Security design issue
Hi Folks,
I've a security design issue using J2EE architecture framework in my
project..
Proj Requirement:
i) User Logs-into a health b2b/b2c portal website...
ii) Check the user exist in the database or LDAP directory service.
iii) If exist user then check the role Patient/Insurance Provider/Physician?
iv)If Patient then display his personal health record history.
else Insurance Provider then display about Insurance Policy information,
which he can update/create insurance for entered patient id. If patient has
granted access to Insurance Provider
and if Physician then display about hospital information like
waiting patients,sending appointments,etc..
The above security access control role & policy has to be implemented
very strong. so that other user cannot view/update someone health records..
Development tool:WebLogic Server/Oracle/LDAP.. on Linux
Security Problem:
i)What is the best security solution for the above requirement?
ii)How do I authenticate/validate user using J2EE security framework?
Can anyone explain in details or steps to implement?
Thanks,
-raj-
I'm assuming that your using WLS 6, if so check out (I know we cover this in
the documentation but I'm guessing at the title) the "securing your site"
guide. Some of what you're planning the WLS server can protect through good
ACL usage. I'd recommend creating at least three groups (patient, provider,
physician), clearly the danger lies in having a user who is a member of more
than one group. I'd recommend implementing your own role checking at both
the servlet and EJB levels to fully enforce information access, using
servlet state and stateful session beans should help.
Alex
Raj <[email protected]> wrote in message
news:[email protected]..
Hi Folks,
I've a security design issue using J2EE architecture framework in my
project..
Proj Requirement:
i) User Logs-into a health b2b/b2c portal website...
ii) Check the user exist in the database or LDAP directory service.
iii) If exist user then check the role Patient/InsuranceProvider/Physician?
iv)If Patient then display his personal health record history.
else Insurance Provider then display about Insurance Policy information,
which he can update/create insurance for entered patient id. If patienthas
granted access to Insurance Provider
and if Physician then display about hospital information like
waiting patients,sending appointments,etc..
The above security access control role & policy has to be implemented
very strong. so that other user cannot view/update someone healthrecords..
>
Development tool:WebLogic Server/Oracle/LDAP.. on Linux
Security Problem:
i)What is the best security solution for the above requirement?
ii)How do I authenticate/validate user using J2EE security framework?
Can anyone explain in details or steps to implement?
Thanks,
-raj-
Similar Messages
-
Okay so I'm having a little bit of a design issue. This is how the section is question looks in design mode:
I have temporarily published the site for now. IE and Firefox load absolutely fine with no problems at all, but when opened in chrome is looks like this:
The temporary link for the site is: CCTV Dorset, CCTV Somerset, CCTV Systems Hampshire, CCTV Security Wiltshire - RS1
As said it is working in IE and Firefox FINE but will not load correctly in chrome.
Can anyone help as to why because obviously I want this to work in all browsers.
Thanks.Is your text inside the blue boxes? Might be how chrome makes the text flow if you just placed a formatted them behind... I would format the text box with color, border and padding to get the same effect and make it flow properly...
Do you have a separate text box for each text area?
I am guessing your issue is might be from how it was put together...
I have fixed sites that were doing this in mobile chrome with this css change ... but I am guessing you are using the desktop version..
I know this fixes similar issues in chrome for mobile
Try adding this to your site global css...
html * {max-height:1000000px;}
I know it fixes issues with the mobile version of chrome
css - how to override font boosting in mobile chrome - Stack Overflow -
Design issue with the multiprovider
Design issue with the multiprovider :
I have the following problem when using my multiprovider.
The data flow is like this. I have the info-objects IobjectA, IobjectB, IobjectCin my Cube.(Source for this data is s-systemA)
And from another s-system I am also loading the masterdata for IobjectA
Now I have created the multiprovider based on the cube and IobjectA.
However, surprisingly join in not workign in multiprovider correctly.
Scenario :
Record from the Cube.
IObjectA= 1AAA
IObjectB = 2BBB
IObjectC = 3CCC
Records from IobjectA =1AAA.
