Security APEX organization question

Background
Windows 2003 server
Oracle 10G
APEX 2.2 sonn upgrade to 3.0 / 3.1
Midsize organization / very small IT staff
I am not a security guru
We wish to position ourselves to expand and add users we wish to make this task as seemless as possible. We have applications in Apex that are being built using apex_public_user (controlled by oracle table to verify access and conditional displays) / and others using apex_users.
We have a plan to use application specific tables to control conditional displays and processes and use our windows security and groups to contol the ability to get to the application.
We want to take this tact to allow the helpdesk personal to set up security and allow reset of passwords.
My question is does this plan seem sound and has anyone implemented such infrastructure.
What are the pitfalls i need to be aware of?
and if this is a valid approach and is there a step by step approach to implement this.

Hello,
Take a look at Authorizations in the documentation, they will allow you to precisely control who can see what -
http://download.oracle.com/docs/cd/E10513_01/doc/appdev.310/e10499/sec.htm#BABEDFGB
Also, to detect when people tamper with the URL you might want to check out Session State Protection too -
http://download.oracle.com/docs/cd/E10513_01/doc/appdev.310/e10499/sec.htm#CDDGIGJH
Hope this helps,
John.
Blog: http://jes.blogs.shellprompt.net
Work: http://www.apex-evangelists.com
Author of Pro Application Express: http://tinyurl.com/3gu7cd
REWARDS: Please remember to mark helpful or correct posts on the forum, not just for my answers but for everyone!

Similar Messages

HT5312 how do u reset your security answers and questions, if you forgot them

I need help witht reseting my security answers and questions and i forgot them.

The page that you posted from has instructions for how to reset them i.e. if you have a rescue email address (which is not the same thing as an alternate email address) set up on your account then steps 1 to 5 half-way down that page should give you a reset link.
If you don't have a rescue email address (you won't be able to add one until you can answer your questions) then you will need to contact iTunes Support / Apple in your country to get the questions reset.
Contacting Apple about account security : http://support.apple.com/kb/HT5699
When they've been reset (and if you don't already have a rescue email address) you can then use the steps half-way down the HT5312 page that you posted from to add a rescue email address for potential future use

WS Security digital certificate question

I have a BPEL process which I have secured using OWSM. I am using digital certificates which I have generated using the keytool command.
Say I have two clients A and B and both have their certificates and send the messages. The request contains a field called sender. A should specify this field as A, and B should specify this as B. How do I verify that A send the message in which the the sender is specified as A.
I want to validate against the digital certificate belongs to sender A. He does not fool me by providing the certificate of A but in the message sends the sender as B.
Is this scenario valid? If yes how to resolve if not why not?
Thanks in advance for your help.
Regards,
Sash

this is not really a certificate issue. Its more of your application / process and where you want to handle this validation. (either at OWSM or else where).
When Sender A is digitally signing the message it is coming only from A (unless the private key / cert is stolen, etc). It A itself sends wrong value for sender field, they are not sending message as per your schema.
To answer your question, yes you can validate if the sender field matches with one of the fields in your cert such as Organization Name or you can map to your database. You have to write a custom step in OWSM to match the certificate information with the sender field.
Thanks
Ram

I have updated to 6.0.1 and when i try download an app for the appstore it asks me to increase my security by adding questions but when i try this it says session espired try again and it says this everytime i try to download an app HEEEEEEEEEELP PLEASE

help me please

First go to Settings > iTunes and App Stores > Tap on your Apple ID > Then Tap on Sign Out.
Go back and sign in again and see if you can update your security question.
Still having problems? I'd sign out of my Apple account, then reset your iPad before signing back in. Press and hold the Home and Sleep buttons simultaneously ignoring the red slider until the Apple logo appears. Let go of the buttons and let the device restart. See if that fixes your problem.

I have an itunes account, and log in ok, but when buying an apps it asked for security answers to questions for which I have tried but cannot remember

can anyone help I can log in to itunes, successfully, but when I try to buy anse app on ipod via itunes etc and it asks security questions I cannot remember what they are , have tried but no joy... help.. I cannot call support as I am deaf.

