Security and connection string

Hi,
   I am a new developer using ColdFusion.
   Does ColdFusion support Windows Authentication or I have to have my connection string in plain text in my cfm files?
   Can I have connection string in my form or I have in one config file?
   Is it possible to encryp my password and user name in the cfm file?
   Your information and help is great appreciated,
   Regards,
iccsi,

That is a broad question. Are you referring to connections to data sources, or recognizing user IDs for site logins? If the former, you can configure the database logins (with some caveats) within the secure CF Administrator, and never have to pass credentials directly in your CFML code. As for user IDs for logins, if you configure your webserver (IIS) to use Windows Authentication via NTLM, Coldfusion will receive the Windows login and make it acccessible to you via CGI variables.
-Carl V.

Similar Messages

What are the username, password and connect string for Designer 6.1.1?

So that we may better diagnose DOWNLOAD problems, please provide the following information.
- Server name
- Filename
Oracle designer6.1.1
- Date/Time
- Browser + Version
IE 6.0
- O/S + Version
Win 98
- Error Msg
ORA-12154:TNS:could not resolve service name.
RME-00220:Fail to connect to repository
These error messages were shown after I entered system, manager and internal, respectively.

Hi YungJen Chen,
There is no general username, password and connect string for
Designer 6i Release 4.1.1.
First, you install the client tools using the Installer. See also the
Designer Installation Guide, Chapter 1, 'Client Side installation'.
Second, you install the repository into an existing database, using
the Designer Installation Guide, Chapter 2, 'Server-side installation,
migration and upgrade'.
The Installation Guide provides step by step instructions on what
users you need to create for various purposes. Any database users
you may need to use such as System or Sys will use the password
given when you installed the database, or whatever passowrd you
changed it to since.
The Installation Guide is available as part of the download, or from
your Windows Start Menu once the Designer client tools are installed
or from the Designer Documentation page here on OTN.
Hope this helps. Regards,
Dominic Battiston
Designer/JDeveloper Product Management

What are the username, password, and connect string for Designer6i R4.1.1

As the title, I tried system, manager and internal.
But it did not work out.
Thank you for your help.

Hi YungJen Chen,
There is no general username, password and connect string for
Designer 6i Release 4.1.1.
First, you install the client tools using the Installer. See also the
Designer Installation Guide, Chapter 1, 'Client Side installation'.
Second, you install the repository into an existing database, using
the Designer Installation Guide, Chapter 2, 'Server-side installation,
migration and upgrade'.
The Installation Guide provides step by step instructions on what
users you need to create for various purposes. Any database users
you may need to use such as System or Sys will use the password
given when you installed the database, or whatever passowrd you
changed it to since.
The Installation Guide is available as part of the download, or from
your Windows Start Menu once the Designer client tools are installed
or from the Designer Documentation page here on OTN.
Hope this helps. Regards,
Dominic Battiston
Designer/JDeveloper Product Management

Driver name and connect String ??

hi guys..
i have developed some JDBC applications connecting to Oracle servers.
Now, i want to develop a JDBC application that connects to DB2 server;
how do i know the driver name and connect String im supposed to pass to
class.forName(driver_name);
and to
DriverManager.getConnection(connect_string);
i use db2java.zip that ships with DB2..
Appreaciating ur cooperation..
Mourad

Look at your DB2 docs. You'll have to download their JDBC driver, of course.
You should know the drill - you've done this with Oracle. - MOD

Securely sending connection string to swf?

ok so when i need to connect a swf to some sort of data
source on the server be it XML, a .NET DLL, a CFC or what ever so
that i can load data from a database or what ever, everyone is
always saying that i shouldn't hard code the connection string into
my actionscript as anyone can get it and do malicious things with
it.
So how should i load the connection string into flash. if i
put them on the server in an XML file or somthing like that then i
still need to put a connection string into the actionscript in
order to load in my main connection strings into the actionscript.
Basically i need to know how to load an external string into
a swf without anyone else being able to get hold of that string for
them selves.
i realy need help with this because i am developing an app
for somone and i need it to connect to a database and i need it to
be secure. i have everything sorted except making the connection
string to the database unstealable.

