Security Models 3-Tier Vs 4-Tier

Hello Security Colleagues,
We are evaluating the two models for our brand new ECC implementation.
We have license for GRC5.3,IDM 7.1.
Would you please share your thoughts/experiences ? much appreciated...
I am also searching for SAP recommendations.
Regards,

Hi Raghu,
It is the concept that is important. Typically this is used for companies with lots of org levels.
Bear in mind the following:
- You will not be able to run single role level SOD analysis using RAR (actually you will but the results will be meaningless).
- You will break the standard auth concept and every transaction addition will take more work for every addition.
- When you remove a transaction you need to evaluate all the auth objects associated with that transaction to judge if they need removing too.
- You will likely introduce additional risks if you have 1 enabler/org/value role which applies to more than 1 transaction role
- Your implementation will be harder to review/audit. This will increase your audit costs as they will likely need to perform more substantive tests as a result of not being able to check SOD so easy (you could say it is their problem, but it will also become your problem)
- As soon as the originators of the design leave then history shows that the implementation will end up a mess as staff are onboarded who do not understand this method.
- Increased support costs if outsourced.
Out of the many, many implementations I have audited, this concept has left most of them in a complete mess. I don't know if you work for an end user or a consultancy, if it is the latter then it would not be without precedent that your company is forced to pay for a rebuild one or two years after implementation. Very few have done it well.
This is just my 2p based on seeing & fixing it.
Cheers
Alex

Similar Messages

Advice on Security Model Architecture..

Hi all,
Just looking for the advice of the experts :)
I am working on the security model architecture for multi-tiered java application. The application architecture breaks down roughly as follows:
Presentation Layer (JSP/Java)
Business Layer (Java)
Persistence Layer (JDBC/Oracle DB)
Now, in the DB we will preserve information about various users, as well as the user's application permissions. My question pertains to authentication/authorization. Where is it most appropriate or efficient to verify a user's access to a functionality? Assume that the user and permission information is retrieved upon login and is made available to all levels.
The options, as I see them, include the following:
Presention layer - UI exposes only functionality applicable to the user.
Business layer - Encode the logic in this facade for the backend.
Persistence layer - Encode the logic in the data access objects.
Any thoughts?

Well, the layered approach is one way in which java applications are constructed.. the user interface is the top layer, which is composed of jsp files and other java files, and the objects that talk to the database are the bottom layer. Maybe an example would help..
You're looking at a page on the Java Discussion Forums. It's a jsp page. You click on the 'Watches' link (upper right). The link points to a servlet, which calls a method in an object that is in what I call the "business" or middle layer/tier. An object in this layer has methods that correspond to any request that needs to be made of the db.
This method in turn calls method/methods in the backend, or data layer, which queries the database and returns the watches for this particular user...
So, if you have a request/response transaction (click on a link or button, processing, and new page is loaded), it would make a round trip through the layers:
Presentation -> Business -> Data -> DB -> Data -> Business -> Presentation

Error while confgiuring Siebel Bi Publisher Security Model..

Hi,
Steps Done
1)     Imported the BIPSiebelSecurityWS.XML
2)     Replaced Existing address with the specific address of the Siebel Server
3)     Enabled Local Super user checkbox, entered a Super user name and password
4)     Configured the Siebel Security Model by pointing the Siebel Web Service end point with Siebel Username/Pwd
5)     Restarted the Bipublisher
6)     When I try to login to Bi Publisher with Siebel Credentials I am getting the error
The server cannot be used due to configuration error, please contact admin..
Please let us know the necessary steps ..

Login using the credentilas used for super user. Siebel user do not work here, it will only fetch the responsibilities here as a roles for that super user.
Thanks,
Ravi kanth

BIP: Upload error (Invalid BI Publisher Security model SBL-RPT-50532)

Hi, We have Siebel 8.1.1.5 running and having trouble integrating with BI Publisher 10.1.3.4.2 . I have setup and configure BIP as per the instructions.
When we try to upload reports from Reports - Standard Templates View, getting the following error messages:
Invalid BI Publisher Security Model Setting (SBL-RPT-50532) && Error (null) invoking method (null) for business service (null).
I have setup the security model to siebel in BIP and able to login tot he console using SADMIN/SADMIN. All the required components are also online and updated the params as per the instructions.
Any help would be greatly appreciated. Thanks in advance!

