SOAP and J2EE security
We have deployed several SOAP services (Apache SOAP) on a WLS6.1
server. Since there are more and more services are being deployed
people are getting worried about security. I was wondering what the
best solution was to to authentication and authorization on EJB and
method level for SOAP clients ? I was thinking about the following
solution: use the standard J2EE security by defining security
constrainst in the ejb-jar.xml file. Therefor every client needs to
provide credentials to use the EJB's (this should work for both
RMI/IIOP and SOAP clients).
What are your ideas and opinions about this solution ?
If you post a reply please CC to [email protected]
Hi,
Let me know if you find answer of your question.
thanks
Similar Messages
-
OID Dynamic Groups and J2EE security roles
Hi
I've searched the forums but can't get a definite answer. Is it possible to use OID dynamic groups and map them to J2EE security roles? I can't find anything that says specificially not but I can't seem to get it to work.
Thanks
AdamHi,
Let me know if you find answer of your question.
thanks -
Hi,
late but hopefully not to late i do my first steps into the world of webservices.
Since we use JDEV 9.0.4 in prodution i started with this version of JDEV.
There it is possible to generate two kind of Webservices, soap and j2ee.
In version 10.1.3 there is only one left.
May someone could explain the reason to me please (and perhaps the differences)?
Thanks and regards,
ChrisIn 10.1.3 we use the standard J2EE way of working with Web Services (JAX-RPC) in older versions of JDeveloper we also supported an Oracle specific way - which was there before the industry standard appeared.
-
J2ee security and page flow problem
To give more details about the problem I have, user likes to put a URL in the browser, then press enter. User likes to see the running results. However, user is not able to see the results because j2ee security requires user log in. After sucessful login, user is going to see the index page. My question is how user be able to view his result page after login.
cheers.In the future, please post JSP/Servlet questions in the appropriate forum: http://forum.java.sun.com/category.jspa?categoryID=20
This is pretty simple to do:
1) set up a Filter that applies to a specific url pattern, such as " /protected/* " so that the Filter is invoked when resources within the "protected/" path get accessed
2) in the Filter code, store the user's desired path in the session scope (let's call it "loginRedirectFrom") and redirect the user to the login screen.
3) in your login servlet/jsp, after the user has been verified, redirect to the url you stored in "loginRedirectForm". -
J2EE security, OID and account lockout
Hi!
I have created a Webcenter application (in Jdev 10.1.3). I have added standard J2EE security to both the portlets and the Webcenter app, using form-based authentication. On the application server, I use the OID for authentication (without SSO).
Now, when a user logs in, all works fine, but after a short period (maybe session timeout?) the OID account becomes locked.
Has anyone seen this before? It is really troublesome.
Jeroen van VeldhuizenJeroen,
you should try checking the OID logs at the time of the lockouts, it seems to me it is probably an OID setting or issue.
Cheers,
Mick. -
Is in PI7.1 possible asynchronous communication between SOAP and ABAPProxy?
Hi,
when method execute_asynchronous has disapeared since XI/PI 7.1, is
there still way how to use ABAP proxy in asynchronous way?
We need to build asynchronous connection SOAP->PI->ABAP_Proxy.
In PI, both interfaces are defined as asynchronous (outbound for SOAP and
inbound for ABAP Proxy).
Despite of this fact, when message is sent, it is processed
synchronous way.
I have set breakpoint in my implementation of method for ABAP Proxy
message processing. When message is sent and breakpoint is reached,
whole connection stays open (between SOAP and PI and between PI and
ABAP Proxy) and waits for processing method (the breakpointed one) to
return. Only when processing method returns, is connection finelly
closed.
If i understand it correctly, this is synchronous behavior. In
asynchronous behavior, as i understand it, should be connection
between PI and ABAP Proxy of application server closed immediately
after message has been delivered. This mean before my processing
method is even called.
The same could be said about SOAP and PI communication. Connection
should be closed immediately after PI has received message. From
definition of asynchronous communication of PI is obvious, that PI
should receive message correctly and close connection to sender system
even when receiver is unreachable. It should deliver message later
when, receiver system is back on line. So why it keeps connection to
sender system open while it waits for receiver?