Why aren't you just using regular form submissions to send
data and regular string data or xml to load data?
I don't think you can hide anything from the user. I think
you have to handle security serverside and the client only gets to
see his own user/pass and whatever data you send to him.

Incompatible Security and Connection time out

Ok, since installing leopard, I have not been able to connect to the stronger of my two wireless connections. The weak on, which is WPA connects fine, when I can get a strong enough signal. The second, WEP (I know, people say it's weak, but thats what I have.) But the password I put in, and it is the correct password, keeps saying that it is the wrong password when I do the "assist me" option.
When I just try to connect using the drop down menu on the airport icon, it says "incompatible security" and once in a while, it will say "connection time out".
I did a search, but none of the solutions here have worked. Any help would be greatly appreciated, because as a student I need the wireless connection for homework purposes, and I cant tolerate a weak connection.
Please help
Blake
Message was edited by: blakewt

Hi.
I can't connect to WEP networks either with Leopard 10.5.1.
It just says "incompatible Security". I've tried it for one hour without any luck.
Why doesn't Apple realize that there are millions of WEP encrypted networks out there and that it is essential to be able to connect to them. (it worked with Tiger, didn't it?)
Is there a knowledge base article out there what to do about it?
I just can't walk to hotel managers and ask them to switch to WPA, especially if they don't have a clue how to do that and older windows computers won't be able to connect any more.
Why a transparent menu bar but no way to connect to WEP networks?
I'm very disappointed. Apple, fix this! (now!)
Is there actually a way to get your money back for Leopard if this basic things don't work anymore?
Thank you for any help.

Newbie question for LogOn trigger and Connection String

Hi,
I would like to set certain session variables in the logon trigger. Is there a connection string attribute or some other way to pass a string or some data to the session.
regards
Stefan

Hi,
my concrete problem is that our application only uses one user. eg. appuser . During the login process of the application the "real" user name, language and other attributes are set in a packag as global variables.
This works fine, but as soon as a usr logs on the DB without our application login then these are ofcourse not filled. My idea was to maybe to be able to enhance the connection string and to be able to pass some more information to the logon trigger.
regards
Stefan

Driver and connection string for DB2 7.1 IBM Z/OS Mainframe

Hi ALL,
Could someone please provide me the connection string and driver for DB2 7.1 IBM Z/OS Mainframe?
Regards,
XIer

Hello,
With SAP and DB2 V7 still ICLI which is part of the operating system is used for DB connectivity. For details on the setup see related docs for SAP releases up to 6.20 .
As of Netweaver 2004 DB2 V8 and DB2 Connect is used.
If you're talking about Java you need a license either from IBM or if you're OEM customer for DB2 on z/OS it is delivered automatically.
Regards,
Thomas

Security and Connectivity procedures (B2B)

Hello All
I would like to know the various security settings in Adapters for A2A and B2B communications. If there is any user guide or document links, then it would be helpful. And what are the different connectivity links needs to be established with the partners for B2B to establish the connection. Any doc or links in this area is also appreciated. Thanks
Ricky

hi
Check out this links, if it serves your purpose
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/9133d51d-0b01-0010-438c-dbc41d3d71da
http://help.sap.com/saphelp_nw2004s/helpdata/en/f5/799add57aeee4f889265094a04695c/content.htm
http://help.sap.com/saphelp_nw2004s/helpdata/en/6a/3f93404f673028e10000000a1550b0/content.htm
Thanks & Regards
Harsimran

Where to place safely connection string

Dear all,
I have build a desktop application which use actually an SQL server express 2008 R2 database accessible from the application through WCF endpoints. WCF endpoint are hosted in a Windows Service and contain the necessary connection string as Windows Authentication
so far.
We are now study the possibility to move our database to SQL azure in a simple manner. For that we have 2 possiblities
1 - The Windows Service host for WCF services for database connection remain local the to the PC running the application and then we change the connection string authentication method to SQL authentication but then user and password will be clearly visible
in config file
2 - We move the WCF service host somewhere in Azure but I guess it will be extra cost because they can be quite many hit to those end point due to the quantity of data the application may require
3 - Is there an other way to hide the connection string in Azure ?
Thnaks for info on the best solution to go
regards

