Secure JSESSIONID for Weblogic running HTTP behind load balancers

We run multiple Weblogic application servers behind a load balancer. We use an SSL accelerator to avoid encrypt/decrypt functions on the CPUs hosting Weblogic. Our Weblogic servers are running version 10.3.
Here is my conundrum:
1) For security purposes, we want the cookie JSESSIONDID to be secure.
2) Weblogic doesn't seem to want to allow me to set this secure flag as there is no HTTPS on Weblogic.
3) Network performance dictates that we don't want to run weblogic using https.
Any suggestions to get JSESSIONID set as secure and http-only on a Weblogic server that is not running https?
Thanks.

Similar Messages

Oracle Identity Server Authenticator as Security Provider for Weblogic 10.3

Hi,
I am getting the following exception on weblogic server 10.1.3 console when accessing users and groups in security realm. This can be reproduced using the following steps.
1. I have installed Oracle Identity Management 10.1.4 (Oracle SSO). I have installed Oracle SSO using the default port options. I tested accessing the Internet directory using orcladmin user and it is working with out any problems.
2. Installed Oracle weblogic Server 10.1.3 and then installed ADF runtime. I verified the installation by accessing the admin server console and did not find any issues.
3. Opened the Admin Console and then accessed the Security Realms and then selected myrealm. Then selected Providers and added Oracle Internet directory Authentication provider.
4. configured the provider specific parameters like the host name and port number (389).
Now when I select user and groups tab I am getting the following exception on weblogic adminserver command prompt console.
Am I missing any steps in configuring Oracle Internet directory authenitcaiton provider for weblogic 10.3.1
<Oct 13, 2009 8:33:21 PM EDT> <Error> <Console> <BEA-240003> <Console encountere
d the following error weblogic.security.providers.authentication.LDAPAtnDelegateException: [Security:090294]could not get connection
at weblogic.security.providers.authentication.LDAPAtnDelegate.getConnection(LDAPAtnDelegate.java:3224)
at weblogic.security.providers.authentication.LDAPAtnDelegate.listUsers(LDAPAtnDelegate.java:2248)
at weblogic.security.providers.authentication.LDAPAuthenticatorImpl.listUsers(LDAPAuthenticatorImpl.java:178)
at weblogic.security.providers.authentication.OracleInternetDirectoryAuthenticatorMBeanImpl.listUsers(OracleInternetDirectoryAuthenticatorMBeanImpl.java:221)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at weblogic.management.jmx.modelmbean.WLSModelMBean.invoke(WLSModelMBean.java:437)
at com.sun.jmx.interceptor.DefaultMBeanServerInterceptor.invoke(DefaultMBeanServerInterceptor.java:836)
at com.sun.jmx.mbeanserver.JmxMBeanServer.invoke(JmxMBeanServer.java:761)
at weblogic.management.jmx.mbeanserver.WLSMBeanServerInterceptorBase$16.run(WLSMBeanServerInterceptorBase.java:449)
at java.security.AccessController.doPrivileged(Native Method)
at weblogic.management.jmx.mbeanserver.WLSMBeanServerInterceptorBase.invoke(WLSMBeanServerInterceptorBase.java:447)
at weblogic.management.mbeanservers.internal.JMXContextInterceptor.invoke(JMXContextInterceptor.java:268)
at weblogic.management.jmx.mbeanserver.WLSMBeanServerInterceptorBase$16.run(WLSMBeanServerInterceptorBase.java:449)
at java.security.AccessController.doPrivileged(Native Method)
at weblogic.management.jmx.mbeanserver.WLSMBeanServerInterceptorBase.invoke(WLSMBeanServerInterceptorBase.java:447)
at weblogic.management.mbeanservers.internal.SecurityInterceptor.invoke(SecurityInterceptor.java:443)
at weblogic.management.jmx.mbeanserver.WLSMBeanServer.invoke(WLSMBeanServer.java:314)
at weblogic.management.mbeanservers.internal.JMXConnectorSubjectForwarder$11$1.run(JMXConnectorSubjectForwarder.java:663)
at java.security.AccessController.doPrivileged(Native Method)
at weblogic.management.mbeanservers.internal.JMXConnectorSubjectForwarder$11.run(JMXConnectorSubjectForwarder.java:661)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
at weblogic.management.mbeanservers.internal.JMXConnectorSubjectForwarder.invoke(JMXConnectorSubjectForwarder.java:654)
at javax.management.remote.rmi.RMIConnectionImpl.doOperation(RMIConnectionImpl.java:1426)
at javax.management.remote.rmi.RMIConnectionImpl.access$200(RMIConnectionImpl.java:72)
at javax.management.remote.rmi.RMIConnectionImpl$PrivilegedOperation.run(RMIConnectionImpl.java:1264)
at java.security.AccessController.doPrivileged(Native Method)
at javax.management.remote.rmi.RMIConnectionImpl.doPrivilegedOperation(RMIConnectionImpl.java:1366)
at javax.management.remote.rmi.RMIConnectionImpl.invoke(RMIConnectionImpl.java:788)
at javax.management.remote.rmi.RMIConnectionImpl_WLSkel.invoke(Unknown Source)
at weblogic.rmi.internal.ServerRequest.sendReceive(ServerRequest.java:174)
at weblogic.rmi.internal.BasicRemoteRef.invoke(BasicRemoteRef.java:222)