I expect the record should be like this :
IObjectA : IObjectB: IObjectC
1AAA :2BBB :3CCC
However, I am getting the record like this:
IObjectA : IObjectB: IObjectC
1AAA :2BBB :3CCC
1AAA : # :#
In the Identification section I have selected both the entries for IobjectA still I am getting this error.
My BW Version is 3.0B and the SP is 31.
Thanks in advance for your suggestion.May be I was not clear enough in my first explanation, Let me try again to explain my scenario:
My Expectation from Multi Provider is :
IObjectA
1AAA
(From InfoObject)
Union
IObjectA IObjectB IObjectC
1AAA 2BBB 3CCC
(From Cube)
The record in the multiprovider should be :
IObjectA IObjectB IObjectC
1AAA 2BBB 3CCC
Because, this is what the Union says .. and the Definition of the multiprovider also says the same thing :
http://help.sap.com/saphelp_bw30b/helpdata/EN/ad/6b023b6069d22ee10000000a11402f/frameset.htm
Do you still think this is how the behaviour of the multiprovider.. if that is the case what would be the purpose of having an infoobject in the multiprovider.
Thank you very much in advance for your responses.
Best Regards.,
Praveen. -
Data mart from two DSOs to one - Loosing values - Design issue
Dear BW experts,
I´m dealing with a design issue for which I would really appreciate any help and suggestions.
I will be as briefly as possible, and explain further based on the doubts , questions I received in order to make it easier go through this problem.
I have two standard DSOs (DSO #1 and #2) feeding a third DSO (DSO #3), also standard.
Each transformation DOES NOT include all fields, but only some of them.
One of the source DSO (let´s call it DSO #1) is uploaded with a datasource that allows reverse type of records (Record Mode = 'R'). Therefore some updates on DSO #1 comes with one entry with record mode 'R' and a 2nd entry with record mode = 'N' (new).
Both feeds are delta mode, and not the same entries are updated through each of them, but the entries that are updated can differ (means an specific entry (unique key values) could be update by one of the feeds, but no updates on the 2nd feed for that entry).
Issue we have: When a 'R' and 'N' entries happen in DSO #1 for any entry, that entry is also reversed and re created in the target DSO #3 (even being that not ALL fields are mapped in the transformation), and thefore we loose ALL the values that are exclusively updated through DSO #2, becoming blank.
I don´t know it we are missing something in our design, or how should we fix this issue we have.
Hope I was more or less clear with the description.
´d really appreciatted your feedback.
Thanks!!
GustavoHi Gustavo
Two things I need to know.
1. Do you have any End Routine in your DSO? If yes, what is the setting under "Update behavior of End Routine Display"....Option available right side of Delete Button ater End Rouine.
2. Did you try with Full Load from DSO1 and DSO2 to DSO3? Do you face the same problem?
Regards
Anindya -
Basically my Ipad2 stopped allowing me to go to sites such as Tumblr a little while ago. It wouldn't display the page properly because of 'security certificate' issues. This in itself would not have been such a problem, but when I went to the App store to try and download the Tumblr App, a pop up appeared asking me to answer some security questions before I could successfully install the App. However, the pop up would not display correctly because of 'security certificate' issues and as a result I can't download any apps from the App Store. Can anyone help with this??
Well, I maged to delete some stuff, download the update...
My Mac mail is still not ok. Still only displays today, yesterday and everything is the 16th of the month previous to this?
All a bit strange to say the least any suggestons on how to resolve this.
I now have a second issue in all my emails at the very top of each it describes in detail the full information of
Delivered-To:
Received:
Received:
Received:
Received:
X-Received:
Return-Path:
Received-Spf:
Authentication-Results:
Content-Type:
Mime-Version:
X-Mailer:
X-Cloudmark-Analysis:
Surely this should not be displayed rather insecure I would think. Any suggestions on how to amend -
Can we set up a forum for Security related issues?