Why is this happening, when both interfaces are defined as
asynchronous? Could be the reason for this, if APPLICATION
ACKNOWLEDGEMENT is set on by default? If so, how can i change it
to SYSTEM ACKNOWLEDGEMENT, or disable it at all?
Or is this kind of asynchronous communication even possible since
XI/PI 7.1 ?
Processing of message we are sending can take some time, so we dont
want connection pending open while waiting for finish of
processing. Thats the reason why we have chose asynchronous model to
use.Quote from How to Use the J2EE SOAP Adapter:
"If you select Best Effort, the Web service client will receive a response
message in the SOAP body. Otherwise, the Web service client will not receive a
response message if no error occurs."
"if no error occurs" - that is the problem. In either case he still
waits if some error occure or not. I dont want it. Once PI has
received message, I want the connection with sender to be closed. If
there will be error in communication between PI and reciever, I want
to see it only in PI log. That mean no notification to sender to be
send about that error.
Is that possible? -
Custom Policy vs. J2EE Security
Hi there, Java Security architecture gurus,
I am currently trying to find the best architecture for the new security framework for our company's application. The system requires instance based security. ACLs are stored in a database. JAAS's authentication is just fine, but its file based authorization is not sufficient for our needs. Access rights change during runtime and they should not be refreshed that inefficient way with Policy.refresh().
The solution I would like to establish should cope with changing environments without the need to change the code that is using security checks. E.g. the app should be able to run as a stand-alone application or within J2EE application servers or servlet engines.
I have looked at the Java 2 Security API and found out that implementing a customized version of the JAAS Policy class can be one approach. A good benefit is the tight integration with the Java Security framework and that it not necessary to reimplement things like the AccessController and privileged actions.
Now, I have the following questions:
- Is the custom Policy a common solution when the application is deployed on a J2EE appserver?
- Is it possible to delegate permission checking of the system permissions (FilePermission, PropertyPermission, etc.) to the original Policy implementation? I would not really want to have to include all of these in the database table.
The alternative approach would probably be J2EE security with the cost of restricting the app to the J2EE environment. To me it seems to be impossible to implement instance based security with role based descriptive J2EE security. With programatic EJB security, I would need to make isPrincipalInRole() completely dynamic to support it.
I looked through the forum for quite a while without success but if you already discussed this topic I would really appreciate a pointer.
Thanks,
ChristophChris,
There is a very good article from IBM that implements the same thing you are trying to implement i.e. instance base security and also custom Policy(u may need this).
http://www-106.ibm.com/developerworks/library/j-jaas/?n-j-442
Now, I have the following questions:
- Is the custom Policy a common solution when the application is deployed on a J2EE appserver?
Custom policy is required primarily if you are going away from the default policy format that sun recommends. If you want to read your permissions from a database you may need to implement a custom Policy class.
- Is it possible to delegate permission checking of the system permissions (FilePermission, PropertyPermission, etc.) to the original Policy implementation? I would not really want to have to include all of these in the database table.
This is recommended by Sun. You may have to delegate the Permission checks that you know you cannot handle to default policy class.
In your CustomPolicy.java getPermissions() method, the following code will code to the end of the function
// If the permission is not found here then delegate it
// to the standard java Policy class instance.
java.security.Policy policy = java.security.Policy.getPolicy();
return policy.getPermissions(codeSource);
Hope this helps. -
All -
I'm new to consuming web services in JDeveloper. I'm using Oracle JDEV 10.1.3.3/OC4J. I'm using this version since it is compatible with Oracle EBS 12.1.3. My intent is to pull data from our third party recruitment app (Success Factors) and load that data into Oracle HRIS. I'm already doing this through a .NET application. I'm converting it to be a Java Concurrent Program in EBS. The code listed below is a stub call to verify I'm on the right track. I created a JDeveloper Web Services proxy project. I'm testing it locally on my windows desktop. When I'm able to consume the service successfully, then I'll think about moving it to the EBS server.