Hello DreamCakes,
The following article provides the necessary steps for restting your security questions.
Rescue email address and how to reset Apple ID security questions
http://support.apple.com/kb/HT5312
Cheers,
Allen

TS1702 I forgot security required 3 questions and answers.

I forgot my secure required 3questions and answers.
So I don,t buy the app.
Please check it out.

I want to buy the app for I.pad.
But I don,t buy it because I forgot my password and your secured required questions and answers.
I change my password successful. But i don,t know
your secured required questions and answers
I want to buy the apps.

Organizational questions from a new iPhoto user

Hello,
I recently purchased iPhoto in hopes that it will help me view my photos easily. I have a large (about 3,000) existing photo collection. I keep this collection very organized, and all photos are in a folder hierarchy of the form 'Year->Month->Day'. The name of each photo begins with the date, such as '2007-01-17 Trees.jpg'. My questions about iPhoto in relation to my existing photos are as follows:
1) If I allow iPhoto to copy my photos, how does iPhoto organize the photos? Do I have any control over this organization or the file naming convention used? Will iPhoto recreate an intelligible directory structure with useful file names, or will all my subsequently imported photos be labeled as "PIC2315..." in a random directory structure?
2) Can I make it such that iPhoto imports my photos and takes the date from the first characters of the file name, and the picture title from the subsequent portion of the file name?
3) Not all of the dates in the metadata accurately reflect the date the photo was taken (some are old photos that were scanned in, some taken before digital cameras had extensive metadata), but the dates used at the beginning of the file names are accurate. Can I use iPhoto to update the date stamp on the photos in my library? Otherwise, the 'organize by date' option is not very useful.
4) Is there any way to move the iPhoto library folder? It looks like, as with iTunes, iPhoto locates its library folder in a conspicuous location, whereas I feel that these files should be relegated to a more discrete location, like the Library folder (in my opinion, the 'pictures' folder should be reserved for images; data files should be stored elsewhere). This is not a big issue, more of an annoyance that Apple imposes its organizational conventions on me without my consent.
Advice on any of these questions would be greatly appreciated. Thanks very much.
Adrian
PowerBook G4 Mac OS X (10.4.1)

Hi Adrian
1) If I allow iPhoto to copy my photos, how does iPhoto organize the photos
Here's how the iPhoto Library Folder is organised:
In this folder there are various files, which are the Library itself and some ancillary files. Then you have three folders
Originals are the photos as they were downloaded from your camera or scanner.
(ii) Modified contains edited pics, shots that you have cropped, rotated or changed in any way.
This allows the Photos -> Revert to Original command - very useful if you don't like the changes you've made.
(iii) Data holds the thumbnails the the app needs to show you the photos in the iPhoto Window.
To your specific questions:
Do I have any control over this organization
No. The exception is if you take responsibility for the File Management (In the Preferences, Advanced Pane, Uncheck Copy Files to the iPhoto Library Folder...) That way you can leave your files untouched in your file structure. However, if you do this when you delete a file from iPhoto you will need to delete it from the Finder by hand. Not the case if you let iPhoto do the file management.
Will iPhoto recreate an intelligible directory structure with useful file names, or will all my subsequently imported photos be labeled as "PIC2315..." in a random directory structure?
Yes it will, the files will be in rolls that can be named via the iPhoto Window and which names will be reflected in the Finder. The Pictures will be named as per the file name.
I'm guessing that all of this is so that you can easily and quickly find a file if you need it. However, you're missing the point of iPhoto. It's a Photo Organiser. The idea is you import your pics into it, they are stored (in full view) in the Finder and then everything you need to do can be done via the iPhoto Window. Organise them, arrange them into albums (infinitely more flexible than your current folders - a single pic can be in any number of albums or slideshows, can be in Smart Albums, can be easily edited in external editors and exported easily.) Want to find a file? There are three ways (at least) to get files from the iPhoto Window.
1. Drag and Drop: Drag a photo from the iPhoto Window to the desktop, there iPhoto will make a full-sized copy of the pic.
2. File -> Export: Select the files in the iPhoto Window and go File -> Export. The dialogue will give you various options, including altering the format, naming the files and changing the size.
3. Show File: Right- (or Control-) Click on a pic and in the resulting dialogue choose 'Show File'. A Finder window will pop open with the file already selected.
2) Can I make it such that iPhoto imports my photos and takes the date from the first characters of the file name, and the picture title from the subsequent portion of the file name?
No, it will take the date from the EXIF data. However you can edit the date, title etc. from the Info window (the wee 'i' bottom left hand corner.) I think that answers your next question as well.
4. You can put the iPhoto Library Folder anywhere you like, on an external disk, in another place on your HD, whatever. Apple aren't forcing you to do anything. (You can do the same with iTunes too). However, remember the iPhoto Library Folder contains Data and images.
One thing to remember is the standard warning: It is strongly advised that you do not move, change or in anyway alter things in the iPhoto Library Folder as this can cause the application to fail and even lead to data loss.
iPhoto is a very good app, reliable and very flexible. But you do have to work with it. All the work you've done on your folders you can recreate in the iPhoto Window (just drag the folders to the Source Window where they will be imported into Albums). Think of it as a Front End to your photo collection. Up to now you've been using the Finder as a front end, iPhoto is a lot more flexible.
Feel free to ask more if you want further clarification or info.
Regards
TD