at javax.management.remote.rmi.RMIConnectionImpl_1031_WLStub.invoke(Unknown Source)
at javax.management.remote.rmi.RMIConnector$RemoteMBeanServerConnection.invoke(RMIConnector.java:978)
at weblogic.management.jmx.MBeanServerInvocationHandler.doInvoke(MBeanServerInvocationHandler.java:544)
at weblogic.management.jmx.MBeanServerInvocationHandler.invoke(MBeanServerInvocationHandler.java:380)
at $Proxy106.listUsers(Unknown Source)
at com.bea.console.utils.security.UserUtils.getUsers(UserUtils.java:78)
at com.bea.console.actions.security.users.UserTableAction.getCollection(UserTableAction.java:100)
at com.bea.console.actions.security.ManagementBaseTableAction.execute(ManagementBaseTableAction.java:83)
at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:431)
at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor.access$201(PageFlowRequestProcessor.java:97)
at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor$ActionRunner.execute(PageFlowRequestProcessor.java:2044)
at org.apache.beehive.netui.pageflow.interceptor.action.internal.ActionInterceptors.wrapAction(ActionInterceptors.java:91)
at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor.processActionPerform(PageFlowRequestProcessor.java:2116)
at com.bea.console.internal.ConsolePageFlowRequestProcessor.processActionPerform(ConsolePageFlowRequestProcessor.java:262)
at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:236)
at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor.processInternal(PageFlowRequestProcessor.java:556)
at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor.process(PageFlowRequestProcessor.java:853)
at org.apache.beehive.netui.pageflow.AutoRegisterActionServlet.process(AutoRegisterActionServlet.java:631)
at org.apache.beehive.netui.pageflow.PageFlowActionServlet.process(PageFlowActionServlet.java:158)
at com.bea.console.internal.ConsoleActionServlet.process(ConsoleActionServlet.java:256)
at org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:414)
at com.bea.console.internal.ConsoleActionServlet.doGet(ConsoleActionServlet.java:133)
at org.apache.beehive.netui.pageflow.PageFlowUtils.strutsLookup(PageFlowUtils.java:1199)
at com.bea.portlet.adapter.scopedcontent.ScopedContentCommonSupport.executeAction(ScopedContentCommonSupport.java:686)
at com.bea.portlet.adapter.scopedcontent.ScopedContentCommonSupport.renderInternal(ScopedContentCommonSupport.java:266)
at com.bea.portlet.adapter.scopedcontent.StrutsStubImpl.render(StrutsStubImpl.java:107)
at com.bea.netuix.servlets.controls.content.NetuiContent.preRender(NetuiContent.java:292)
at com.bea.netuix.nf.ControlLifecycle$6.visit(ControlLifecycle.java:428)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:727)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walkRecursivePreRender(ControlTreeWalker.java:739)
at com.bea.netuix.nf.ControlTreeWalker.walk(ControlTreeWalker.java:146)
at com.bea.netuix.nf.Lifecycle.processLifecycles(Lifecycle.java:395)
at com.bea.netuix.nf.Lifecycle.processLifecycles(Lifecycle.java:361)
at com.bea.netuix.nf.Lifecycle.runOutbound(Lifecycle.java:208)
at com.bea.netuix.nf.Lifecycle.run(Lifecycle.java:162)
at com.bea.netuix.servlets.manager.UIServlet.runLifecycle(UIServlet.java:388)
at com.bea.netuix.servlets.manager.UIServlet.doPost(UIServlet.java:258)
at com.bea.netuix.servlets.manager.UIServlet.doGet(UIServlet.java:211)
at com.bea.netuix.servlets.manager.UIServlet.service(UIServlet.java:196)
at com.bea.netuix.servlets.manager.SingleFileServlet.service(SingleFileServlet.java:251)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at com.bea.console.utils.MBeanUtilsInitSingleFileServlet.service(MBeanUtilsInitSingleFileServlet.java:47)
at weblogic.servlet.AsyncInitServlet.service(AsyncInitServlet.java:130)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3588)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2200)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2106)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1428)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Caused by: java.lang.reflect.InvocationTargetException
at weblogic.security.providers.authentication.LDAPAtnDelegate$LDAPFactory.newInstance(LDAPAtnDelegate.java:3890)
at weblogic.security.utils.Pool.newInstance(Pool.java:37)
at weblogic.security.utils.Pool.getInstance(Pool.java:33)
at weblogic.security.providers.authentication.LDAPAtnDelegate.getConnection(LDAPAtnDelegate.java:3219)
... 119 more
Caused by: netscape.ldap.LDAPException: error result (49)
at netscape.ldap.LDAPConnection.checkMsg(LDAPConnection.java:4871)
at netscape.ldap.LDAPConnection.simpleBind(LDAPConnection.java:1766)
at netscape.ldap.LDAPConnection.authenticate(LDAPConnection.java:1264)
at netscape.ldap.LDAPConnection.authenticate(LDAPConnection.java:1273)
at netscape.ldap.LDAPConnection.bind(LDAPConnection.java:1562)
at weblogic.security.providers.authentication.LDAPAtnDelegate$LDAPFactory.newInstance(LDAPAtnDelegate.java:3860)
... 122 more
Thanks and Regards,
S R Prasad

