SSL authentication + Radius

Hi,
I would like to know if there are webservers which authenticate the
user through a login page and convey the successful authentication of
the user to a RADIUS server.
-Shar

Itsharkopath,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Do a search of our knowledgebase at http://support.novell.com/search/kb_index.jsp
- Check all of the other support tools and options available at
http://support.novell.com.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://support.novell.com/forums)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://support.novell.com/forums/faq_general.html
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Product Support Forums Team
http://support.novell.com/forums/

Similar Messages

SSL authentication

Hello
I am configuring ssl authentication ( document oracle support 736510.1)
But when doing tnsping from client side i have an tns-12560
[oracle@testrac3 admin]$ tnsping TEST
TNS Ping Utility for Linux: Version 11.2.0.3.0 - Production on 17-JUN-2013 10:04:14
Copyright (c) 1997, 2011, Oracle. All rights reserved.
Used parameter files:
/opt/app/oracle/product/11.2.0.3/db/network/admin/sqlnet.ora
Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS = (PROTOCOL = TCPS)(HOST = testrac1.XX.XX)(PORT =2484)) (SECURITY= (SSL_SERVER_CERT_DN=CN=dbasecurityRoot,O=dbasecurity,C=US)) (CONNECT_DATA = (SERVER = DEDICATED) (SERVICE_NAME= TEST.XXX.XXX)))
TNS-12560: TNS:protocol adapter error
Can someone give me an help
Best regards

Hi, djoloff,
I already answered in this thread, may be it will help.
https://forums.oracle.com/thread/2527585

Connecting Using SSL Authentication Without Username and Password

Hi,
We're on RedHat Linux 4.0 using 10.2.0.3 (server/client). We're trying to figure out a way to connect to the database using instantclient and JDBC-OCI and SSL authentication without using a username or password. According to the documentation this should be possible but no sample code is given.
LD_LIBRARY_PATH is set /opt/app/oracle/product/10.2.0/db_1/lib:/usr/lib:/home/oracle/instantclient where the instantclient was installed from the 10.2.0.1 client software
and we are using JDK version 1.6.0_03.
We're also referencing the following paper:
http://www.oracle.com/technology/tech/java/sqlj_jdbc/pdf/wp-oracle-jdbc_thin_ssl_2007.pdf
We've got our client and server wallets configured and the sample code we tried looks like this:
import java.sql.*;
import java.sql.*;
import java.io.*;
import java.util.*;
import oracle.net.ns.*;
import oracle.net.ano.*;
import oracle.jdbc.*;
import oracle.jdbc.pool.*;
import java.security.*;
import oracle.jdbc.pool.OracleDataSource;
public static void main(String[] argv) throws Exception {
DriverManager.registerDriver(new oracle.jdbc.driver.OracleDriver());
Security.addProvider(new oracle.security.pki.OraclePKIProvider());
System.setProperty("oracle.net.tns_admin", "/opt/app/oracle/product/10.2.0/db_1/network/admin");
String url = "jdbc:oracle:thin:@orcl";
java.util.Properties props = new java.util.Properties();
props.setProperty("oracle.net.authentication_services","(TCPS)");
props.setProperty("javax.net.ssl.trustStore",
"/opt/app/oracle/product/10.2.0/db_1/admin/wallet/server/cwallet.sso");
props.setProperty("javax.net.ssl.trustStoreType","SSO");
props.setProperty("javax.net.ssl.keyStore", "/opt/app/oracle/product/10.2.0/db_1/admin/wallet/client/cwallet.sso");
props.setProperty("javax.net.ssl.keyStoreType","SSO");
props.put ("oracle.net.ssl_version","3.0");
props.put ("oracle.net.wallet_location", "(SOURCE=(METHOD=file)(METHOD_DATA=(DIRECTORY=/opt/app/oracle/product/10.2.0/db_1/admin/wallet/client)))");
System.out.println("At Here...");
OracleDataSource ods = new OracleDataSource();
//ods.setUser("scott");
//ods.setPassword("tiger");
ods.setURL(url);
ods.setConnectionProperties(props);
System.out.println("At Here1...");
Connection conn = ods.getConnection();
System.out.println("At Here2...");
Statement stmt = conn.createStatement();
ResultSet rset = stmt.executeQuery("select 'Hello Thin driver SSL "
+ "tester ' from dual");
while (rset.next())
System.out.println(rset.getString(1));
rset.close();
stmt.close();
conn.close();
When this code is compiled and run, the following error is thrown:
Exception in thread "main" java.sql.SQLException: invalid arguments in call
at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:112)
If a username and password is supplied, the code works. So does anyone have a working of using SSL to authenticate without supplying username/password?
Thanks
mohammed