Hi Hakan,
Please check whether your EAI Object manager is using different srf to one that application set to. In that case try to
set the EAI to same srf Or compile report stuff to that particular srf. And befiore that have you declared the Siebel securiy model setting in BIP.
Please reach me at [email protected] for any issues.
Thanks,
Ravi

Upgrade from a two tier EBS 11i 11.5.10.2 on Windows 2003 Apps and Windows 2008 R2 DB tier to two Tier R12.2.3 both on Windows 2008 R2

Hi,
Any ideas about the best practices for the migration/upgrade reflected with the below question?
I have a source EBS11i 11.5.10.2 running as a two tier configuration ( apps tier on server ora10 on Windows 2003, DB tier 11.2.0.2 on server ora1 on Windows 8 R2. Can I use the Note 1377213.1 for a migration to a two tier configuration ( apps tier on server T10 running Windows 2008 R2 and EBS 12.2.3 and DB tier running 11.2.0.4 on Windows 2008 R2 )? What alternative approach could you suggest? As far as I know EBS11i is not certified on Windows 2008 R2 and R12.2.0 is not certified on Windows 2003.

Yes you can by following "Application Tier Upgrades and Migrations" section -- Install 12.2 apps tier on 64-bit Windows and proceed with the upgrade.
Oracle E-Business Suite Installation and Upgrade Notes Release 12 (12.2) for Microsoft Windows x64 (64-bit) (Doc ID 1330706.1)
Thanks,
Hussein