Basic Security & form printing questions.

Hi, I am not an Oracle Forms developer yet, just gathering info, but I have 2 probably simple questions for you forms experts out there that maybe you can help me with.
Lets say that this new application will have 10 users and I create a main menu with 5 categories. Can forms allow me to give 4 users read/viewable rights to, lets say 3 categories,instead of all 5 categories? Bsically I just need to know if it offers some kind of security that I can create for each individual user.
The next question is if I create 10 forms that is supposed to 'retrieve' data, but I need to also have these 10 forms print out 'without' the data. Do I need to create 20 forms, or is 10 sufficient and oracle would allow me to print the forms out either with or without data.
Thank you in advance
null

There is menu-level security, meaning that only users that have certain roles may execute certain menu choices.
There's no special security at form level, apart from the database level security.
If a database user does not have insert, update & delete priviledges on a datablock in the form (but has the select priviledge), then, he won't be able to change the data in that block using the form, and if he'd try to, he'd get an error when trying to commit the changes.
Well, you may use set_block_property(your_block, update_allowed, property_true) or set_block_property(your_block, update_allowed, property_true) in the when new-form-instance trigger to make the form behave as you will when opened by a given database user.

EAP-TLS client security policy enforcement question using ISE

Hi Experts ,
I have remote site connected to HQ wireless controller and cisco ISE used as RADIUS server . I am using EAP-TLS authentication method where client will validate the server certificate and server will validate the client certificate.
I am using EAP-TLS and machine authentication.
In case of server certificate installation using internal PKI (Root CA ) server , I am quite clear that we can create certificate in ISE and can be signed by CA which will be used for EAP-TLS as well. however I am trying to under the client certificate installation.
how does client gets certificate from CA. is there any mechanism used by AD to import the certificate automatically to all the clients ?
and more important is , which certificate will be installed on client machines. Do we need to create certificate first from CA and save in repository and later can be installed same to client machines .... Sorry it could be microsoft AD related question however i am pretty sure that since we as a wireless techie , need to know even client side configuration.
This is all about certificate installation . how about entire security policy which is used for EAP-TLS ?
how will client wireless network adapter properties automatically configured with same SSID which is configured with EAP-TLS along with certificate validation ?
I am not sure ... will it get pushed through AD ? how will it happen ?
It would be really helpful if someone could put light on this ..