The problem has been resolved after providing OID admin user creadential with cn=orcladmin instead of orcladmin. The Security:090294 is related to OID credentials.
Regards,
S R Prasad

How to increase JVM Process size for WebLogic running SOA Applications.

Hi,
I believe 32 Bit OS can address up to 4GB memory so theoretically 32 Bit JVM can use 4GB but practical convention is 2GB as other 2GB is used by OS itself and also this default JVM Process size is set somewhere and I also believe that if JVM is 32 bit on 64Bit OS even though JVM will run on 32Bit Virtual Machine so JVM does not know that it is 64Bit OS in that case again it can use max Process default size up to 2GB.
And for 64Bit JVM, I can allocate more than 4GB depend on my available RAM size to Xmx, MaxPermSize parameters in java.exe file and after that I can set the same value in “setSOADomainEnv.cmd” or to “setDomainEnv.cmd” file.
But I am 99% sure by just assigning more memory value to Xmx, MaxPermSize in “setSOADomainEnv.cmd” file only won’t work (not setting Xmx in java.exe), if it would have worked then in my case when I was assigning 1536 to Xmx in “setSOADomainEnv.cmd” file then why it was showing out of memory error. I think that is because it was only taking default 2GB for my 32 Bit JVM not considering 3GB or 4GB. So i think i have to change default memory size what JVM can use (<http://www.wikihow.com/Increase-Java-Memory-in-Windows-7> but i am using windows 8 so for that I don’t know the option to change this default Process Size)
I also believe that first JVM start and before start it check how much memory it can use from it’s own –Xmx parameter in some ware configuration or java.exe file and after that it allocate that much size of JVM Process Memory in RAM then after it loads Weblogic or Java Applications in its (Heap + Non-heap + Native Area) which are parts of JVM Process memory
I read post on :< http://stackoverflow.com/questions/3143579/how-can-jvm-use-more-than-4gb-of-memory > and < http://alvinalexander.com/blog/post/java/java-xmx-xms-memory-heap-size-control >
All used :
java -Xmx64m -classpath ".:${THE_CLASSPATH}" ${PROGRAM_NAME}
java –Xmx6g //command which will call java/JVM interpreter which will hold –Xmx parameter to set Heap size for JVM
before JVM comes in memory (JVM process memory)
now my question is can I manually open any configuration file or java.exe same like “setSOADomainEnv.cmd” or “setDomainEnv.cmd” (I know since java.exe is exe I can’t open simply but I want similar work around)
so that I don’t need to type java –Xmx6g every time when I run weblogic (and then later I can change weblogic “setDomainEnv.cmd” Xmx and PermSize to more than default size 4GB to 5GB or 6GB in the case of 64Bit OS)
Please correct me if I am wrong in my understanding.
Thanks.

These days the VM will detect a "server" machine and set up the memory appropriate for that.
You can create a simple java console application and have it print the memory settings (find the appropriate java class fort that.)
There is of course the possibility that your application is running out of memory because it is doing something wrong and not because the VM doesn't have enough memory. You can force that in a test setup by LOWERING the maximum amount of memory and thus making it more likely that an out of memory exception will occur.

Defining security-constraint for weblogic

          I'm working on declarative security using web.xml. Somehow I need to define the
          user names, password, etc. in which j_security_check relies on. I created a JAAS
          LoginModule which connects to me database and looks up users.
          How do I tell weblogic what to use when authenticating users? I'd imagine it's
          some weblogic.xml element, but I can't figure it out.
          thanks
          James