Java Security Model: Java Protection Domains

1.     Policy Configuration
Until now, security policy was hard-coded in the security manager used by Java applications. This gives us the effective but rigid Java sandbox for applets.A major enhancement to the Java sandbox is the separation of policy from mechanism. Policy is now expressed in a separate, persistent format. The policy is represented in simple ascii, and can be modified and displayed by any tools that support the policy syntax specification. This allows:
o     Configurable policies -- no longer is the security policy hard-coded into the application.
o     Flexible policies -- Since the policy is configurable, system administrators can enforce global polices for the enterprise. If permitted by the enterprise's global policy, end-users can refine the policy for their desktop.
o     Fine-grain policies -- The policy configuration file uses a simple, extensible syntax that allows you to specify access on specific files or to particular network hosts. Access to resources can be granted only to code signed by trusted principals.
o     Application policies -- The sandbox is generalized so that applications of any stripe can use the policy mechanism. Previously, to establish a security policy for an application, an developer needed to implement a subclass of the SecurityManager, and hard-code the application's policies in that subclass. Now, the application can make use of the policy file and the extensible Permission object to build an application whose policy is separate from the implementation of the application.
o     Extensible policies -- Application developers can choose to define new resource types that require fine-grain access control. They need only define a new Permission object and a method that the system invokes to make access decisions. The policy configuration file and policy tools automatically support application-defined permissions. For example, an application could define a CheckBook object and a CheckBookPermission.
2.     X.509v3 Certificate APIs
Public-key cryptography is an effective tool for associating an identity with a piece of code. JavaSoft is introducing API support in the core APIs for X.509v3 certificates. This allows system administrators to use certificates from enterprise Certificate Authorities (CAs), as well as trusted third-party CAs, to cryptographically establish identities.
3.     Protection Domains
The central architectural feature of the Java security model is its concept of a Protection Domain. The Java sandbox is an example of a Protection Domain that places tight controls around the execution of downloaded code. This concept is generalized so that each Java class executes within one and only one Protection Domain, with associated permissions.
When code is loaded, its Protection Domain comes into existence. The Protection Domain has two attributes - a signer and a location. The signer could be null if the code is not signed by anyone. The location is the URL where the Java classes reside. The system consults the global policy on behalf of the new Protection Domain. It derives the set of permissions for the Protection Domain based on its signer/location attributes. Those permissions are put into the Protection Domain's bag of permissions.
4.     Access Decisions
Access decisions are straightforward. When code tries to access a protected resource, it creates an access request. If the request matches a permission contained in the bag of permissions, then access is granted. Otherwise, access is denied. This simple way of making access decisions extends easily to application-defined resources and access control. For example, the banking application allows access to the CheckBook only when the executing code holds the appropriate CheckBookPermission.
Sandbox model for Security
Java is supported in applications and applets, small programs that spurred Java's early growth and are executable in a browser environment. The applet code is downloaded at runtime and executes in the context of a JVM hosted by the browser. An applet's code can be downloaded from anywhere in the network, so Java's early designers thought such code should not be given unlimited access to the target system. That led to the sandbox model -- the security model introduced with JDK 1.0.
The sandbox model deems all code downloaded from the network untrustworthy, and confines the code to a limited area of the browser -- the sandbox. For instance, code downloaded from the network could not update the local file system. It's probably more accurate to call this a "fenced-in" model, since a sandbox does not connote strict confinement.
While this may seem a very secure approach, there are inherent problems. First, it dictates a rigid policy that is closely tied to the implementation. Second, it's seldom a good idea to put all one's eggs in one basket -- that is, it's unwise to rely entirely on one approach to provide overall system security.
Security needs to be layered for depth of defense and flexible enough to accommodate different policies -- the sandbox model is neither.
java.security.ProtectionDomain
This class represents a unit of protection within the Java application environment, and is typically associated with a concept of "principal," where a principal is an entity in the computer system to which permissions (and as a result, accountability) are granted.
A domain conceptually encloses a set of classes whose instances are granted the same set of permissions. Currently, a domain is uniquely identified by a CodeSource, which encapsulates two characteristics of the code running inside the domain: the codebase (java.net.URL), and a set of certificates (of type java.security.cert.Certificate) for public keys that correspond to the private keys that signed all code in this domain. Thus, classes signed by the same keys and from the same URL are placed in the same domain.
A domain also encompasses the permissions granted to code in the domain, as determined by the security policy currently in effect.
Classes that have the same permissions but are from different code sources belong to different domains.
A class belongs to one and only one ProtectionDomain.
Note that currently in Java 2 SDK, v 1.2, protection domains are created "on demand" as a result of class loading. The getProtectionDomain method in java.lang.Class can be used to look up the protection domain that is associated with a given class. Note that one must have the appropriate permission (the RuntimePermission "getProtectionDomain") to successfully invoke this method.
Today all code shipped as part of the Java 2 SDK is considered system code and run inside the unique system domain. Each applet or application runs in its appropriate domain, determined by its code source.
It is possible to ensure that objects in any non-system domain cannot automatically discover objects in another non-system domain. This partition can be achieved by careful class resolution and loading, for example, using different classloaders for different domains. However, SecureClassLoader (or its subclasses) can, at its choice, load classes from different domains, thus allowing these classes to co-exist within the same name space (as partitioned by a classloader).
jarsigner and keytool
example : cd D:\EicherProject\EicherWEB\Web Content jarsigner -keystore eicher.store source.jar eichercert
The javakey tool from JDK 1.1 has been replaced by two tools in Java 2.
One tool manages keys and certificates in a database. The other is responsible for signing and verifying JAR files. Both tools require access to a keystore that contains certificate and key information to operate. The keystore replaces the identitydb.obj from JDK 1.1. New to Java 2 is the notion of policy, which controls what resources applets are granted access to outside of the sandbox (see Chapter 3).
The javakey replacement tools are both command-line driven, and neither requires the use of the awkward directive files required in JDK 1.1.x. Management of keystores, and the generation of keys and certificates, is carried out by keytool. jarsigner uses certificates to sign JAR files and to verify the signatures found on signed JAR files.
Here we list simple steps of doing the signing. We assume that JDK 1.3 is installed and the tools jarsigner and keytool that are part of JDK are in the execution PATH. Following are Unix commands, however with proper changes, these could be used in Windows as well.
1. First generate a key pair for our Certificate:
keytool -genkey -keyalg rsa -alias AppletCert
2. Generate a certification-signing request.
keytool -certreq -alias AppletCert > CertReq.pem
3. Send this CertReq.pem to VeriSign/Thawte webform. Let the signed reply from them be SignedCert.pem.
4. Import the chain into keystore:
keytool -import -alias AppletCert -file SignedCert.pem
5. Sign the CyberVote archive �TeleVote.jar�:
jarsigner TeleVote.jar AppletCert
This signed applet TeleVote.jar can now be made available to the web server. For testing purpose we can have our own test root CA. Following are the steps to generate a root CA by using openssl.
1. Generate a key pair for root CA:
openssl genrsa -des3 -out CyberVoteCA.key 1024
2. Generate an x509 certificate using the above keypair:
openssl req -new -x509 -days key CyberVoteCA.key -out CyberVoteCA.crt
3. Import the Certificate to keystore.
keytool -import -alias CyberVoteRoot -file CyberVoteCA.crt
Now, in the step 3 of jar signing above, instead of sending the request certificate to VeriSign/Thawte webform for signing, we 365 - can sign using our newly created root CA using this command:
openssl x509 -req -CA CyberVoteCA.crt -CAkey CyberVoteCA.key -days 365 -in CertReq.pem -out SignedCert.pem �Cacreateserial
However, our test root CA has to be imported to the keystore of voter�s web browser in some way. [This was not investigated. We used some manual importing procedure which is not recommended way]
The Important Classes
The MessageDigest class, which is used in current CyberVote mockup system (see section 2), is an engine class designed to provide the functionality of cryptographically secure message digests such as SHA-1 or MD5. A cryptographically secure message digest takes arbitrary-sized input (a byte array), and generates a fixed-size output, called a digest or hash. A digest has the following properties:
� It should be computationally infeasible to find two messages that hashed to the same value.
� The digest does not reveal anything about the input that was used to generate it.
Message digests are used to produce unique and reliable identifiers of data. They are sometimes called the "digital fingerprints" of data.
The (Digital)Signature class is an engine class designed to provide the functionality of a cryptographic digital signature algorithm such as DSA or RSA with MD5. A cryptographically secure signature algorithm takes arbitrary-sized input and a private key and generates a relatively short (often fixed-size) string of bytes, called the signature, with the following properties:
� Given the public key corresponding to the private key used to generate the signature, it should be possible to verify the authenticity and integrity of the input.
� The signature and the public key do not reveal anything about the private key.
A Signature object can be used to sign data. It can also be used to verify whether or not an alleged signature is in fact the authentic signature of the data associated with it.
----Cheers
---- Dinesh Vishwakarma