Hello,
Based on your description, you can try to
encrypt or decrypt sections of web configuration file.
You can refer to Wayne Walter Berry 's blog to understand how to encrypt web.config:
Securing Your Connection String in Windows Azure: Part 1
Securing Your Connection String in Windows Azure: Part 2
Securing Your Connection String in Windows Azure: Part 3
Securing Your Connection String in Windows Azure: Part 4
Regards,
Fanny Liu
Fanny Liu
TechNet Community Support

C How to Set Isolation Level in the Connection String

How to Set Isolation Level in the Connection String using the "Microsoft OLE DB Provider for DB2 Version 4.0"?
We are trying to move from Crystal Reporting that run against a IBM DB2 database on a mainfram to SSRS reporting and we have downloaded the "Microsoft OLE DB Provider for DB2 Version 4.0" and then worked with the DB2 Administrator to create the
Packages. We only have access to use the "Read Uncommitted ("MSUR001") package. We were able to connect and pull data before he removed access to the other packages, but after setting access the Connection keeps trying to use
the 'Cursor Stability (MSCS001)" package. How do we change the Default to the "Read Uncommitted ("MSUR001") package??? Since it is keeps defaulting to the the other package
we can't connect to do it in the T-SQL query, it has to be set at the Connection String level.

Hi Dannyboy1263,
According to your description, you want to set the Transaction Isolation Level in Connection String. Right?
In Reporting Services, the Connection String for OLE DB Connection can only contains Provider, Data Source and Initial Catalog. There's no property for setting Transaction Isolation Level in the Connection String. Based on my knowledge, we can
only set the Transaction Isolation Level at Query level or set it by using code (C#, VB, Java...) to call the property of Connection. So unfortunately your requirement can't be achieved currently.
Reference:
OLE DB Connection Type (SSRS)
Data Connections, Data Sources, and Connection Strings in Reporting Services
If you have any question, please feel free to ask.
Best Regards,
Simon Hou

Need PL/SQL Code to get Oracle connection string

Hi
Could you please give any solution to below requirement?
Requirement :
I have an existing pl/sql program (Registered as concurrent Program) in which i am calling a "C" Program. The "C" program expects a parameter to pass the value of oracle connection string (userid/pwd@instance). The C Program takes the connection string to connect to oracle and manipulate data.
Question. How will I get Oracle userid,pwd and connection string being in PL/SQL Session so that it will run for every instance i move the code in.
Note :
1.) We have limitations to call another concurrent program to fetch these data.
2.) We cannot hard code the value in the program because of compliance issue.
Any example of code will help.
Thanks in Advance.
Cheers
Samar

Hi,
Check the below link, It might help you.
http://download.oracle.com/docs/cd/B13789_01/appdev.101/b10802/d_obtool.htm
http://download.oracle.com/docs/cd/B10501_01/appdev.920/a96590/adgsec04.htm
Twinkle

Connection string in dev and production

I have a several servers that i want to pull data from.
I put the connection string in a OBJECT variable that come from configuration table and use it in the for loop mapping the value to local variable called connectionstring, this variable is the expression for the connection string property.
So far everything is working as expected.
my problem is that on my development i put my local server in the connection string variable so i will be able to connect to the server so i will be able to map source to destination.
When i deploy the solution to production the data in the configuration table is different obviously but i get a connection error that saying that it try to connect to my dev server.
Any idea why?
Thanks.