Hello Vino,
Some answers below :
how does client gets certificate from CA. is there any mechanism used by AD to import the certificate automatically to all the clients ?
You have templates in the certificate authority to user or machine certificate and you can apply these certificates to a group of machines or users using GPO in the Windows Server 2008.
It can be automatically because the machine can get it using GPO from domain and after can authenticates using 802.1X using these certificates received from this policy.
If you want a user certificate and get it manually you can access the CA too using the URL https://X.X.X.X/certsrv and request manually the user certificate using your domain credentials and install manually to authenticate using EAP-TLS with this user certificate.
In the Cisco ISE Side it needs to have a local certificate from the same client CA or from another CA and the Cisco ISE needs to trust in the clients CA Issuer to accept the client certificate and allow this one to access the network.
In the client side the same happens, the client needs to trust in the Issuer CA for the Cisco ISE certificate to validate ISE certificate and get access to the network.
and more important is , which certificate will be installed on client machines. Do we need to create certificate first from CA and save in repository and later can be installed same to client machines .... Sorry it could be microsoft AD related question however i am pretty sure that since we as a wireless techie , need to know even client side configuration.
If you have a Windows Server with GPO and a CA configured you can use some templates to apply automatically a machine certificate or user certificate to a group of machines or user, in the case of machines it can be get from the domain using GPO and in the case of user certificate it can be get manually or using GPO too.
This is all about certificate installation . how about entire security policy which is used for EAP-TLS ?
The EAP-TLS is the most secured method to use to authenticate devices in the network because you have certificates and you have trusted certificate authority that you trust and only devices who has certificates from these CAs will be allowed to access the network.
Another method very secured is EAP-FAST with machine and user certificate that the ISE will validade both the machine and user certificate before allow this one to get access to the network.
how will client wireless network adapter properties automatically configured with same SSID which is configured with EAP-TLS along with certificate validation ?
You can apply it too using GPO in the Windows Server to a domain machine but when you have a machine that is not a domain machine you can use a user certificate to authenticate this one and need to install manually the user certificate in that machine to authenticate the user to wireless network and create SSID specifying the policy that is EAP-TLS.
Remember that client machine needs to have the CA issuer for the Cisco ISE certificate to trust in the Cisco ISE and get access to the network and the opposite too (ISE needs to have the CA Issuer to trust in the client)
I hope it helps.

HT5312 Security answers and questions need to be reset

I forgot the answers to my security questions and when I created my Apple ID I decided to never add a rescue address, so I need my questions and answers to be reset.

1. See my User Tip for some help: Some Solutions for Resetting Forgotten Security Questions: Apple Support Communities.
2. Here are two different but direct methods:
    a. Send Apple an email request at: Apple - Support - iTunes Store - Contact Us.
    b. Call Apple Support in your country: Customer Service: Contacting Apple for support
        and service.
3. For other queries about Apple ID see Frequently asked questions about Apple ID.
4. Rescue email address and how to reset Apple ID security questions

Secured wirless network question

hi
Can I access a secured wirless network by any chance?
thanks

If I understand your question correctly.....NO. Accessing a secured network "by chance" is almost impossible. Now can some one access a secured network..... Maybe. Secured networks are protected by a password and if the password can be obtained then your in, however passwords on networks are highly encrypted. It would be a lot of work so some one would probably have a darn good reason to want in.

Apex Newbie question !!!!! HTTP server ????

I am newbie at APEX. I have a DBA background, but no experience with Oracle applications.
I DO respect your time, and have tried to find this info on teh docs, but, honestly, can not find it. And I looked over everywhere, metalink, otn, gogling. I thought that I would find it on these forums under some form of FAQs, but have not found the answer :-(
I have installed oracle database 11g for windows on my laptop, and when installing APEX 3.2, it asks me to stop the http server and ..... :-)
Now, I have a question regarding the Oracle HTTP server, which is supposed to be isntalled with the 11g, instead of the Companion CD, which no longers exist.
First question. We have a http server that is used by oracle EM database control, correct ? I do not see a service for it on the Services list. Teh apex application install asks for stopping/starting the http server. How do we do that ? AND, where the the http server binaries located ? I did a search for apache, and found it under C:\app\oracle\product\11.1.0\db_1\perl\site\5.8.3\lib\Apache, but no binaries there, or under ORACLE_BASE\bin either.
What do I setup for ORACLE_HTTPSERVER windows environment on a brand new 11g database install ?
Now, I see that we can get HTTP server from BEA install. I was trying to keep APEX from using a web server tier here. To me, the beauty of APEX is to not have to manage BEA, or any other tier. Keep it simple, at least for development, and keep everything on the DB, and simply use the native HTTP server.
So, this is a VERY basic question, but how do I do that ? I will worry about what I can and can not do with the native HTTP server or BEA later. I just want to get this up and running so that I can start playing with it.
Thanks,
Henrique