Hi,
these concepts are used and implemented in jGuard(www.jguard.net) which enable easy JAAS integration into j2ee webapps across application servers.
cheers,
Charles(jGuard team).

Need Best Practice - Apex, multiple schemas, security model

We have an oracle database which contains
a) named database users with no objects
b) several schemas with data tables:
sales
marketing
accounting
We need to build GUI for tables in these schemas,
every database users should belong to a group, each user group should have access to several (not all) GUI pages.
1) Is it possible and is it recommended (if not - why?) to create ONE workspace and ONE application inside it to have access to ALL tables in ALL schemas listed with user groups level security?
How to do it properly?
Some link to documentation?
2) Which security model (apex users, database users,..) to choose and why? please recommend some links to comparison...

Hi Marcus,
Our developers like to see all the tables for a single custom application in its own diagram no matter where they come from and the DBA's don't want to wade through several thousand tables to find the handful we need nor have to duplicate table definitions in multiple models. In >Designer we have been doing that with Application Folders.There are no application folders in data Modeler. You can use subviews to define your subject areas. Subview is crated for each application (folder) during import form Designer repository.
Philip

CRM 7.0 security model & accessebility of data at table level

Hi CRM Experts,
Firstly i am new to this topic 'CRM 7.0 security model' and i want following information from you, my simple requirement of my on going project.
1. what are different types of roles in CRM 7.0 system and how to define those roles & which table all the role information is stored in CRM 7.0 ABAP & Java stack installled system.
2. How are the ABAP & JAVA roles are different from each other in CRM 7.0 system.
3. How to define portal roles in CRM 7.0 & which table or storage location these portal roles data are stored & is there any way we can extract them from CRM system, if any webservice or any mean this can be achieved?
Basically i am interested in users/roles/authorization data in CRM 7.0 for both ABAP & JAVA stack system. please help me achieving this requirement.
Thanks,
Digamber.