          James,
          If you use JAAS callback to go to your databse and authenticate a user say "A",
          this doesn't help becaase Weblogic has no idea who A is or what groups A belongs
          to.
          Once you use a realm, WLS knows exactly who A is and which groups he belongs to,
          then the declartive security in web.xml comes into play. For example if you restrict
          certain resources to a principal named "Administrators" and then map it to a group
          named "Administrators" in the realm. Once A is made a member of this group, he
          will be able to access the protected resources automatically.
          "James Leone" <[email protected]> wrote:
          >
          >I've read up on Realms and looked at the example for implementing a custom
          >realm.
          >
          >Are you telling me that all of that security stuff in web.xml not implemented
          >through JAAS, rather I need to implement the weblogic interfaces to create
          >my
          >own realm?
          >
          >If this is the case, what good is JAAS in a web application (more specifically
          >LoginModule and Callbacks)? It would make sense if weblogic itself implemented
          >the framework in JAAS, the I point it to my custom LoginModule (this
          >opposed to
          >implementing a proprietary realm).
          >
          >"Jawahar" <[email protected]> wrote:
          >>
          >>James,
          >>
          >>You should be using a security realm and not reading the database yourself.
          >>Read
          >>up on realms and set one up.
          >

When Client Security Solution for T61 running on Windows 7 will be released?

Now I clean installed Windows 7 Professional 64-bit on my computer. Anything work fine except for Client Security Solution which I can't install. Does anybody know that when it will be released?
Added: Also, Presentation Director for Windows Vista doesn't work on Windows7 too. When it will be released?
Thanks a lot!
Solved!
Go to Solution.

No Presentation Director for Win 7.
Matt Kohut
Lenovo Product Marketing

Unable to securely request for a page

Question:
a) I'm unable to securely request for my webpage : https://127.0.0.1:8443/Blah , instead I get the following Error:
Firefox can't establish a connection to the server at localhost:8443.
The site could be temporarily unavailable or too busy. Try again in a few
moments.
If you are unable to load any pages, check your computer's network
connection.
If your computer or network is protected by a firewall or proxy, make sure
that Firefox is permitted to access the Web.
On Internet Explorer I simply get:
Internet Explorer cannot display the webpage
b) How do I know which SSL Implementation my tomcat is making use of: JSSE/APR
Details:
web.xml
<?xml version="1.0"?>
<!DOCTYPE web-app PUBLIC
"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
id="Your_WebApp_ID"
version="2.5">
<description>The standard web descriptor for the email client</description>
<servlet>
<servlet-name>AuthenticateUser</servlet-name>
<servlet-class>MailBoxController</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>AuthenticateUser</servlet-name>
<url-pattern>/ControlPanel</url-pattern>
</servlet-mapping>
<welcome-file-list>
<welcome-file>login.jsp</welcome-file>
</welcome-file-list>
<error-page>
<error-code>401</error-code>
<location>/authenticationFailed.jsp</location>
</error-page>
<context-param>
<param-name>serverName</param-name>
<param-value>Gmail</param-value>
</context-param>
<context-param>
<param-name>port</param-name>
<param-value>993</param-value>
</context-param>
<context-param>
<param-name>ip</param-name>
<param-value>imap.gmail.com</param-value>
</context-param>
<session-config>
<session-timeout>30</session-timeout>
</session-config>
<listener>
<listener-class>Logger</listener-class>
</listener>
<security-constraint>
<web-resource-collection>
<url-pattern>/*</url-pattern>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>administrator</role-name>
</auth-constraint>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>BASIC</auth-method>
</login-config>
<security-role>
<role-name>administrator</role-name>
</security-role>
</web-app>
tomcat-users.xml :
<tomcat-users>
<role rolename="administrator"/>
<user username="admin" password="system123#" roles="administrator"/>
</tomcat-users>
Following tag was added in web.xml in conf of tomcat :
<-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 -->
<Connector
protocol="org.apache.coyote.http11.Http11NioProtocol"
port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="C:/Users/.keystore" keystorePass="changeit"
clientAuth="false" sslProtocol="TLS"/>
Can anybody please help me with my problem. Am I going wrong with configuring SSL?
Thanks
Krutika

