked all most all possible ways in internet to find out a suggestion/solution for the below. But Invain.
I would like to know the Transactions, authorization objects and profiles that are responsible to restrict users not to change and copy queries from QD.
I need only display option for queries.
Also,please confirm shall we restrict the same from Transaction SCC4.
Thanks In Advance.

Hi there,
Since you're talking about a QD system, you should lock it in transaction SCC4.
In case you need to change things in QD without opening the system in SCC4, you can go to transaction rsa1->transport connection and click on Object Changeability. In there you can define what paricular options are "opened for changes" even with SCC4 in close mode.
Also, for roles having that objects, you should use the authorization object S_RS_COMP and S_RS_COMP1 with Activity with value 02 - Display
Diogo.

Restriction of some with holding tax code when doing F-43

Dear All,
       How can i restrict previous fiscal year's with holding tax codes while creating a vendor invoice (i.e F-43).
      Its an urgent requirement, i would really appreciate if some one gives the input.
Thanks
Suresh

Dear Rob,
          yeah i know that, but unfortunately i cannot write the validation because the pre-requisite condition requires an entry from WITH_ITEM table, which is not there in the list of structures and tables while writing the validation.
         Please provide the alternate or else let me know how to include the WITH_ITEM table in the list of structures & tables.
Thanks
Ravi

Securing SOA 11g Web Services with OWSM AD authentication

I have SOA 11g with Weblogic 10.3.5 installed and running a Web Service and a Client I want to protect with Active Directory auth and perhaps some other access rules. As I read, I can use OWSM policies to do that. Most guides I found concern OWSM 10g.
How can I make WL use AD authentication? Do I have to use Access Manager?

I finally figured it out. The nullpointer exception is related to the SAML assertion. The SAML assertion in my requests is signed with embedded signature and this seems to be not supported with the used OWSM policy. Without the signature is the exception gone.
Marian

SAML Sender-Vouches errors when using with OWSM

Hi,
We have configured OWSM Policy 'SAML - Verify WSS 1.0 Token' with Allow signed assertions only. We have created jks Trust store location and configured policy to refer to the file with appropriate password.
We have created proxy security to Sender-Voches signed and to sign outbound message.
We are getting following error when we try to run the proxy.
javax.xml.rpc.soap.SOAPFaultException: SAML token verification failed
at oracle.j2ee.ws.client.StreamingSender._raiseFault(StreamingSender.java:555)
at oracle.j2ee.ws.client.StreamingSender._sendImpl(StreamingSender.java:396)
at oracle.j2ee.ws.client.StreamingSender._send(StreamingSender.java:112)
at vigni4.oracle.srtutorial.datamodel.proxy.runtime.TimeServiceSoap_Stub.getTime(TimeServiceSoap_Stub.java:79)
at vigni4.oracle.srtutorial.datamodel.proxy.TimeServiceSoapClient.getTime(TimeServiceSoapClient.java:41)
at vigni4.oracle.srtutorial.datamodel.proxy.TimeServiceSoapClient.main(TimeServiceSoapClient.java:29)
Process exited with exit code 0.
and Error in gateway.log is
2007-09-01 18:58:56,561 WARNING [RMICallHandler-58] saml.VerifySAMLStep - SAML Token verification failed:
Can any provide information on how to resolve the issue?