Digamber,
For an overview of the changes in CRM 7.0, visit the following link:
http://www.sap.com/germany/solutions/business-suite/crm/SAP_CRM7_Highlights.pdf
In respect to Security model, CRM 7.0 is a bit different, where a lot of functionality is executed via BSPs that are run on a browser. However, the authorizations should be still need to assign in the the backend.
For CRM specific security guides, I recommend you visit the SAP link - http://service.sap.com/security
In the left pane hierarchy, go to 'Security Guides'. Scroll down to find the CRM section and download the required guides.
Also, further there are new concepts like WEBCLIENT UI (an extra authorization layer, which is UI COMPONENT LEVEL and logical links. (Controlled by object UIU_COMP)). Standard authorization setup in the new WEBUI client is now controlled by both backend authorizations and the UIU_COMP. That means even if the user has SAP_ALL access, he will not able to perform any actions.
Hope this provides some light!!
Rgds,
Raghu

Assigning role to role doesn't work when applying Database security model

I applied Oracle Database security model for BI Publisher.
then I create some roles and users and assigned roles to users in Oracle Database.
i also assigned appropriate folders to each role in BI Publisher.
the users with direct roles worked successfully but i got problem when i assigned roles to a super role, and assigned this role to a super user.
the super user could only access guest folder.
Please help me.
thanks.
Daniel
Edited by: user13344498 on Jul 5, 2010 11:13 PM

Add a Role to a Role:
1. From the Security Center, select Roles and Permissions; this will invoke the
Security Center page. Here you can see the list of existing roles and permissions.
2. Select the Add Roles icon for the Role.
3. Select the desired role from the Available Roles list and use the Move shuttle
button to move it to the Included Roles.
this is from "Oracle® Business Intelligence Publisher User's Guide Release 10.1.3.2 Part No. B40017-01" book, but the security model is BI Publisher Security.

2-tier or 3 tier?

i hava webapp like this jsp--> dao (singleton) --> hibernate -->database (is this consider 2 tier or 3 tier?)

DAO = Data Access Object. Given the first word in that acronym, I think we can comfortably put this at the Data layer.
Right now I'd say you have 2 tiers there.
The 3rd tier is normally another layer sitting between your Server and your database. EJBs for instance.
Client
Tier 1 = Web server.
Tier 2 = application server.
Tier 3 = database server
Client talks to web server over http. Web server talks to application server (RMI, EJB, whatever). Application server talks to database.
If your architecture comprises of just Tomcat and a Database, you've probably got 2-tiers

Differcence between 2-tier and 3-tier

hiii,
diff between 2-tier and 3-tier sap architecture??

The easiest way to explain this is, as you suggest, by an example. So I'll give you an example.
Let's suppose I'm going to write a piece of software that students at a school can use to find out what their current grade is in all their classes. I structure the program so that a database of grades resides on the server, and the application resides on the client (the computer the student is physically interacting with).
When the student wants to know his grades, he manipulates my program (by clicking buttons, menu options, etc). The program fires off a query to the database, and the database responds with all the student's grades. Now my application uses all this data to calculate the student's grade, and displays it for him.
This is an example of a 2-tier architecture. The two tiers are:
1. Data server: the database serves up data based on SQL queries submitted by the application.
2. Client application: the application on the client computer consumes the data and presents it in a readable format to the student.
Now, this architecture is fine, if you've got a school with 50 students. But suppose the school has 10,000 students. Now we've got a problem. Why?
Because every time a student queries the client application, the data server has to serve up large queries for the client application to manipulate. This is an enormous drain on network resources.
So what do we do? We create a 3-tier architecture by inserting another program at the server level. We call this the server application. Now the client application no longer directly queries the database; it queries the server application, which in turn queries the data server.
What is the advantage to this? Well, now when the student wants to know his final grade, the following happens:
1. The student asks the client application.
2. The client application asks the server application.
3. The server application queries the data server.
4. The data server serves up a recordset with all the student's grades.
5. The server application does all the calculations to determine the grade.
6. The server application serves up the final grade to the client application.
7. The client application displays the final grade for the student.
It's a much longer process on paper, but in reality it's much faster. Why? Notice step 6. Instead of serving up an entire recordset of grades, which has to be passed over a network, the server application is serving up a single number, which is a tiny amount of network traffic in comparison.
There are other advantages to the 3-tier architecture, but that at least gives you a general idea of how it works.
Incidentally, this website is a 3-tier application. The client application is your web browser. The server application is the ASP code which queries the database (the third tier) for the question-and-answer you requested.
I hope that helps! dont forget to give points if useful

Webi Rich Client 2-tier Vs 3-tier?