Seems like you haven't configured your package properly
Here are some important consideration for SQL Server Configuration
Now, let’s go through some important considerations that will help you to understand this configuration type better, and to avoid common implementation issues:
SQL Server configurations are very flexible, as you can store multiple configuration properties/values in the same table.
Multiple packages can use the same configuration table and filter.
You can have a configuration filter for each entry in the configuration table, or you can use the same filter to group a set of entries. If you use the second approach, make sure that all properties under the selected filter exist in the package
being configured. Otherwise warning messages are generated for those properties in the configuration filter that do not exist in the target package.
You can use existing database security and backup policies to protect the configuration table contents.
A drawback of this configuration type is that it relies on an SSIS connection manager to get access to the configuration table, but does not have built-in support for updating its connection string. In other words, the connection string that points
to the configuration table is hard-coded inside of the package, and you have to take extra steps in order to update it (for example, through an extra package configuration placed at the top of the Package Configurations Organizer, or in SQL Server 2008, by
using the /CONN option of DTExec).
The /CONN option of DTExec utility can be used to override the connection string used by the configuration only in SSIS 2008. This is because SQL Server 2008 Integration Services reloads configurations after applying DTExec command line options.
The configuration wizard can create the table and insert the required rows when they do not exist, but only if the direct method is chosen. The wizard never includes any sensitive data in the ConfiguredValue column of the table, and you would need
to manually update the table to add the required sensitive data.
If you use the direct method, and provide an existing configuration filter, the wizard will prompt you to either reuse the configuration information in the table or to override it with the property values from the current package. Make sure that
you understand this behavior, since choosing the wrong option could change the contents of the configuration table and produce unexpected execution results.
When you use the indirect method, the environment variable must contain the name of the configuration connection manager, the name of the configuration table and the configuration filter. The syntax should be:
“ConfigurationManagerName”;”Schema.ConfigurationTableName”;’ConfigurationFilter”
As with the direct method, you have to account for extra logic if you need to modify the connection string inside of “ConfigurationManagerName”

Provider Connection String and Extended Protection

Good morning,
I have an application which by default uses OLEDB as Provider in the Connection String and I cannot change this. The Connection String that it uses is the following:
"Provider=SQLOLEDB.1;Data Source=ServerName;Initial Catalog=DatabaseName;Persist Security Info=False;Integrated Security=SSPI"
The database server (SQL Server 2012) and the client application are placed in two different computers but in the same domain.
The problem is that I cannot connect to the server from the application when I configure the SQL with Force Encryption On and Extended Protection as Required or Allowed. If I disable Force Encryption, then the connection works (Extended protection as Required
and Allowed). This happens when I use Windows Authentication, with SQL Server Authentication there is no problem.
I've tried to use this connection string in a Visual Basic script and it doesn't work either. But when I change the provider to "Provider=SQLNCLI11" then it works (with Force Encryption On, Extended Protection as Required/Allowed, and using Windows
Authentication).
With SQL Server Management Studio everything works fine.
Anyone can explain me the reason why this happens? and if is there a solution?
Thank you!

public static void DoTestDbOracle()
// OracleConnection takes the settings from TNSNAMES.ORA
OracleConnection connOracle = new OracleConnection("SERVER=FRED.WORLD;PWD=uFRED;UID=pFRED");
String strSQL = "SELECT DISTINCT MARKET_ID, SWITCH_NO, CELL_ID, SECTOR_ID FROM FRED_TABLE";
connOracle.Open();
OracleCommand cmdOracle = new OracleCommand(strSQL, connOracle);
OracleDataReader rdrOracle = cmdOracle.ExecuteReader();
while (rdrOracle.Read())
Console.WriteLine("{0:G}-{1:G}-{2:G}-{3:G}",
rdrOracle["MARKET_ID"],
rdrOracle["SWITCH_NO"],
rdrOracle["CELL_ID"],
rdrOracle["SECTOR_ID"]);
connOracle.Close();
}

I run Dev 6i on Windows 2008 R2 64-bit,the forms are working fine after connection to the database but the reports continue to request for username, password and database connection string every time i try to open a report.

I receive REP-0501: Unable to connect to specified database. I run developer 6i application on windows 2008 r2. I have applied the nn60.dll and nnb60.dll files to the \BIN directory. The forms are working fine. The reports will only display after the correct user id (username, password and database connection string) is supplied. This is happening to all attempts to open already complied form. Pls, help.

If you are connecting to an Oracle 11g database, remember that by default the passwords are case sensitive. To disable that, run
ALTER SYSTEM SET SEC_CASE_SENSITIVE_LOGON = FALSE;

Security and connection string

Similar Messages

Maybe you are looking for