I know many of us think security is a Windows related issue, but from time to time there are security issues that may come up. I had a question so I looked and couldn't find a forum, so I posted in one of the OS X 10.6 sub forums.
Thanks!I am a co-founder of Calendar of Updates http://www.calendarofupdates.com/updates/index.php?act=idx This is a site that is primarily a Windows based security forum (I switched about 4-5 years ago). Over the years, I've tried to grow the Mac side of our forum, but, as you may know, there is little or no interest in security within the Mac community. For many, the feel security is a Windows issue.
It's a free site, so don't think I have a vested interest in growing the membership, I'm not an owner, either.
I just created an *Apple OS X Security Issues* forum http://www.calendarofupdates.com/updates/index.php?showforum=209
Right now it's an empty forum since it was created 10 minutes ago. Please feel free to join the forum and share security related issues and questions.
I am not aware of any other forums that deal with OS X security issues
exclusively, so this forum could be a good place to bookmark and visit from time to time. -
Design issue with sharing LV2 style global between run-time executables
Hi,
Just when I though that I had everything figured out, I ran into this design issue.
The application that I wrote is pretty much a client-server application where the server publishes data and the client subscribes data using data sockets. Once the client gets all the data in the mainClient.vi program, I use LV2 style (using shift registers) to make the data global to all the other sub-vi’s. So the LV2 is in initialize mode in the mainClient.vi program and then in the sub-vi’s the LV2 is in read mode. Also, I had built the run time menu for each sub-vi that when an item is selected from the menu, I would use the get menu selection to get the item tag which will be the file nam
e of the sub-vi and open the selected sub-vi using vi server. This all worked great on my workstation where I have labVIEW 7.0 Express installed. But the final goal is to make exe’s for each of these sub-vi’s and install runtime on the PC’s that do not have labVIEW installed. Of course when I did that only the mainClient.exe program was getting the updated data from the server but the sub-vi’s were not getting the data from the mainClient.exe. I did realize that the reason for this is due to the fact that I had compiled all the sub-vi’s separately and so the LV2 vi is now local to each executable (i.e. all executables have their own memory location). Also, the run-time menu did not work because now I am trying to open an executable using vi server properties.
To summarize, is there a way to share LV2 style global's between executables without compiling all of the sub-vi’s at one time? I tried using data-sockets (local-host) instead of LV2 st
yle gloabls to communicate between the sub-vi’s but I ran into performance issues due to the large volume of data.
I would really appreciate it if anyone can suggest a solution/alternative to this problem.
Thanks
Nish> 1) How would I create a wrap-around for the LV2.vi which is
> initialized in my mainClient.vi and then how would I use vi server in
> my sub-vi to refer to that LV2.vi?
> You mentioned that each sub-vi when opened will first connect to the
> LV2.vi via via-server and will keep the connection in the shift
> register of that sub-vi. Does this mean that the sub-vi is accessing
> (pass-by-reference) the shared memory of the mainClient.vi? If this
> is what you meant I think that this might work for my application.
>
If the LV2 global is loaded statically into your mainClient.vi, then any
other application can connect to the exe and get a reference to the VI
using the VI name. This gives you a VI reference you can use to call
the VI. Ye
s, the values will be copied between applications. That is
why you need to add access operations to the global that returns just
the info needed. If you need the average, do that in the global. If
you need the array size, do that in the global. Returning the entire
array shouldn't be a common operation on the LV2 style global anyway.
> 2) Just to elaborate on my application, the data is
> transferred via DataSockets from the mainServer.vi on another PC to
> the client’s PC where the mainClient.vi program subscribes the
> data (i.e. 5 arrays of double type and each arrays has about 50,000
> elements). The sub-vi’s will have to access these arrays
> located on the mainClient.vi every scan. Is there any limitation on
> referencing the mainClient.vi data via vi-server from each sub-vi?
Your app does need to watch both the amount of data being passed across
the network, and the amount being shared between the apps. You might
want to consider puttin
g the VIs back into the main app. What is the
reason you are breaking them apart for?