Could anyone explain what is 2-tier and 3-tier for Rich Client?
Thank you

When you login 3-tier will show a web app (j2ee or .net) in the system information, as it must connect to the connection server through the web/app. It will use the XI 3.x servers middleware connection for refreshing report data.
If you launch it from infoview a file will be created on your local computer called something.extranet and this file will contain the web/app connection information for connecting.
When using 2 tier connections will be made from the local computer, this requires middle ware to be set up on the workstation(s). Performance will be faster in 2-tier as a benefit. When using 2-tier only a CMS or clustername will be entered in the system.
Regards,
Tim

Urgent! Application tier and Data tier on different platforms

Hello!
I would be very grateful if someone confirms that the deployment of the Beehive, where Application tier and Data tier are placed on different platforms, is supported.
For example, Oracle Database (Data tier) on Linux, and Oracle Application Server (Application tier) on Windows.
Thanks in advance.
Dima.

Hi Dima,
Yes, this will work.

Error during JNDI lookup Accessing Remote EJB (access to web service restricted using declarative security model)

Hello everyone,
I developed a Web Service prototype accessing remote EJB using the EJB
control with special syntax in the jndi-name attribute: @jws:ejb
home-jndi-name="t3://10.10.245.70:7131/AccountDelegatorEJB"
Everything works fine, but I get an error when I restrict access to my web
service with a declarative security model by implementing steps provided in
help doc:
- Define the web resource you wish to protect
- Define which security role is required to access the web resource
- Define which users are granted the required security role
- Configure WebLogic Server security for my web service(Compatibility
Security/Users)
I launch the service by entering the address in a web browser. When prompted
to accept the digital certificate, click Yes, when prompted for network
authentication information, enter username and password, navigate to the
Test Form tab of Test View, invoke the method by clicking the button and I
get the following exception:
<error>
<faultcode>JWSError</faultcode>
<faultstring>Error during JNDI lookup from
jndi:t3://10.10.245.70:7131/AccountDelegatorEJB[Lookup failed for
name:t3://10.10.245.70:7131/AccountDelegatorEJB]</faultstring>
<detail>
<jwErrorDetail> weblogic.jws.control.ControlException: Error during JNDI
lookup from jndi:t3://10.10.245.70:7131/AccountDelegatorEJB[Lookup failed
for name:t3://10.10.245.70:7131/AccountDelegatorEJB] at
weblogic.knex.control.EJBControlImpl.acquireResources(EJBControlImpl.java:27
8) at
weblogic.knex.context.JwsInternalContext.acquireResources(JwsInternalContext
.java:220) at
weblogic.knex.control.ControlHandler.invoke(ControlHandler.java:260) at
ibas.AccountControl.getTransactionHistory(AccountControl.ctrl) at
ibas.GetSecure.retrieveVisaHistoryTxn(GetSecure.jws:64) </jwErrorDetail>
</detail>
</error>
I have a simple Hello method as well in my WebService (which is also
restricted) and it works fine, but remote EJB access doesn't. I tested my
prototype on Weblogic 7.2 and 8.1 platforms - same result.
Is that a bug or I am missing some additional configuration in order to get
that working. Has anyone seen similar behavior? Is there a known resolution?
Or a suggested way to work around the problem?
Thank you.
Andre