I'm getting the following error when I invoke the following service:
HTTP transport error: javax.xml.soap.SOAPException: java.security.PrivilegedActionException: javax.xml.soap.SOAPException: Message send failed: String index out of range: -7
End point is: https://api4.successfactors.com/sfapi/v1/soap?wsdl
Any help/assistance would be much appreciated.
Below is my code and output of my test:
package emsc.oracle.apps.emscper.sfapi.proxy;
import HTTPClient.HTTPConnection;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.IsValidSession;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.IsValidSessionResponse;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.Login;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.LoginResponse;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.LoginResult;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.Logout;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.LogoutResponse;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.SFCredential;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.SFParameter;
import emsc.oracle.apps.emscper.sfapi.proxy.types.sfobject_sfapi_successfactors_com.Error;
import java.io.File;
import javax.xml.rpc.ServiceFactory;
import java.util.ArrayList;
import java.util.List;
import java.util.Date;
import javax.xml.ws.BindingProvider;
import javax.xml.soap.SOAPException;
import java.util.Map;
import oracle.security.ssl.OracleSSLCredential;
public class SFAPITest {
// Declare members:
private String companyId;
private String userName;
private String password;
private String developerKey;
private Date effDt;
private String greaterThanEffDt;
private String lessThanEffDt;
// Declare constants:
final static private String breakLine = "+---------------------------------------------------------------------------+";
final static private String format = "yyyy-mm-dd";
private enum ReqId {
PrimaryReq(25),
PrimaryReqCEO(26),
EmCarePrimary(27),
RTI(28),
EmCareClinical(29);
private int reqId;
private ReqId() {
private ReqId(int value) {
reqId = value;
public int getReqId() {
return reqId;
// Getters and Setters:
protected String getCompanyId() {
return this.companyId;
protected void setCompanyId(String value) {
this.companyId = value;
protected String getUserName() {
return this.userName;
protected void setUserName(String value) {
this.userName = value;
protected String getPassword() {
return this.password;
protected void setPassword(String value) {
this.password = value;
protected String getDeveloperKey() {
return this.developerKey;
protected void setDeveloperKey(String value) {
this.developerKey = value;
protected Date getEffDt() {
return this.effDt;
protected void setEffDt(Date value) {
this.effDt = value;
protected String getGreaterThanEffDt() {
return this.greaterThanEffDt;
protected void setGreaterThanEffDt(String value) {
this.greaterThanEffDt = value;
protected String getLessThanEffDt() {
return this.lessThanEffDt;
protected void setLessThanEffDt(String value) {
this.lessThanEffDt = value;
public void runProgram()
SFAPIService mySFAPIService;
String CompletionText = "";
String effDtStr2 = null;
/* Code your program logic here.
* Use getJDBCConnection method to get the connection object for any
* JDBC operations.
* Use CpContext provided commit,rollback methods to commit/rollback
* data base transactions.
* Don't forget to release the connection before returning from this
* method.
/* Call setCompletion method to set the request completion status and
* completion text.
* Status values are ReqCompletion.NORMAL,ReqCompletion.WARNING,
* ReqCompletion.ERROR.
* Use Completion text message of length 240 characters. If it is more
* than 240 then full string will appear in log file and truncated 240
* characters will be used as request completion text.