Here is my latest update before I go to bed :-(
I was able to install the HTTP server, but had some issues later down on the apex install.
C:\app\oracle\product\10g-iAS-http-server\opmn\bin>opmnctl status
Processes in Instance: IAS-1
--------------------------------------------------------------+---------
ias-component | process-type | pid | status
--------------------------------------------------------------+---------
HTTP_Server | HTTP_Server | 5204 | Alive
I am able to see the welcome page for the web server here
http://localhost:7777/
I am able to reset the admin password, ( by the way, I did setup the gateway as well :-) ). I am not sure what happens when you have both the gateway and the web server setup. Now, when try to login to the apex admin account using either
http://localhost:7777/apex/apex_admin or
http://localhost:7777/pls/apex/apex_admin, nothing happens besides a HTTP-404 error.
Now, when I had the port set to 8080, via the commands
SQL> EXEC DBMS_XDB.SETHTTPPORT(8080);
PL/SQL procedure successfully completed.
SQL> SELECT DBMS_XDB.GETHTTPPORT FROM DUAL;
GETHTTPPORT
8080
and try to login again here
http://localhost:7777/pls/apex/apex_admin
I do get a prompt, but when i enter admin, and the password I have setup, it does not allow me to get in :-(
Now, I need some explanation of this DAD file, as I am not sure if I need it to simply login during install. Here is the man page from the install doc :
3.4.11.1 Creating a Workspace Manually
To create an Oracle Application Express workspace manually:
Log in to Oracle Application Express Administration Services. Oracle Application Express Administration Services is a separate application for managing an entire Oracle Application Express instance. You log in using the ADMIN account and password created or reset during the installation process.
In a Web browser, navigate to the Oracle Application Express Administration Services application.
If your setup uses Apache and mod_plsql, go to:
http://hostname:port/pls/apex/apex_admin
Where:
hostname is the name of the system where Oracle HTTP Server is installed.
port is the port number assigned to Oracle HTTP Server. In a default installation, this number is 7777.
pls is the indicator to use the mod_plsql cartridge.
***apex is the database access descriptor (DAD) defined in the mod_plsql configuration file.***
Here it mentions this DAD file, and I am not sure if I need it now, and even, how to reference it. My database name is called apex, but I do not have anything on my dads.conf file. Should I have something there ? I see a sample such as this from the README.DADs file :
<Location /plsqlapp>
SetHandler pls_handler
Order deny,allow
Allow from all
AllowOverride None
PlsqlDatabaseUsername scott
PlsqlDatabasePassword tiger
PlsqlDatabaseConnectString orcl
PlsqlAuthenticationMode Basic
PlsqlDefaultPage scott.home
PlsqlDocumentTablename scott.wwdoc_document
PlsqlDocumentPath docs
PlsqlDocumentProcedure scott.wwdoc_process.process_download
</Location>
It is a bit late tonite. Tomorrow I will get back at it.
Thanks for any help, but I must be doing something really obvious to you guys here, and I can't see it :-(
Cheers,
Henrique