Andre,
It would be best if this issue is handled as an Eval Support case. Please
BEA Customer Support at http://support.beasys.com along with the required
files, and request that an Eval support case be created for this issue.
Thanks
Raj Alagumalai
WebLogic Workshop Support
"Andre Shergin" <[email protected]> wrote in message
news:[email protected]...
Anurag,
I removed "t3", still get an error but a different one (Unable to create
InitialContext:null):
<error>
<faultcode>JWSError</faultcode>
<faultstring>Error during JNDI lookup from
jndi://secuser1:[email protected]:7131/AccountDelegatorEJB[Unable to
create InitialContext:null]</faultstring>
<detail>
<jwErrorDetail> weblogic.jws.control.ControlException: Error during JNDI
lookup from
jndi://secuser1:[email protected]:7131/AccountDelegatorEJB[Unable to
create InitialContext:null] at
weblogic.knex.control.EJBControlImpl.acquireResources(EJBControlImpl.java:27
8) at
weblogic.knex.context.JwsInternalContext.acquireResources(JwsInternalContext
.java:220) at
weblogic.knex.control.ControlHandler.invoke(ControlHandler.java:260) at
ibas.AccountControl.getTransactionHistory(AccountControl.ctrl) at
ibas.GetVisaHistoryTransactions.getVisaHistoryTxn(GetVisaHistoryTransactions
.jws:67) </jwErrorDetail>
</detail>
</error>
Note: inter-domain communication is configured properly. The Web Service to
remote EJB works fine without a declarative security.
Any other ideas?
Thank you for your help.
Andre
"Anurag" <[email protected]> wrote in message
news:[email protected]...
Andre,
It seems you are using the URL
jndi:t3://secuser1:[email protected]:7131/AccountDelegatorEJB
whereas you should not be specifying the "t3:" protocol.
The URL should be like
jndi://secuser1:[email protected]:7131/AccountDelegatorEJB
Please do let me know if you see any issues with this.
Note that this will only allow you to access remote EJBs in the same WLS
domain. For accessing EJBs on another domain, you need to configure
inter-domain communication by
following a few simple steps as mentioned at
http://e-docs.bea.com/wls/docs81/ConsoleHelp/jta.html#1106135. This link has
been provided in the EJB Control Workshop documentation.
Regards,
Anurag
"Andre Shergin" <[email protected]> wrote in message
news:[email protected]...
Raj,
I tried that before, it didn't help. I got similar error message:
<error>
<faultcode>JWSError</faultcode>
<faultstring>Error during JNDI lookup from
jndi:t3://secuser1:[email protected]:7131/AccountDelegatorEJB[Lookup
failed for
name:t3://secuser1:[email protected]:7131/AccountDelegatorEJB]</faultstr
ing>
<detail>
<jwErrorDetail> weblogic.jws.control.ControlException: Error during JNDI
lookup from
jndi:t3://secuser1:[email protected]:7131/AccountDelegatorEJB[Lookup
failed for
name:t3://secuser1:[email protected]:7131/AccountDelegatorEJB] at
weblogic.knex.control.EJBControlImpl.acquireResources(EJBControlImpl.java:27
8) at
weblogic.knex.context.JwsInternalContext.acquireResources(JwsInternalContext
.java:220) at
weblogic.knex.control.ControlHandler.invoke(ControlHandler.java:260) at
ibas.AccountControl.getTransactionHistory(AccountControl.ctrl) at
ibas.GetSecure.retrieveVisaHistoryTxn(GetSecure.jws:64) </jwErrorDetail>
</detail>
</error>
Anything else should I try?
P.S. AccountDelegatorEJB, the remote EJB my Web Service calls is NOTaccess
restricted.
I hope there is a solution.
Thanks,
Andre
"Raj Alagumalai" <[email protected]> wrote in message
news:[email protected]...
Andre,
Can you try using the following url with username and password
jndi://username:password@host:7001/my.resource.jndi.object ?
once you add webapp level security, the authenticated is the user who
invokes the EJB.
http://e-docs.bea.com/workshop/docs81/doc/en/workshop/guide/controls/ejb/con
CreatingANewEJBControl.html?skipReload=true
has more info on using remote EJB's.
Hope this helps.
Thanks
Raj Alagumalai
WebLogic Workshop Support
"Alla Resnik" <[email protected]> wrote in message
news:[email protected]...
Hello everyone,
I developed a Web Service prototype accessing remote EJB using the EJB
control with special syntax in the jndi-name attribute: @jws:ejb
home-jndi-name="t3://10.10.245.70:7131/AccountDelegatorEJB"
Everything works fine, but I get an error when I restrict access to my
web
service with a declarative security model by implementing steps
provided
in
help doc:
- Define the web resource you wish to protect
- Define which security role is required to access the web resource
- Define which users are granted the required security role
- Configure WebLogic Server security for my web service(Compatibility
Security/Users)
I launch the service by entering the address in a web browser. Whenprompted
to accept the digital certificate, click Yes, when prompted for
network
authentication information, enter username and password, navigate tothe
Test Form tab of Test View, invoke the method by clicking the buttonand
I
get the following exception:
<error>
<faultcode>JWSError</faultcode>
<faultstring>Error during JNDI lookup from
jndi:t3://10.10.245.70:7131/AccountDelegatorEJB[Lookup failed for
name:t3://10.10.245.70:7131/AccountDelegatorEJB]</faultstring>
<detail>
<jwErrorDetail> weblogic.jws.control.ControlException: Error during
JNDI
lookup from jndi:t3://10.10.245.70:7131/AccountDelegatorEJB[Lookupfailed
for name:t3://10.10.245.70:7131/AccountDelegatorEJB] at
weblogic.knex.control.EJBControlImpl.acquireResources(EJBControlImpl.java:27
8) at
weblogic.knex.context.JwsInternalContext.acquireResources(JwsInternalContext
.java:220) at
weblogic.knex.control.ControlHandler.invoke(ControlHandler.java:260)at
ibas.AccountControl.getTransactionHistory(AccountControl.ctrl) at
ibas.GetSecure.retrieveVisaHistoryTxn(GetSecure.jws:64)</jwErrorDetail>
</detail>
</error>
I have a simple Hello method as well in my WebService (which is also
restricted) and it works fine, but remote EJB access doesn't. I testedmy
prototype on Weblogic 7.2 and 8.1 platforms - same result.
Is that a bug or I am missing some additional configuration in order
to
get
that working. Has anyone seen similar behavior? Is there a knownresolution?
Or a suggested way to work around the problem?
Thank you.
Andre