try
ServiceFactory factory = ServiceFactory.newInstance();
mySFAPIService = (emsc.oracle.apps.emscper.sfapi.proxy.SFAPIService)factory.loadService(emsc.oracle.apps.emscper.sfapi.proxy.SFAPIService.class);
SFAPI api = mySFAPIService.getSFAPI();
/// SFAPI api = new SFAPI();
//Map<String, Object> requestContext = ((BindingProvider) api).getRequestContext();
//requestContext.put(BindingProvider.SESSION_MAINTAIN_PROPERTY, true);
System.out.println("ServiceName => " + mySFAPIService.getServiceName().toString());
System.out.println("End Point => " + mySFAPIService.getServiceName().toString());
System.out.println(breakLine);
// Authentication: Login to SFAPI:
SFCredential credential = new SFCredential();
// Fake credentials being passed in for this post:
credential.setCompanyId("XXX");
credential.setUsername("XXX");
credential.setPassword("XXX");
credential.setDeveloperKey("XXX");
HTTPConnection httpsConnection = null;
OracleSSLCredential _credential = new OracleSSLCredential();
_credential.setWallet("\\\\\\C:\\Program Files\\Java\\jdk1.6.0_33\\jre\\lib\\security", "ParkEstes3");
/*System.setProperty("javax.net.ssl.trustStore","C:\\\\\OraHome_1\\jdev\\jdevbin\\jdk\\jre\\lib\\security\\keystore");
System.setProperty("javax.net.ssl.trustStorePassword","changeit");
System.out.println(System.getProperty("javax.net.ssl.trustStore"));*/
// SFParameter: Define a generic SFParameter List. This is a necessary parameter
// to invoking calls in SFAPI:
/*System.setProperty("javax.net.ssl.keyStore",
"file:\\\C:\\jdk1.4.1\\jre\\lib\\security\\client.keystore");
System.setProperty("javax.net.ssl.keyStorePassword","welcome"); */
/* System.setProperty("oracle.net.wallet_location",
"(SOURCE=(METHOD=file)(METHOD_DATA=(DIRECTORY=\\\C:\Users\dparrish\Oracle\WALLETS)))"); // (2) */
File kstore = new File("C:\\OraHome_1\\jdev\\jdevbin\\jdk\\jre\\lib\\security\\jssecacerts");
boolean exists = kstore.exists();
if (!exists) {
System.out.println("Keystore does not exist");
else {
System.out.println("Keystore does exist");
System.setProperty("javax.net.ssl.trustStore", kstore.getAbsolutePath());
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
//System.setProperty("proxySet", "false");
//System.setProperty("http.proxyHost", "127.0.0.1");
//System.setProperty("http.proxyPort", "8080");
System.out.println(kstore.getAbsolutePath());
List<SFParameter> lst = new ArrayList<SFParameter>();
SFParameter param = new SFParameter();
param.setName("");
param.setValue("");
lst.add(param);
SFParameter[] sfParam = lst.toArray(new SFParameter[lst.size()]);
Login login = new Login();
try {
login.setCredential(credential);
System.out.println("1");
login.setParam(sfParam);
System.out.println("2");
LoginResponse loginResponse = new LoginResponse();
LoginResult loginResult = new LoginResult();
try {
loginResponse = api.login(login);
catch (Exception e ) {
System.out.println(e.getMessage());
System.out.println("3");
try {
loginResult = loginResponse.getResult();
catch (Exception e ) {
System.out.println(e.getMessage());
System.out.println("4");
IsValidSession vs = new IsValidSession();
IsValidSessionResponse isValidSessionResponse = api.isValidSession(vs);
System.out.println("5");
if (isValidSessionResponse.isResult()) {
System.out.println("Session is valid");
System.out.println("Result => " + loginResult.getSessionId());
System.out.println(breakLine);
Logout logout = new Logout();
LogoutResponse logoutResponse = api.logout(logout);
if (logoutResponse.isResult()) {
System.out.println("Logout of SFAPI Successful");
else {
System.out.println("Logout of SFAPI Unsuccessful");
else {
System.out.println("Session is invalid");
List<Error> errors = new ArrayList<Error>();
for (int i = 0; i < loginResult.getError().length; i++) {
errors.add(loginResult.getError()[i]);
for (int i = 0; i < errors.size(); i++) {
System.out.println("Error Indice => " + i);
System.out.println("Error Code: => " + errors.get(i).getErrorCode());
System.out.println("Error Message: => " + errors.get(i).getErrorMessage());
System.out.println(breakLine);
} // end for loop of SFObject errors
} // end InvalidSession
catch (Exception e)
System.out.println("Session Credential Exception");
System.out.println("Exception => " + e.getMessage());
System.out.println(breakLine);
catch (Exception e)
System.out.println("Parameter List Exception");
System.out.println("Exception => " + e.getMessage());
System.out.println(breakLine);
} // end runProgram
// Constructor:
public SFAPITest() {
} // end constructor
public static void main (String args[]) {
try
SFAPITest test = new SFAPITest();
test.runProgram();
catch (Exception e) {
System.out.println("main exception => " + e.getMessage());
} // SFAPITest
Here is the output with trace:
WARNING: Unable to connect to URL: https://api4.successfactors.com:443/sfapi/v1/soap due to java.security.PrivilegedActionException: javax.xml.soap.SOAPException: Message send failed: String index out of range: -7
Session Credential Exception
Exception => ; nested exception is:
HTTP transport error: javax.xml.soap.SOAPException: java.security.PrivilegedActionException: javax.xml.soap.SOAPException: Message send failed: String index out of range: -7
+---------------------------------------------------------------------------+
Process exited with exit code 0.The other end is throwing back a programming error.