I did add these lines:
<Connector
     protocol="org.apache.coyote.http11.Http11NioProtocol"
     port="8443" maxThreads="200"
     scheme="https" secure="true" SSLEnabled="true"
     keystoreFile="C:/Users/Krutika Ravi/.keystore" keystorePass="changeit"
     clientAuth="false" sslProtocol="TLS"/>
to the web.xml contained in conf folder of tomcat.
But didn't fiddle with server.xml -
After un-commenting
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
in server.xml contained in conf folder I get the following exceptions
Jul 25, 2012 11:11:41 PM org.apache.catalina.core.AprLifecycleListener init
INFO: Loaded APR based Apache Tomcat Native library 1.1.24 using APR version 1.4
.6.
Jul 25, 2012 11:11:41 PM org.apache.catalina.core.AprLifecycleListener init
INFO: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], ra
ndom [true].
Jul 25, 2012 11:11:43 PM org.apache.catalina.core.AprLifecycleListener initializ
eSSL
INFO: OpenSSL successfully initialized (OpenSSL 1.0.1c 10 May 2012)
Jul 25, 2012 11:11:43 PM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["http-apr-8080"]
Jul 25, 2012 11:11:43 PM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["http-apr-8443"]
Jul 25, 2012 11:11:43 PM org.apache.coyote.AbstractProtocol init
SEVERE: Failed to initialize end point associated with ProtocolHandler ["http-ap
r-8443"]
java.lang.Exception: Connector attribute SSLCertificateFile must be defined when
using SSL with APR
at org.apache.tomcat.util.net.AprEndpoint.bind(AprEndpoint.java:484)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.jav
a:610)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:429)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:9
81)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.core.StandardService.initInternal(StandardService
.java:559)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.j
ava:814)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.startup.Catalina.load(Catalina.java:624)
at org.apache.catalina.startup.Catalina.load(Catalina.java:649)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:601)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:450)
Jul 25, 2012 11:11:43 PM org.apache.catalina.core.StandardService initInternal
SEVERE: Failed to initialize connector [Connector[HTTP/1.1-8443]]
org.apache.catalina.LifecycleException: Failed to initialize component [Connecto
r[HTTP/1.1-8443]]
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:106)
at org.apache.catalina.core.StandardService.initInternal(StandardService
.java:559)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.j
ava:814)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.startup.Catalina.load(Catalina.java:624)
at org.apache.catalina.startup.Catalina.load(Catalina.java:649)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.
java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcces
sorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:601)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:450)
Caused by: org.apache.catalina.LifecycleException: Protocol handler initializati
on failed
at org.apache.catalina.connector.Connector.initInternal(Connector.java:9
83)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
... 12 more
Caused by: java.lang.Exception: Connector attribute SSLCertificateFile must be d
efined when using SSL with APR
at org.apache.tomcat.util.net.AprEndpoint.bind(AprEndpoint.java:484)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.jav
a:610)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:429)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:9
81)
... 13 more
Jul 25, 2012 11:11:43 PM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["ajp-apr-8009"]
Jul 25, 2012 11:11:43 PM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 2945 ms
Jul 25, 2012 11:11:43 PM org.apache.catalina.core.StandardService startInternal
INFO: Starting service Catalina
Jul 25, 2012 11:11:43 PM org.apache.catalina.core.StandardEngine startInternal
INFO: Starting Servlet Engine: Apache Tomcat/7.0.29
Jul 25, 2012 11:11:43 PM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive C:\Junkyard\apache-tomcat-7.0.29\webapps
\Blah.war
Jul 25, 2012 11:11:44 PM org.apache.catalina.loader.WebappClassLoader validateJa
rFile
INFO: validateJarFile(C:\Junkyard\apache-tomcat-7.0.29\webapps\Blah\WEB-INF\lib\
javax.servlet-5.1.12.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2.
Offending class: javax/servlet/Servlet.class
Logger Contructor
Servlet Context has been initialized
Jul 25, 2012 11:11:45 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\Junkyard\apache-tomcat-7.0.29\webap
ps\docs
Jul 25, 2012 11:11:45 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\Junkyard\apache-tomcat-7.0.29\webap
ps\examples
Jul 25, 2012 11:11:46 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\Junkyard\apache-tomcat-7.0.29\webap
ps\host-manager
Jul 25, 2012 11:11:46 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\Junkyard\apache-tomcat-7.0.29\webap
ps\manager
Jul 25, 2012 11:11:46 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\Junkyard\apache-tomcat-7.0.29\webap
ps\ROOT
Jul 25, 2012 11:11:46 PM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["http-apr-8080"]
Jul 25, 2012 11:11:46 PM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["ajp-apr-8009"]
Jul 25, 2012 11:11:46 PM org.apache.catalina.startup.Catalina start
INFO: Server startup in 2728 ms
Edited by: 948555 on Jul 25, 2012 10:42 AM

Windows 2012 server security checklist for corporate company standard/recommended check-list

Hello All,
Good Day.
I am looking for Windows 2012 server security checklist (standard hardening
settings), would you kindly assist me by providing Wintel 2012 standard/recommended check-list ASAP?
Thanks in advance.

Hi,
The Microsoft Security Compliance Manager 3.0 tool is designed to provide you with an end-to-end solution to help you plan, deploy, and monitor security baselines for computers running Windows Server 2012 in your environment.
For more detailed information, please refer to the articles below:
Windows Server 2012 Security Baseline
http://technet.microsoft.com/en-us/library/jj898542.aspx
Security Hardening Tips and Recommendations
http://social.technet.microsoft.com/wiki/contents/articles/18931.security-hardening-tips-and-recommendations.aspx
Regards,
Mandy
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Security Enclosure for Time Capsule?