Greg McKaskle -
A web service design issue with patterns
Hello,
I�d like to ask for your help in the following design issue:
I need to create an email sending web service (with Axis). Only just one method which returns with an integer return code. This handles the following:
- based on the given parameters gets the email addresses from an
LDAP server (with netscape ldap for java)
- makes a cache from them (only after a timeout period will be the cache
refreshed) (don�t know what tool to use for this)
- selects html templates which to be sent based on the given parameters
- sends emails with the appropriate templates (with Velocity)
- the whole process is logged (with log4j)
I have to write the code as generic as possible. I know that some design pattern should be used for this. (some from GoF , and I know there exists design patterns specially created for web services as well).
Could you enumerate me which patterns (and for what part of the program) would be the best choice to solve this problem? I have read through some books about patterns, but don�t have the knowledge to pick up the right one for a concrete problem like this..
Thank you in advance,
nagybalyHello,
I�d like to ask for your help in the following design
issue:
I need to create an email sending web service (with
Axis). Only just one method which returns with an
integer return code. This handles the following:Lots of responsibilities here. You would do well to break this up into several classes that you can test separately.
I would also advise that you not embed all this in a servlet. Make a service that collaborates with several objects to accomplish the task and let the serlvet just call it.
.> - based on the given parameters gets the email
addresses from an
LDAP server (with netscape ldap for java)I'd recommend Spring's LDAP module. Pretty terrific stuff.
cache from them (only after a timeout period will be
the cache
refreshed) (don�t know what tool to use for
this)Maybe EhCache or OsCache or something like that.
- selects html templates which to be sent based on
the given parametersWhere does this come from? Certainly not the LDAP. A relational database? Write a DAO for the document template.
- sends emails with the appropriate templates (with
Velocity)Have an e-mail sender service using Java Mail.
- the whole process is logged (with log4j)Easily done.
I have to write the code as generic as possible. I
know that some design pattern should be used for
this. No pattern. There might be patterns, if you say that the DAOs to access the LDAP and RDB are patterns.
Stop thinking patterns and start thinking objects.
(some from GoF , and I know there exists design
patterns specially created for web services as
well).Nope.
Could you enumerate me which patterns (and for what
part of the program) would be the best choice to
solve this problem? I have read through some books
about patterns, but don�t have the knowledge to pick
up the right one for a concrete problem like this..
Thank you in advance,
nagybalyYou haven't read them because they aren't there. Your problem is pretty specific, even if it's common.
% -
Essbase Security Filter issue.
Hi,
Its regarding the security filter issue.
The major problem is whosoever user is provisioned under that security filter, if the user is trying to connect to Application using Excel Addin / Smartview, it crashes the essbase server [Network Error [10061], timed out error)]
When we figured out because of this filter essbase server is crashing, we tried to edit the filter. sometimes if we click on edit, it crashes the server or sometimes we can see some junk characters in the filter.
We have applied the security on Entities dimension and problematic filter is ASP.
Now the hirerachy is like this.
Entities dimesnsion and then ASP member and under ASP we have our several members.
Filter is like this:
Write : @Idescendants("ASP")
It was working fine for almost 15 days.
Now if i edit the filter, i can see like this:
Write : @Idescendants("ASP")
Metaread:@Idescendants("*&^%?)
Junk characters are coming in and no idea from where they are coming.
I can't delete the filter also, again it crashes the essbase server.
As a workaround i have created a temp filter and dome the assignation for this group, according to that.
Everything is working fine.
I just wanted to know, has anybody faced such kind of problem earlier.
What cud be the root cause for this.
How could I delete the filter.
I have also get messages like security file is corrupted (we have restored it from old backup) but really worried about security file as we are moving the whole thing to production server this weekend.
Please advise me on this, Please help me. Any help would be highly appreciated.
I am really in trouble.