That might be because you are sending incorrect data and the other end fails to validate it.
You might be able to guess based on your C# code. But, since you are using soap one generic solution is available to you.
- Get an http proxy interceptor like wireshark.
- Run it while your C# app runs, collect the http requests from that.
- Run it while running your java code, collect the http requests from that.
Compare the two. -
HI All,
We are using Oc4j version 10g 10.1.3 , and while starting conatiner getting below warning , let me know if anyone have solution for this,.
14/01/10 01:01:29 ********** user-manager (see application/server descriptors) will no longer be supported in the next release of this product!
Please take the appropriate actions to migrate to an alternative strategy! **********
2014-01-10 01:01:29.833 WARNING J2EE SECUR-00100 ********** user-manager (see application/server descriptors) will no longer be supported in the next release
of this product!I just checked my BIOS and my current setting is set at IDE although it also mentions that the default should be AHCI. Currently I have a dual boot of Windows 7 (need it for Tax software) and Arch
So I guess, when I get the new HDD, I will first set it to AHCI and then install the OSes on it. See if NCQ helps any, and if not I will turn it back and re-install (if I have to). I am planning to have Windows only in virtualbox in the new drive.
Anyhoo, while I was in the BIOS I found two things which I had questions about :
1) Under Onboard Devices --> Integrated NIC , my setting is currently set at "On w/PXE" and it says the default should be just "On". Would it be ok to change it back to On since its a single machine and its not booting an OS on any server. I just don't want to have to re-install anything now since I will be doing that in the new HDD.
2) How would I know whether my BIOS would support a 64 bit OS in Virtualbox? I checked some setting under Virtualization, but they weren't very clear.
I will edit this post and let you know exactly what settings were present under the Virtualization sub-section. -
In WEB Application i used JSP, Struts and J2EE.
But Now use swing application, and something for joing swing and j2ee
Somebody knows something...
I need your help....In WEB Application i used JSP, Struts and J2EE.
But Now use swing application, and something for joing
swing and j2ee
hopefully, no business logic is in struts; only the application logic (i.e. order of screens, input type validation, etc.). If this is the case you have many options:
- direct calls to the ejb (assuming you have a service defined as an EJB)
- SOAP, SOAP-RPC, or a full web-service (as mentioned above)
- your own custom protocol over HTTP
- RMI (probably too much work; easier to just make direct EJB calls)
- JMS (probably more work than just using SOAP or HTTP)
- Socket based communication with your own custom protocol
Probably the fastest to get going is direct calls from swing to the EJB.
You'll have to re-implement your application logic; but this is fine as the swing app will probably have a different flow than the web-app.
Best of luck,
Andrew -
Struts/servlet page flow problem due to j2ee security
Whe I type url such as http://localhost:7777/myapp/action.do, I want to see the execution result page from this action. However the result page will always be index.jsp because j2ee security which I have a loginaction.do and its result page is index.jsp. How can I have overcome this problem.