I'm concerned about losing my iMac to theft, so I back it up on a Time Capsule. The only problem is that the TC is only slightly less prone to being stolen than the iMac, since I hide it under my desk.
I've looked around for some kind of secure enclosure for it that could be bolted to the floor or underneath the desk, but have only been able to find fireproof safes and security boxes that don't have air and cabling openings to allow the unit to run while it's enclosed.
Anyone know of a secure enclosure for a (running) Time Capsule?

Can you not just use the security slot on the back of it and attache a cable lock to it?

Load balancers with web servers & policy agents

I have a pair of host machines, hostA and hostB, running multiple web server instances, portalA, portalB, contentA, contentB, serviceA, serviceB, etc.
The two hosts, hostA and hostB, are sitting behind load balancers. ServiceA and serviceB must be protected by login and I have a policy agent installed on hostA and hostB for these two instances.
The load balancers respond to https://service/* and forward requests to http://serviceA:3456/* or http://serviceB:3456/* depending on the host selected by round-robin.
I've been told that serviceA and serviceB cannot be running on the default 443 port (although we could enable SSL if we wanted) in order to work nicely with the other web server instances that are behind the load balancers.
The problem is that the policy agent knows that it is running as http://serviceA:3456/.
The user makes a request to the load balancers for:
https://service/protected.html
The load balancer passes the request to:
http://serviceA:3456/protected.html
The agent sends a redirect to login which sends the user to:
http://service:3456/protected.html
This final URL is not available through the load balancers and it's obviously not the public URL.
I have fqdnDefault set to 'service.x.x' so the URL is rewritten to that extent. Is there a way to tell the agent that the port it's running on is not the public port (ie. that it's behind a NAT device)? Is there a way to tell the agent that it's should actually redirect to https and not http?

Hi,
CQ authoring does not leverage server side sessions, therefor you'll never loose data because of this.
But: As the cluster has a small delay on synchronisation, it could be, that on a write and subsequent read you'll get the old content, if you don't have sticky sessions (because both requests are not processed by the same server). Therefor I advise you to use sticky sessions in front of a CQ authoring cluster.
Jörg

Site behind load balancer - Key not valid for use in specified state

Hi,
I have created a sharepoint application page to access an active end point on ADFS and establish a fedauth session. All works well in single server. But when the page runs behind load balancer with 2 servers, it fails with key not valid for use in specified
state exception. Stickiness is enabled on load balancer. verified that.
I had made few changes to config file in microsoft.identitymodel section to accomodate adfs custom login. This included removing securitytokenhandlers and issuertokenresolvers as well. Is this impacting the encryption/decryption in anyway?
Any pointers would help.
Reference point for my application page : http://blog.helloitsliam.com/Lists/Posts/Post.aspx?ID=76

Hi,
As I understand, you encountered the error “Key not valid for use in specified state” when ADFS custom login.
In order to run in Windows Azure Web Sites a Web application which uses WIF for handling authentication, you must change the default cookie protection method (DPAPI, not available on Windows Azure Web Sites) to something that will work in a farmed environment
and with the IIS’ user profile load turned off.
1. If you are using the Identity and Access Tools for VS2012, just go to the Configuration tab and check the box “Enable Web farm ready cookies”.
2. If you want to do things by hand, add the following code snippet in your system.identitymodel/identityConfiguration element:
   <securityTokenHandlers>
     <add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler,
             System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler,
            System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
    </securityTokenHandlers>
There is a similar case:
http://stackoverflow.com/questions/19323287/key-not-valid-for-use-in-specified-state-error-for-net-4-5-mvc-4-application
Best regards,
Sara Fan
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Weblogic 10.3 secure jsessionid cookie

Hi,
I am running my application on weblogic 10.3 app server. And my application is running on both HTTP and HTTPS. My questions is around the JSESSIONID cookie that App server generates and send to client. By default this cookie is non-secure, even if application runs on HTTPS. I want to know, how can Weblogic App Server create a new JSESSIONID cookie which is secure, when application moves from HTTP to HTTPS? My requirement is to run the application on secure JSESSIONID cookie when we use HTTPS.
How can i achieve it? It's kind of critical to me.
Any help is highly appreciated.