JavaBean - Netscape security model is no longer supported.

Netscape security model is no longer supported.
Please migrate to the Java 2 security model instead.
Is logged to my java console window and the javabean will not be invoked. How do I migrate to the Java 2 security model. I'm tryÃng to use acrobat viewer for Java as a bean in my forms to open and print pdf documents.
Thanks,
Anders

Anders,
see also my response to your second posting on this:
VBean
My last information regarding the Acrobat Reader jar files were that they are based on Java 1.x, wchih may explain the problems you are running into. I tried these jar files one or two years ago and had problems getting them to work in a newer Java environment.
Frank

Please Migrate to the java 2 Security Model.

HI, this is my first post BTW, I dont know much about Java its just that when i try to access my work from home(united Airlines). It was working fine until i had to format My hd and since u can no longer download java from the microsoft site i had to come here to download the newer version and havent been able to access it since. Is there a site or anywhere that i can download hte old version perhaps or get this one to work? when i tyr to login i get this Error in the Java Console:
ipsNetletStatus.init()
Netlet Starting (16)
Netscape security model is no longer supported.
Please migrate to the Java 2 security model instead.
Netlet found Netscape
Netscape security model is no longer supported.
Please migrate to the Java 2 security model instead.
Netscape security model is no longer supported.
Please migrate to the Java 2 security model instead.
Netscape security model is no longer supported.
Please migrate to the Java 2 security model instead.
Netlet config: https://gw-r5.airline.compuserve.com:443/http://as-r5.airline.compuserve.com:8080/NetletConfig?func=loadResources
ipsNetletStatus.start()
...ipsNetletStatus.run() is starting
Netscape security model is no longer supported.
Please migrate to the Java 2 security model instead.
Netscape security model is no longer supported.
Please migrate to the Java 2 security model instead.
netscape.javascript.JSException: Failure to evaluate netscape.security.PrivilegeManager.enablePrivilege("UniversalPreferencesRead");navigator.preference("network.proxy.ssl");
at sun.plugin.javascript.ocx.JSObject.eval(Unknown Source)
at BrowserProxyInfo.<init>(BrowserProxyInfo.java:58)
at SServer.loadParameters(SServer.java:140)
at SServer.start(SServer.java:111)
at sun.applet.AppletPanel.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)

Lokk at this thread http://forum.java.sun.com/thread.jsp?forum=31&thread=297109
and search the Forums using the term "java 2 security model" (include the quote marks)

Security Models 3-Tier Vs 4-Tier

Similar Messages

Maybe you are looking for