Thanks,To give more details about the problem I have, user likes to put a URL in the browser, then press enter. User likes to see the running results. However, user is not able to see the results because j2ee security requires user log in. After sucessful login, user is going to see the index page. My question is how user be able to view his result page after login.
cheers. -
Using dynamic groups for j2ee security
Hi all,
I have my realm setup in server.xml and my standard and sun-specific deployment descriptors setup for j2ee security.
Everything seems to work fine for groups defined via uniquemember attributes (all users are specified), but I'm having trouble with dynamic groups (defined with the memberurl attribute)
How do I configure my realm in my server.xml to get this working?Hi,
I got an official answer from SUN.
"Dynamic Groups" are not (longer) supported with SJS AS 7!
It will probably be supported with SJS AS 8 SE.
If you have a iPlanet 6.5 application that is running with dynamic groups, just wait a little bit before you migrate. -
Is it possible to bind to J2ee Security methods in JSF pages, like request.getUserPrincipal() or request.isUserInRole("rolename)?
Hi,
actually you can use EL if you create a method in a managed bean to check for a specific role membership. Reference the method - which returns true or false - from EL. Note that EL cannot have arguments and for this reason you cannot directly pass in role names as argumens
Frank -
I have a login system created. It creates accounts into a mysql server at the moment. I want the users to be able to log in. I need the correct details in my "my-DB-plan.xml" file in order to be able to connect to the SQL server. Im not sur what to put in this file or whether im to use a server.xml file
Any Help.Please.Our[b] login.html page is simple as follows:
<html><head><title>
J2EE SQL Security and Registry System Demo
</title></head><body>
<h1>LOGIN using Derby and J2EE declarative security!</h1>
<form method="POST" action="j_security_check">
Username:<br>
<input size="20" name="j_username">
<br><br>
Password:<br>
<input size="20" name="j_password" type="password">
<input name="submit" type="submit" value="Login">
</form>
</html>The connection is not made on the page but rather the username and password is authenticated by "j_security_check".
It's something to do with the my-db-plan.xml file I think, but I don't know if I'm to replace that file, change it or what..
It's setup for the Derby Database server rather than MySQL. I'm not sure how you'd change it. This login system we are using can be seen here: http://www-128.ibm.com/developerworks/opensource/library/os-ag-logreg2/ -
JAAS or regular J2EE Security?
Hi, can some offer me some examples of why I should prefer JAAS (and vice versa) over J2EE security via constraints and roles in web.xml? I'm just not sure which to use...
Thanks...hi,
you should have a look towards jGuard to use JAAS in j2ee in an easy way:
homepage:
http://jguard.sourceforge.net/
sourceforge page:
http://sourceforge.net/projects/jguard
it hides the JAAS complexity , and enable dynamic configuration, and great flexibility!
sincerly yours,
Charles(jguard team).
Maybe you are looking for
-
Hey Guys, I'm starting powershell and I'm having a headheck (I'm searching for hours) with a piece of code :) I'm trying to do that : $LogLines = (Get-Content -Path $LogPath) Foreach ($LogLine in $LogLines) { $LogSubString = $LogLine.Substring(21,15)
-
I previously used Adobe 8 Standard to create PDF packages, I can't seem to find the feature in the new Adobe X Standard. Can anyone help point me in the right direction? Thanks
-
Error when trying implementing BADI --- IDCO_BPL_RCKM_MR21.
Hi Folks, I have to implement the BADI "IDCO_BPL_RCKM_MR21" to update the standard price in MR21. Could any one help me how to implement this BADI. When I tried to implement this BADI I am getting an error message "BADI definition IDCO_BPL_RCKM_MR21
-
Quicktime File Crashing Both Quicktime App and Finder in Mac, but Not Windows
Hi, I have a drive full of Apple ProRes Quicktime files. Almost all of them play perfectly, except 2. Those 2 files have played in the past, but I've had problems with them. They've come back to functionality in the past, but now they are not
-
I updated my iphone 4 with io6, my password does not work
Did not have problems connecting with apple-id and password, after io6 update, my apple-id sign in is not working. Any solutions ?