I tried setting up the secure cookie by modifying the config.xml.
But my app server is shutting down forcefully by throwing this message.
<Aug 28, 2009 1:05:18 PM GMT+05:30> <Error> <Management> <BEA-141244> <Schema va
lidation errors while parsing D:\bea\user_projects\domains\zendough\config\confi
g.xml - Expected elements 'weblogic-plugin-enabled@http://www.bea.com/ns/weblogi
c/920/domain hosts-migratable-services@http://www.bea.com/ns/weblogic/920/domain
http-trace-support-enabled@http://www.bea.com/ns/weblogic/920/domain key-stores
@http://www.bea.com/ns/weblogic/920/domain custom-identity-key-store-file-name@h
ttp://www.bea.com/ns/weblogic/920/domain custom-identity-key-store-type@http://w
ww.bea.com/ns/weblogic/920/domain custom-identity-key-store-pass-phrase-encrypte
d@http://www.bea.com/ns/weblogic/920/domain custom-trust-key-store-file-name@htt
p://www.bea.com/ns/weblogic/920/domain custom-trust-key-store-type@http://www.be
a.com/ns/weblogic/920/domain custom-trust-key-store-pass-phrase-encrypted@http:/
/www.bea.com/ns/weblogic/920/domain java-standard-trust-key-store-pass-phrase-en
crypted@http://www.bea.com/ns/weblogic/920/domain reliable-delivery-policy@http:
//www.bea.com/ns/weblogic/920/domain message-id-prefix-enabled@http://www.bea.co
m/ns/weblogic/920/domain default-file-store@http://www.bea.com/ns/weblogic/920/d
omain candidate-machine@http://www.bea.com/ns/weblogic/920/domain overload-prote
ction@http://www.bea.com/ns/weblogic/920/domain jdbcllr-table-name@http://www.be
a.com/ns/weblogic/920/domain jdbcllr-table-xid-column-size@http://www.bea.com/ns
/weblogic/920/domain jdbcllr-table-pool-column-size@http://www.bea.com/ns/weblog
ic/920/domain jdbcllr-table-record-column-size@http://www.bea.com/ns/weblogic/92
0/domain jdbc-login-timeout-seconds@http://www.bea.com/ns/weblogic/920/domain se
rver-diagnostic-config@http://www.bea.com/ns/weblogic/920/domain auto-jdbc-conne
ction-close@http://www.bea.com/ns/weblogic/920/domain supported-protocol@http://
www.bea.com/ns/weblogic/920/domain federation-services@http://www.bea.com/ns/web
logic/920/domain single-sign-on-services@http://www.bea.com/ns/weblogic/920/doma
in web-service@http://www.bea.com/ns/weblogic/920/domain nm-socket-create-timeou
t-in-millis@http://www.bea.com/ns/weblogic/920/domain' instead of 'web-server@ht
tp://www.bea.com/ns/weblogic/920/domain' here in element server@http://www.bea.c
om/ns/weblogic/920/domain>
Here is my config.xml
<?xml version='1.0' encoding='UTF-8'?>
<domain xmlns="http://www.bea.com/ns/weblogic/920/domain" xmlns:sec="http://www.bea.com/ns/weblogic/90/security" xmlns:wls="http://www.bea.com/ns/weblogic/90/security/wls" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.bea.com/ns/weblogic/90/security/wls http://www.bea.com/ns/weblogic/90/security/wls.xsd http://www.bea.com/ns/weblogic/920/domain http://www.bea.com/ns/weblogic/920/domain.xsd http://www.bea.com/ns/weblogic/90/security/xacml http://www.bea.com/ns/weblogic/90/security/xacml.xsd http://www.bea.com/ns/weblogic/90/security http://www.bea.com/ns/weblogic/90/security.xsd">
<name>zendough</name>
<domain-version>10.3.0.0</domain-version>
<security-configuration>
<name>zendough</name>
<realm>
<sec:authentication-provider xsi:type="wls:default-authenticatorType"></sec:authentication-provider>
<sec:authentication-provider xsi:type="wls:default-identity-asserterType">
<sec:active-type>AuthenticatedUser</sec:active-type>
</sec:authentication-provider>
<sec:role-mapper xmlns:xac="http://www.bea.com/ns/weblogic/90/security/xacml" xsi:type="xac:xacml-role-mapperType"></sec:role-mapper>
<sec:authorizer xmlns:xac="http://www.bea.com/ns/weblogic/90/security/xacml" xsi:type="xac:xacml-authorizerType"></sec:authorizer>
<sec:adjudicator xsi:type="wls:default-adjudicatorType"></sec:adjudicator>
<sec:credential-mapper xsi:type="wls:default-credential-mapperType"></sec:credential-mapper>
<sec:cert-path-provider xsi:type="wls:web-logic-cert-path-providerType"></sec:cert-path-provider>
<sec:cert-path-builder>WebLogicCertPathProvider</sec:cert-path-builder>
<sec:name>myrealm</sec:name>
</realm>
<default-realm>myrealm</default-realm>
<credential-encrypted>uuuuuu</credential-encrypted>
<node-manager-username>weblogic</node-manager-username>
<node-manager-password-encrypted>kkkkk</node-manager-password-encrypted>
</security-configuration>
<server>
<name>AdminServer</name>
<ssl>
<enabled>true</enabled>
</ssl>
<listen-port>7001</listen-port>
<listen-port-enabled>true</listen-port-enabled>
<listen-address></listen-address>
<java-compiler>javac</java-compiler>
<client-cert-proxy-enabled>false</client-cert-proxy-enabled>
<web-server>
<auth-cookie-enabled>true</auth-cookie-enabled>
</web-server>
</server>
<embedded-ldap>
<name>ttttt</name>
<credential-encrypted>yyyyy</credential-encrypted>
</embedded-ldap>
<configuration-version>10.3.0.0</configuration-version>
<app-deployment>
<name>hybrisplatform</name>
<target>AdminServer</target>
<module-type>ear</module-type>
<source-path>xxxxx</source-path>
<deployment-order>100</deployment-order>
<security-dd-model>DDOnly</security-dd-model>
<staging-mode>stage</staging-mode>
</app-deployment>
<admin-server-name>AdminServer</admin-server-name>
</domain>

Can't update. Message says I don't have all permissions, yet have admin rights for imac running 10.5.8 & checked preference, security settings.