Thanks,
Pankaj Mehta.Try to edit the filter from MaxL command line using
alter filter sample.basic.filt7 add write on '@IDescendants("ASP")';
here sample=application
basic=database
filt7=filtername
have good luck -
SOA Design issues and other politics
Hi all,
I have a requirement for live data feed from external system. I am using SOA11g and JDeveloper 11g. There are two designs, one proposed and other I have in mind to achieve this.
1) The external system sends XML data in a push model to the exposed SOA Web Service (uses one-way messaging mode) at my end. I then store the message in the database
a) In this design how do we keep track of all messages that are sent are received. Is there a better solution.
2) The third party is proposing a Web Service at their end. The application being real-time (i.e any changes at their DB end i.e some DB tables, should be propogated across to our web services using XML messages). I will have to keep sending XML requests on a regular basis (say every 5 seconds). Can I achieve such type of Web Service client using SOA 11g?
a) Here I have a design issue, that the data feed is live, why do the WS client have to keep sending requests at regular intervals. Why can't the third party send data whenever there is an update/insert at their database end. Third party is coming up with advantages like loose coupling and making the Web Service more generic. I doubt all the claims give that the applications are B2B and we are the other ones who will be using their web services for the time being. Their may be other two organizations later on.
b) If the first request is not yet returned, will the second request after 5 seconds be blocked.
This designs and solutions are becoming quite political across organizations, and got to do with who will take the blame for data issues. I just want a proper SOA design for live data feed. Please suggest the advantages and disadvantages of both if anybody has been through this path.
Thanks
Edited by: user5108636 on 1/09/2010 18:19See if wireless isolation is enabled.
When logged into your WRT1900AC using local access replace the end of the browser URL with:
/dynamic/advanced-wireless.html
Please remember to Kudo those that help you.
Linksys
Communities Technical Support -
Design Issue: Localization using Lookup OR Dependency Injection
Hello Forums!
I'm having a design issue regarding localization in my application. I'm using Spring Framework (www.springframework.org) as an
application container, which provides DI (dependency injection) - but the issue is not Spring- but rather design related. All localization
logic is encapsulated in a separate class ("I18nManager"), which basically is just a wrapper around multiple Java ResourceBundles.
Right now localization is performed in the "traditional" look-up style, e.g.
ApplicationContext.getMessage("some.message.key");
where ApplicationContext is a wrapper around the Spring application context and getMessage(...) is a static method on that
context. The advantage of that solution is a clean & simple interface design, localization merely becomes a feature of classes, but
is not part of their public API. The only problem with that approach is the very tight coupling of Classes to the ApplicationContext, which
really is a problem when you want to use code outside of an application context. The importance of this problem increases if one considers
that I18N is a concern that can be found in every application layer, from GUI to business to data tier, all those components suddenly depdend
on an application context being present.
My proposed solution to this problem is a "Localizable" interface, which may provide mutators for an "I18NManager" instance that can be
passed in. But is this really a well-designed solution, as almost any object in an application may be required to implement this interface?
I'm too concerned about performance: the look-up solution does not need to pass references to localizable objects, whereas my proposed solution
will require 1 I18NManager reference per localizable object, which might cause troubles if you let's say load 10.000 POJOs from some database that
are all localizable.
So (finally) my question: how do you handle such design issues? Are there any other solutions out there that I'm not aware of yet? Comments/Help welcome!michael_schmid wrote:
Hello Forums!
I'm having a design issue regarding localization in my application. I'm using Spring Framework (www.springframework.org) as an
application container, which provides DI (dependency injection) - but the issue is not Spring- but rather design related. All localization
logic is encapsulated in a separate class ("I18nManager"), which basically is just a wrapper around multiple Java ResourceBundles.Why do you think you need a wrapper around resource bundles? Spring does very well with I18N, as well as Java does. What improvement do you think you bring?
Right now localization is performed in the "traditional" look-up style, e.g.
ApplicationContext.getMessage("some.message.key");
where ApplicationContext is a wrapper around the Spring application context and getMessage(...) is a static method on that
context. Now you're wrapping the Spring app context? Oh, brother. Sounds mad to me.