Hi,
I just solved this. I noticed from another thread that I was not using the OCI driver (see below):
String url = "jdbc:oracle:thin:@pki14";
Once I changed it to:
String url = "jdbc:oracle:oci:@pki14";
The code worked perfectly. One more setting that you'll have to do is to create the user you want to connect as externally:
create user scott identified externally as
'CN=acme, OU=development, O=acme, C=US';
grant connect,create session to scott;
Note that the DN should be the same as the SSL certificate that you created in your wallet.
hth
mohammed

Cisco ISE throws "11036 The Message-Authenticator RADIUS attribute is invalid "

Hello,
I am trying to authenticate my server(running an NMS) with an Cisco ISE with EAP-TLS protocol.
I am seeing "11036 The Message-Authenticator RADIUS attribute is invalid " in the ISE when the ACCESS-REQUEST is sent from NMSServer to ISE. The RADIUS shared secret key is same in both the NMS server and the ISE server .
Is the some java samples for Message authenticator attribute which I can refer. I think, I am missing something in Message authenticator attribute.
Any pointers or suggestions to overcome this ?

To login to Prime GUI, the authentication will be done by ISE.
The flow goes like this, Admins will login to Prime GUI with default username/pwd and add the RADIUS/ISE details to it which will be used by prime for authentication/authorization.
Once its done, any other user who tries to login to Prime GUI with their own credentials will be validated against the Identity details in ISE. So even to login to Prime GUI, authentication should be successful in ISE.

Java sp 2-way SSL authentication

I've written a java stored proc that uses JSSE to implement an HTTPS client to a partner's server. In the past, this strategy has worked well, and we have several successful projects under our belts.
This time, the partner's server is configured for 2-way ssl authentication. When I try to open the connection from my client, it is reporting-
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate.
I'm not 100% sure what that means, but I think that it means the server is asking for a public cert from the client, and it isn't happy with what it is getting back.
Can anyone tell me how to configure the client-side cert in a way that will make it available for my java code running in the Oracle JVM. I understand how to set up the keystore so that it is available for Tomcat, for example, but I'm at a loss to find how to setup client certs for access within an Oracle Java Stored Procedure...
I hope that I have explained this clearly. If I need to provide more information, just ask.
Thanks in advance for any help.
Cole

http://www.weblogic.com/docs51/classdocs/API_acl.html
Michael Girdley
BEA Systems Inc
"gennot" <[email protected]> wrote in message
news:[email protected]..
Could you send me the complete URL of these example, please?
Thanks
Enrico
Michael Girdley <[email protected]> wrote in message
39b87078$[email protected]..
The passing of the client's certificate should be automatic to WebLogic.We
have an example of getting the client side certificate from inside of
WebLogic in our documentation.
This does not require for SSL to be used from the Web server to
WebLogic.
>>
Thanks,
Michael
Michael Girdley
BEA Systems Inc
"Bob Simonoff" <[email protected]> wrote in message
news:[email protected]..
I have read through the docs and haven't found anything that would
address
the following confusion:
Suppose I want to use Apache or IPlanet as the webserver with WebLogicas
the back end application server (obviously). I have the need to use 2way
SSL authentication. As I understand it the following applies:
Client (browser) has a certificate as does the web server. Theyauthenticate
each other.
Now, the web server and weblogic need to communicate. WebLogic, in our
environment does authentication via the security realm.
What do I have to do to get the the web server (Apache or IPlanet) to
communicate the client's certificate to WebLogic so the WebLogic canperform
the authentication?
Does the communication between the web server and WebLogic also need
to
be
SSL?
Thanks
Bob Simonoff

SSL authentication between business connectoe and other system

Hi every1,
One system has to be connected to SAP BC(Business connector). I want to know how to setup the connectivity between these two systems. Also I want to know how to handel the SSL authentication between these two systems with complete details for how to do this.
Thankx in advance.
Regards
Karan

Hi Karan,
Find everything related to SAPBC at http://service.sap.com/connectors _> SAP business connector.
For SSL check
http://service.sap.com/connectors _> SAP business connector -> Tools and Services -> SSL Version.
Regards
Juan