Trying to update. When I drag ff icon to apps folder message says replace or stop. Answer replace, then message says can't complete as I don't have permissions. I have full admin rights for imac running 10.5.8. I've reviewed preferences & security settings, FF is set to accept all incoming connections. Not sure what else to check.

If there are problems with updating or with the permissions then easiest is to download the full version and trash the currently installed version to do a clean install of the new version.
Download a new copy of the Firefox program and save the disk image (dmg) file to the desktop
*Firefox 9.0.x: http://www.mozilla.com/en-US/firefox/all.html
*Trash the current Firefox application to do a clean (re-)install
*Install the new version that you have downloaded
Your profile data is stored elsewhere in the Firefox Profile Folder, so you won't lose your bookmarks and other personal data if you uninstall and (re)install Firefox.
*http://kb.mozillazine.org/Profile_folder_-_Firefox

Oracle Workshop for Weblogic load error

Hello,
I installed Weblogic 10.3 on CentOS 4.6 linux. Weblogic server 10.3 runs without error but when I run Oracle Workshop for Weblogic - specify a workspace I receive a JVM terminated error code 127.
/home/oracle/bea/jrockit_160_05/jre/bin/java: symbol lookup error : /usr/lib/firefox-1.5.0.12/components/libdocshell.so: undefined symbol: PR_GetPhysicalMemorySize
I wonder if anyone has received this error and if so what they did to fix it??
Thanks in advance for your help.
Jonathan

Hi Jonathan,
This similar thread seems interesting: http://ubuntuforums.org/showthread.php?t=134760
In that thread, the guy had conflicts between 1.5 and 1.7 version libraries for mozilla. I'm no Linux expert, but you might want to use the ldd command to look at the dependencies for the libraries of interest.
Hopefully, someone else can give you some tips based on their own solution to your same problem but if that doesn't pan out then maybe this will give you something to go on.

How to turn off core dump for WebLogic 8.1 running on AIX 5.3

Hi there,
Is there a way we can turn off core dumping for WebLogic 8.1 running on AIX 5.3?
Thank you.
Regards,
Surender

Hi Surender,
Please add the following Flag in the JAVA_OPTIONS of your servers StartScript like following :
JAVA_OPTIONS=${JAVA_OPTIONS} -Xdump:system:none
Thanks
Jay SenSharma
http://jaysensharma.wordpress.com/2009/12/30/jvm-crash-and-native-outofmemory/ (WebLogic Wonders Are Here)

How to run FVC utility for Weblogic server?

Hi all,
I want to use FVC(Form Version Controller) utility to update the database for some users.
I have provided the required parameters in the "fvc.properties".
When i run the utility from command prompt it is just printing the parameters given in the fvc properties file and the execution stops.
When i check the database nothing is updated.
I'm using BEA-Weblogic Version 8.1 as application server.
But in another environment where I'm using OC4J as application server I'm able to run the FVC utility and it is also updating the database.
Is there any other steps that we have to follow ,if we want to use this utility for Weblogic?
Thanks.

Hi,
The following is script found in fvcutil.cmd
@echo off
setlocal
if "%1" == "" goto usage
if "%2" == "" goto usage
call classpath
set CLASSPATH=%CLASSPATH%;.\lib\xlFvcUtil.jar;.\ext\jbossall-client.jar;.\ext\weblogic.jar;.\ext\oscache.jar;.\ext\javagroups-all.jar;.\ext\commons-logging.jar
D:\oracle_dev_design/xlclient/java\bin\java -DXL.FvcProps=fvc.properties -DXL.HomeDir=. -Djava.security.auth.login.config=.\config\authwl.conf com.thortech.xl.util.fvcutil.FVCUtil %1 %2
goto end
:usage
echo.
echo "USAGE : fvcutil.cmd <USERNAME> <PASSWORD>"
echo.
:end
endlocal
authwl is set properly. But when we run this command we get only parameters given in the fvc property file.
But when we run the same in another environment using (OC4J Application server) we are able to update the database using fvc.
Please guide us out on this regard to execute the same in weblogic server enabled environment.
Thanks

Secure JSESSIONID for Weblogic running HTTP behind load balancers

Similar Messages

Maybe you are looking for