The advantage of that solution is a clean & simple interface design, localization merely becomes a feature of classes, but
is not part of their public API. The only problem with that approach is the very tight coupling of Classes to the ApplicationContext, which
really is a problem when you want to use code outside of an application context. The importance of this problem increases if one considers
that I18N is a concern that can be found in every application layer, from GUI to business to data tier, all those components suddenly depdend
on an application context being present.One man's "tight coupling" is another person's dependency.
I agree that overly tight coupling can be a problem, but sometimes a dependency just can't be helped. They aren't all bad. The only class with no dependencies calls no one and is called by no one. We'd call that a big, fat main class. What good is that?
Personally, I would discourage you from wrapping Spring too much. I doubt that you're improving your life. Better to use Spring straight, the way it was intended. I find that they're much better designers than I am.
My proposed solution to this problem is a "Localizable" interface, which may provide mutators for an "I18NManager" instance that can be
passed in. But is this really a well-designed solution, as almost any object in an application may be required to implement this interface?I would say no.
I'm too concerned about performance: the look-up solution does not need to pass references to localizable objects, whereas my proposed solution
will require 1 I18NManager reference per localizable object, which might cause troubles if you let's say load 10.000 POJOs from some database that
are all localizable.
So (finally) my question: how do you handle such design issues? Are there any other solutions out there that I'm not aware of yet? Comments/Help welcome!I would use the features that are built into Spring and Java until I ran into a problem. It seems to me that you're wrapping your way into a problem and making things more complex than they need to be.
% -
Design Issues, suggestions welcome
I have stumbled across some design issues, with a carhire system i am making.
kept in
[CAR]------------------->[GARAGE]
|
|
| Retives car from garage
|
|
|
[TIMESLOT]
As it stands the GARAGE class automatically has CAR objects added as attributes.
import java.util.*;
public class Garage {
//class attributes
private LinkedList carhold;
Car ford_ka = new Car("A",135);
Car ford_focus = new Car("B",149);
Car ford_Mondeo = new Car("C",179);
Car Vauxhall_Vectra = new Car("D",239);
Car Mercedes_E240 = new Car("H",290);
Car Renault_Espace = new Car("V",399);
public Garage() {
carhold = new LinkedList();
carhold.add(ford_ka);
carhold.add(ford_focus);
carhold.add(ford_Mondeo);
carhold.add(Vauxhall_Vectra);
carhold.add(Mercedes_E240);
carhold.add(Renault_Espace); The TIMESLOT class has an GARAGE object as an attribute, thus enabling it access mehtods.
import java.util.*;
public class TimeSlot {
Garage g = new Garage();
public void getCarCost(String input) {
Car theCar = g.search(input);problem is each time a new TIMESLOT is create so too is a
new garage created with all the cars.
I really need the garage to be a seperate entity, but still allowing
the TIMESLOT class to use its methods.
would in heritence be the appropriate solution, or maybe something else.
I would like to hear other suggestions.I believe a Singleton pattern works perfectly here. A singleton ensures that only one instance of an object is created. You would use it as follows:
public class Garage {
private LinkedList carhold;
// Car declarations here
private Garage() {
carhold = new LinkedList();
// add cars here
public static Garage getInstance() {
static Garage instance = null;
if (instance == null)
instance = new Garage();
return instance;
public class TimeSlot {
public void getCarCost(String input) {
Garage g = Garage.getInstance();
// do some other stuff
}Notice the PRIVATE constructor on the Garage class. This keeps classes other than Garage from instantiating it. In fact, the only way to get an instance of Garage is to call Garage.getInstance(), which will always return the same instance.
You might also consider the Builder pattern, which will keep you from having to instantiate all those Car objects inside of your Garage. You would do something like this:
public class Garage {
LinkedList carhold;
public Garage() {
carhold = new LinkedList();
public void addCar(Car c) {
carhold.add(c);
public class GarageBuilder {
public static final int BOBS_GARAGE = 0;
public static final int BILLS_GARAGE = 1;
public static Garage buildGarage(int garage) {
Garage g = new Garage();
switch (garage) {
case BOBS_GARAGE:
Car c = new Car("bobsCar", 200);
g.add(c);
break;
case BILLS_GARAGE:
Car c = new Car("billsCar", 400);
g.add(c);
break;
return g;
} -
Hi everybody,
We know that weblogic stores all its configuration
parameters in an xml file,including the userid and password for the database
in clear text form .