Navigate to external URL from secured APEX server

NOTE I am using the internal Oracle APEX server to host my application, so it may be possible that you will have to be an Oracle employee with the same access, or using a similar setup, in order to respond. Even if you are not, if you feel inclined to "take a swing" at it, keep this in mind.
Hi all,
I am using the internal APEX server at oracle to host an application (Application Express 4.0.2.00.07). I have other, NON-APEX applications hosted on other servers within the Oracle firewall.
On page 0 of the APEX application (which, as you may know, usually displays as the "header" section of every other page in the application) I have created a select list of the other projects and their associated URLs as well as a "Go" button, so users that want to navigate to the other applications can do so from this application. Since page 0 does not seem to allow the creation of standard branch items (please correct me otherwise), I have created a process on that page triggered by the "Go" button. The process currently contains the following code:
begin
apex_application.g_unrecoverable_error := true;
htp.p('<script language="JavaScript">
window.open (:P0_PRODUCT_PAGES); 
</script>');
end;
That code currently replaces the existing page with a blank page and the associated URL is "https://apex.oraclecorp.com/pls/apex/wwv_flow.accept". I am assuming this means that APEX was looking for an application ID and/or page and did not get it so it "stopped" at this page.
I am unaware if there are any settings on the APEX server, DB,or associated web server preventing me from navigating outside of APEX once I am running the hosted application.
I would like to launch another properly-sized (default) browser window rather than replace the existing window pointing to the URL for the selected application.
I have also tried using the owa.util code to try to generate the proper URL but was likewise unsuccessful.
NOTE: I am not looking for different ways to do this by changing server parameters, settings, etc. since I do not have server rights to do this. Additionally, due to time constraints, I would prefer not to be drawn in to a discussion of the comparisons and/or benefits of owa.util or javascript over the other for navigating to an external URL from within APEX, etc. (I'm not trying to be a "punk", but I AM under the gun to resolve this with very limited time). In light of this, please indicate if you have a working option to do this under similar conditions that I can implement quickly. I have done much research within the forums and Googled extensively for information from outside sources but have not yet found something that will provide the proper results.
If you are an oracle employee and wish to contact me directly, please email me at [email protected]
Crossing my fingers and hoping someone has done this before.
Many thanks in advance; your useful contribution will actually contribute to lessening the world's INSOMINA factor considerably (mostly mine). ;)

>
I would like to launch another properly-sized (default) browser window rather than replace the existing window pointing to the URL for the selected application.
I have also tried using the owa.util code to try to generate the proper URL but was likewise unsuccessful.
>
Opening a URL in a new tab or window has to happen in the browser, without submitting the page. The server doesn't know about browser windows. Use:
onchange="window.open(this.value);" in the HTML Form Element Attributes property of <tt>P0_PRODUCT_PAGES</tt> (making the "Go" button unnecessary), or, if the "Go" button is required to match the LAF:
onclick="window.open($v('P0_PRODUCT_PAGES'));"in the button Attributes property, ensuring the button is a template button including the <tt>#BUTTON_ATTRIBUTES#</tt> substitution string, e.g.
<input type="button" value="#LABEL#" #BUTTON_ATTRIBUTES# />Ensure that absolute URLs are used in the <tt>P0_PRODUCT_PAGES</tt> where necessary, specifying the correct scheme for the site, so that you are not trying to go to <tt>{noformat}https://apex.oraclecorp.com/pls/apex/www.google.com{noformat}</tt> for example:
f?FOO:BAR:&APP_SESSION. // other APEX app hosted on apex.oraclecorp.com sharing the same authentication scheme
https://foo.oraclecorp.com // other secured internal site
http://www.google.com // unsecured external site

HT5312 I need to reset my security I'd questions and answer

I'm having a problem remembering and recovering my Security ID questions and answers

You need to contact Apple, either through the link in that article or by phoning them and asking for the Account Security team.
(86200)

Oracle APEX installation question

Can we install APEX on different host from database host?
We would liketo install apex/apache on standalone host.
Can we do it?
Thank you.

This is an interesting question to me also. I'd like to hear some discussion as to how people have done this.
It is my understanding that an APEX application has to exist in the same database as the data which it uses. I didn't think that it was possible to have the Parsing Schema for an application on a different database than the APEX install.
Even if it is possible (with the help of database links and the like) would it be advisable in terms of performance, maintenance, etc?
Doug

Security APEX organization question

Similar Messages

Maybe you are looking for