[Cisco ACS] 11036 The Message-Authenticator RADIUS attribute is invalid

Hi,
I got many Cisco AP which are linked to 2 Cisco WLC.
On each WLC, I configured a primary and a secondary RADIUS Server.
RADIUS servers are Cisco ACS 5.2.0.26 (patch 10)
Primary and secondary ACS configurations are synchronized.
There are no problem between primary WLC and Cisco ACS (primary and secondary).
When secondary WLC requests primary Cisco ACS, I get this error "11036 The Message-Authenticator RADIUS attribute is invalid"
Secondary WLC automatically contacts secondary Cisco ACS and it works fine.
Cisco ACS description for this error: "This maybe because of mismatched Shared Secrets."
The two Cisco ACS are synchronized so I should have same error on them...
Why does primary ACS generate this error?
Thanks for your help,
Patrick

Tarik Admani wrote:Amjad,That is a good observation, shouldnt 7.3 (which recently released) help put these types of issues to rest? I hear that the configuration can now be replicated from one controller to the next in a failover setup.Thanks,Tarik Admani
*Please rate helpful posts*
Yes. That is a good point.
With 7.3 you can use high availability (HA) between two WLCs and you can configure only one WLC (the primary) and all the configuraiotn can be replicated and synched to the other WLC (the secondary).
The two WLCs in the HA must be on same subnet though. Otherwise hot-standby HA between WLCs can't be used.
Rating useful replies is more useful than saying "Thank you"

SSL authentication Connectivity using Oracle JDK1.3

Please let me know whether Oracle JDK1.3 will support the SSL authentication Connectivity.
If not what is the workaround to make the SSL authentication connectivity work
in oracle JDK 1.3
since this urgent,Please let us know this information at the earliest

Hi,
Oracle furnish an embedded Java VM with the database but does not furnish JDKs; there is no such a thing as Oracle JDK 1.3.
You are probably referring to JDBC but which release?
SSL Authentication is supported in JDBC-Thin 11g and JDBC-OCI pre-11g.
Kuassi http://db360.blogspot.com