I want to know whether it is a security flaw?
Is there a way to encrypt the file contents,so that the userid and password
will not be in clear text form.
Any suggestions to increase the security on the config file by appliying os
restriction or by any third party tool will be helpful.
Thanks in advance
prashantI am a co-founder of Calendar of Updates http://www.calendarofupdates.com/updates/index.php?act=idx This is a site that is primarily a Windows based security forum (I switched about 4-5 years ago). Over the years, I've tried to grow the Mac side of our forum, but, as you may know, there is little or no interest in security within the Mac community. For many, the feel security is a Windows issue.
It's a free site, so don't think I have a vested interest in growing the membership, I'm not an owner, either.
I just created an *Apple OS X Security Issues* forum http://www.calendarofupdates.com/updates/index.php?showforum=209
Right now it's an empty forum since it was created 10 minutes ago. Please feel free to join the forum and share security related issues and questions.
I am not aware of any other forums that deal with OS X security issues
exclusively, so this forum could be a good place to bookmark and visit from time to time. -
I am running OS 10.5.8 on an iMac. There is no security update issued for this operating system - it only covers 10.6. Is my comuter vulnerable? Do I need to do anything?
I'm still not clear why Apple only issued security updates for 10.6 and later. I assume they think we should all update our operating systems or maybe they are just focusing on the majority of users?
Apple has had a long standing policy of only supporting the current and previous operating system releases. Whether they decide to make an exception for even older releases is anyone's guess.
You can send them feedback to express your opinion.
Or does the new Trojan not affect older OS? I'd like to know , if anyone has information.
As far as is known, it does affect older unsupported releases. Disabling Java in your web browser is the current preventive approach (and that is a community derived approach) -
Hi All,
I am developing an ADF web application. The security design is such that user authentication is mapped to database users. The design I see several pros and cons
1) Different database users means I cannot take advantage of connection pooling.
2) The architect argues SQL querying can be controlled at database level for each user.
I have never been involved in such a web application. Can anybody please guide me if this is the way to go for ADF web application, any other pros and cons. The database is Oracle 11g. I still believe that application security should not be tied to the database security.
Worst case if I have to go with this design, How to implement ADF security using database users.
ThanksI blogged a use case for using Proxy Authentication with JPA here http://blogs.oracle.com/olaf/2010/04/using_oracle_proxy_authenticat.html. (Being a sample it includes a setter for user name, but a case with a JAAS Subject and Principal is easily adaptable).
I'll dig out an ADF BC example and blog about it, too.
--olaf
Maybe you are looking for
-
How do you get your serial number when you don't have your ipod
I was running and then I dropped it and I lost it i went to your website and I'm trying to find it but there saying i need the serial number how can I get the serial number please send me a message back
-
How can i have the date and time show up on my canon vixia hf m50
Cannot get the date and time to show up onscreen in ANY videos on my new vixia HF M50. Can somebody help me on this?
-
Correlation and Principal Components Analysis software for Mac
Greetings- I am looking for Mac software that will compute correlations between multiple variables and perform principal components analysis on the resulting intercorrelation matrix. These would be small data sets, 10 or 15 variables, 100 subjects. I
-
I am looking for comments about both of these storage vendor for virtualization with VMware. Both of these companies are key players in the storage market. We plan to virtualize everything we can oracle, exchange, file services and various sing
-
Unable to create a disk image for mass deployment or to restore on other
I am attempting to create a master 10.5 Leopard image that can be deployed to other Macs, but the restore process fails with the following error: *Restore Failure. Could not find any scan information. The source image needs to be imagedscanned/scanne