We have also noticed that correct message is reaching OWSM.
Attaching the same.
<?xml version="1.0" encoding="UTF-8" ?>
- <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ns0="urn:Test:GetTime">
- <env:Header>
- <wsse:Security env:mustUnderstand="1" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/">
<wsse:BinarySecurityToken ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" wsu:Id="_FNfXFOVi1OcPKSyRUAHDyw22" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">MIICQjCCAasCBEbZZN4wDQYJKoZIhvcNAQEFBQAwaDELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB0Zsb3JpZGExEDAOBgNVBAcTB3NhbUhvbWUxDzANBgNVBAoTBnNhbU9yZzEQMA4GA1UECxMHc2FtRGVwdDESMBAGA1UEAxMJU2FtIE1vb3JlMB4XDTA3MDkwMTEzMTA1NFoXDTA3MTEzMDEzMTA1NFowaDELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB0Zsb3JpZGExEDAOBgNVBAcTB3NhbUhvbWUxDzANBgNVBAoTBnNhbU9yZzEQMA4GA1UECxMHc2FtRGVwdDESMBAGA1UEAxMJU2FtIE1vb3JlMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDOrVJbJ/sPvZsgZEDUSIolP1UDT8hfyajfIaPqYHBLBK+FlywrhhrxESyzAsG/k7FSIRZvFg5vAk/W3LB+nPBtrbI2bBMEsQbznuSjzEVkQJVxZMlDjR4yNMHPLbniL64BKuTFnLEhWrnZTmpiThjwoWMPL9eK7/x7su9iDCP5NwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBADWjdaRz0FBNHxXPiV9Ad0Kkm2Eag5LQXQoXUuC/VTXk56uQktVLtorp5fYAUsRD2o7ZuPGPJ6Q+5Owe8wXbxrCOX1diI5fxpH5TsS0k8Y/7/Hx3gq67JuPy8x8ApgNd+NagAKHKC0rgEP9ng1FGyhzuHICapPxmjrt2VI3SW2cJ</wsse:BinarySecurityToken>
- <dsig:Signature xmlns="http://www.w3.org/2000/09/xmldsig#" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#">
- <dsig:SignedInfo>
<dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
<dsig:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" />
- <dsig:Reference URI="#mvDwzM5hZWAdG6n5tKLufA22">
- <dsig:Transforms>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<dsig:DigestValue>zBFquf+Y0ngNapyK4Xq0Jws1FPM=</dsig:DigestValue>
</dsig:Reference>
- <dsig:Reference URI="#nwWnNm69TPcdyp0yT8fa7g22">
- <dsig:Transforms>
- <dsig:Transform Algorithm="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#STR-Transform">
- <wsse:TransformationParameters xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<dsig:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</wsse:TransformationParameters>
</dsig:Transform>
<dsig:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
</dsig:Transforms>
<dsig:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" />
<dsig:DigestValue>rgHU/BWcaOiwuP/Q72oybFcEQO8=</dsig:DigestValue>
</dsig:Reference>
</dsig:SignedInfo>
<dsig:SignatureValue>R+RGFjzRYpGVPGINbzsFbXSQ7Slc04/mzQ+BX57oD7NhMKxCcO1C9cV2cJzWAeN5WuDlfsh3RZR/5sTsyEi3yO69ECcLUNDlbjey57GBr5W9PRRIWPs2fZVk2EH4+KOnXVghcAsrXPgm1Ai9UZQUXh0aPiOkQMDplnnhENTkKUo=</dsig:SignatureValue>
- <dsig:KeyInfo>
- <wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:Reference URI="#_FNfXFOVi1OcPKSyRUAHDyw22" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" />
</wsse:SecurityTokenReference>
</dsig:KeyInfo>
</dsig:Signature>
- <wsse:SecurityTokenReference wsu:Id="nwWnNm69TPcdyp0yT8fa7g22" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
<wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">YFfqXnq2xlt426HB9uDInw22</wsse:KeyIdentifier>
</wsse:SecurityTokenReference>
- <saml:Assertion MajorVersion="1" MinorVersion="1" AssertionID="YFfqXnq2xlt426HB9uDInw22" IssueInstant="2007-09-01T13:40:06Z" Issuer="https://phaos.com/idp" xmlns="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion">
<saml:Conditions NotBefore="2007-09-01T13:40:06Z" NotOnOrAfter="2007-09-02T13:40:06Z" />
- <saml:AuthenticationStatement AuthenticationInstant="2007-09-01T13:40:06Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password">
- <saml:Subject>
<saml:NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">oc4jadmin</saml:NameIdentifier>
- <saml:SubjectConfirmation>
<saml:ConfirmationMethod>urn:oasis:names:tc:SAML:1.0:cm:sender-vouches</saml:ConfirmationMethod>
</saml:SubjectConfirmation>
</saml:Subject>
</saml:AuthenticationStatement>
</saml:Assertion>
</wsse:Security>
</env:Header>
- <env:Body wsu:Id="mvDwzM5hZWAdG6n5tKLufA22" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd">
- <ns0:getTime env:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<format xsi:type="xsd:string" />
</ns0:getTime>
</env:Body>
</env:Envelope>

Restricting IP's with OWSM?

Similar Messages

Maybe you are looking for