Configuring SSL Authentication

I am attempting to set up SSL authentication in a test environment with Oracle 9.2 on Windows XP. When I try to connect the client I get ORA-28862: SSL connection failed. I switched on client tracing which appears to show that the wallet is being opened successfully but the connection fails on the SSL handshake with ORA-28862 and a minor code of 542. Where can I find out what this minor code means? There doesn't appear to be any further indication of what the problem might be in the trace file but here is the section with the handshake error, any assistance gratefully received:
[04-DEC-2008 18:44:40:795] ntzCreateConnection: performing NZOS handshake - pass 1
[04-DEC-2008 18:44:40:795] nzos_Handshake: entry
[04-DEC-2008 18:44:40:795] nttwr: entry
[04-DEC-2008 18:44:40:795] nttwr: socket 1772 had bytes written=51
[04-DEC-2008 18:44:40:795] nttwr: exit
[04-DEC-2008 18:44:40:795] nttrd: entry
[04-DEC-2008 18:44:40:795] ntt2err: entry
[04-DEC-2008 18:44:40:795] ntt2err: soc 1772 error - operation=5, ntresnt[0]=530, ntresnt[1]=53, ntresnt[2]=0
[04-DEC-2008 18:44:40:795] ntt2err: exit
[04-DEC-2008 18:44:40:795] nttrd: exit
[04-DEC-2008 18:44:40:795] nzos_Handshake: exit
[04-DEC-2008 18:44:40:795] ntzCreateConnection: SSL handshake failed with error 28862.
[04-DEC-2008 18:44:40:795] ntzchknb: entry
[04-DEC-2008 18:44:40:795] nttctl: entry
[04-DEC-2008 18:44:40:795] nttctl: Setting connection into async mode
[04-DEC-2008 18:44:40:795] ntzchknb: exit
[04-DEC-2008 18:44:40:795] ntzchknb: entry
[04-DEC-2008 18:44:40:795] nttctl: entry
[04-DEC-2008 18:44:40:795] nttctl: Setting connection into callback mode
[04-DEC-2008 18:44:40:795] ntzchknb: exit
[04-DEC-2008 18:44:40:795] ntzCreateConnection: returning NZ error 28862 in result structure
[04-DEC-2008 18:44:40:795] ntzCreateConnection: failed with error 542
[04-DEC-2008 18:44:40:795] ntzCreateConnection: exit
[04-DEC-2008 18:44:40:795] ntzdisconnect: entry
[04-DEC-2008 18:44:40:795] ntzFreeNTZData: entry
[04-DEC-2008 18:44:40:795] ntzFreeNTZData: exit
[04-DEC-2008 18:44:40:795] nttdisc: entry
[04-DEC-2008 18:44:40:795] nttdisc: exit
[04-DEC-2008 18:44:40:795] ntzdisconnect: exit
[04-DEC-2008 18:44:40:795] ntzconnect: failed with error 542
[04-DEC-2008 18:44:40:795] ntzconnect: exit
[04-DEC-2008 18:44:40:795] nserror: entry
[04-DEC-2008 18:44:40:795] nserror: nsres: id=0, op=65, ns=12560, ns2=0; nt[0]=28862, nt[1]=542, nt[2]=0; ora[0]=28862, ora[1]=0, ora[2]=0
[04-DEC-2008 18:44:40:795] nsopen: unable to open transport
[04-DEC-2008 18:44:40:795] nsbfr: entry
[04-DEC-2008 18:44:40:795] nsbfr: normal exit
[04-DEC-2008 18:44:40:795] nsbfr: entry
[04-DEC-2008 18:44:40:795] nsbfr: normal exit
[04-DEC-2008 18:44:40:795] nsmfr: entry
[04-DEC-2008 18:44:40:795] nsmfr: 2348 bytes at 0xdee0b8
[04-DEC-2008 18:44:40:795] nsmfr: normal exit
[04-DEC-2008 18:44:40:795] nsmfr: entry
[04-DEC-2008 18:44:40:795] nsmfr: 492 bytes at 0xdbd2d0
[04-DEC-2008 18:44:40:795] nsmfr: normal exit
[04-DEC-2008 18:44:40:795] nsopen: error exit
[04-DEC-2008 18:44:40:795] nsclose: entry
[04-DEC-2008 18:44:40:795] nsclose: normal exit
[04-DEC-2008 18:44:40:795] nladget: entry
[04-DEC-2008 18:44:40:795] nladget: exit
[04-DEC-2008 18:44:40:795] nsmfr: entry
[04-DEC-2008 18:44:40:795] nsmfr: 164 bytes at 0xdd7ea0
[04-DEC-2008 18:44:40:795] nsmfr: normal exit
[04-DEC-2008 18:44:40:795] nladtrm: entry
[04-DEC-2008 18:44:40:795] nladtrm: exit
[04-DEC-2008 18:44:40:795] nscall: error exit
[04-DEC-2008 18:44:40:795] nioqper: error from nscall
[04-DEC-2008 18:44:40:795] nioqper: nr err code: 0
[04-DEC-2008 18:44:40:795] nioqper: ns main err code: 12560
[04-DEC-2008 18:44:40:795] nioqper: ns (2) err code: 0
[04-DEC-2008 18:44:40:795] nioqper: nt main err code: 28862
[04-DEC-2008 18:44:40:795] nioqper: nt (2) err code: 542
[04-DEC-2008 18:44:40:795] nioqper: nt OS err code: 0
[04-DEC-2008 18:44:40:795] niomapnserror: entry
[04-DEC-2008 18:44:40:795] niqme: entry
[04-DEC-2008 18:44:40:795] niqme: reporting ORA-28862 error

Hi Ian,
Well, I'm pretty sure Oracle Advanced Security is an Oracle product so you may not need to contact Microsoft just yet. :)
I don't have too much to offer but I can say that I have seen this error when the operating system user used to create the wallet is not the same user that the listener and database services run as (these likely are running as the default Local System account unless you've already changed them).
That is to say, if a user named "abc" created the wallet the listener and database services should be edited to run as that user using the Log On tab for the service properties. Hopefully that makes sense.
Perhaps that will help a bit,
Regards,
Mark

Mutual SSL Authentication

Hi,
We are trying to implement Mutual SSL Authentication in our environment with Reverse Proxy and the Client's Browser.
Can anybody help me out in this.
We are using OAM

Make sure the following for reverse proxy:
1. make sure the webserver that uses reverse proxy accepts requests from reverse proxies.
2. update the virtual hosts configured in the policy manager
3. prevent people from using the direct url, u can use web server ACL's
4.redirect all existing URL's to reverse proxy hostname with port
5. deploy enough proxy servers to handle the load
Thanks.
Subhani Shaik

SSL Certificate and SSL Authentication

Hi-
I'm hoping someone can shed some light on this issue.
First off, is there a difference between SSL Certificate and SSL Authentication?
I have a POP account. The Incoming port is set to 110. The Outgoing, 26. (This is according to Bluehost.com). The security settings for both incoming/outgoing are set to none. Everything works fine.
But if I want extra security, I'll set the incoming to 995 and outgoing to 465.
If I set the security settings to SSL, do I check "Use secure authentication", or do I have to purchase a SSL certificate to secure the authentication? This is where I'm confused. I tried asking the hosting company but they're not much help.
Any advice would be appreciated.
Thanks!

Hi Imagine,
You do not need to purchase your own SSL certificate to use secure authentication. The server handles this for you. You just need to make sure the port #s are correct and you simply check mark the SSL boxes and leave authentication on Password at least on most setups. Each host maybe different so you have to double check with them.
Hope That Helps,
Eric

SSL Authentication failure to ASA

We have a Cisco ASA 5520 running 7.1. We have users that connect via SSL. There are times when a user tries to logon via SSL that they get login failed multiple times and then say 10 or 30 minutes later authentication will succeeed. The failed attempt happens so fast that it is almost like there is no auctual attempt at authentication, almost like it is a cache or browser cache setting, because I can use a test pc and login. When my test pc is having this issue, I can use a second test pc and authentication will work. Does anyone else seem to be experiencing this issue? Could it be a browser issue? Users are using a combination of IE 6.0 and IE 7.0.
Thanks

Verify your RADIUS configuration with the Test button on the AAA Server Groups configuration screen. Once you supply a username and password, this button allows you to send a test authentication request to the ACS server.
Choose Configuration > Remote Access VPN > AAA Setup > AAA Server Groups.
Select your desired AAA Server group in the top pane. Select the AAA server that you want to test in the lower pane. Click the Test button to the right of the lower pane. In the window that appears, click the Authentication radio button, and supply the credentials with which you want to test. Click OK when finished

SSL Authentication in weblogic 5.1

Hi
I am using SSL in my weblogic application. So that it asks for the username and
password while startup. But now i want to mention the username and password in
weblogic.properties file itself. So that the client need not have to provide the
username and password. I am using weblogic server 5.1 version.
How do i do this?
Hope my question is clear. Please help.
with regds
siva

Hi Michael
I am using SSL in my application. So that it asks for the certificate username
and password while startup. But now i want to mention the username and password
in weblogic.properties file itself. So that the client need not have to provide
the username and password everytime. I am using weblogic server 5.1 version.
How do i do this?
Hope my question is clear. Please help.
with regds
siva
Michael Young <[email protected]> wrote:
Hi.
It's not 100% clear to me what you are asking for. Do you want authentication
turned off for
your application? That will certainly turn off prompting for authentication
information. You
can set your ACL for your application (in your properties file) to allow
everyone to execute
it. Something like:
weblogic.allow.execute.<myApplication>=everyone
But maybe you want some kind of silent authentication so that not everyone
can execute your
app? I suppose you could pass authentication info in a cookie. I really
don't know enough
about your application, though.
I suggest you post this question in weblogic.developer.interest.security
- you have a better
chance of getting an answer there for security related questions.
Hope this helps.
Michael
siva wrote:
Hi all,
I have the following requirements. I have an application which asksfor the authentication
information like username and password at first. The application isrunning in
weblogic5.1 server. Is there a way where in weblogic.properties file,i mention
the username and password so that the application will not ask forin the browser.
please help. It's urgent.
with regds
siva--
Developer Relations Engineer
BEA Support

SSL authentication in Applet, the next step?

Hi,
In the following code:
     private RssReader rssReader;
     private void createFeed() {
          rssReader = new RssReader("https://{username}:{password}@{domain}/mymon/index.php?{anaction}=rss.showrss&server_id=&ident=&statusnr=2&block=7&wwwauth=1");
          System.out.println ("TlsModel.createFeed; rssReader created");
          rssReader.readRSSFeed();
          System.out.println ("TlsModel.createFeed; read Feed");
     }I got the following error:
TlsModel.createFeed; rssReader created
IOException java.io.IOException: Server returned HTTP response code: 401 for URL: https://{username}:{password}@{domain}/mymon/index.php?{anaction}=rss.showrss&server_id=&ident=&statusnr=2&block=7&wwwauth=1
-1
TlsModel.createFeed; read FeedWe configured the feeder to allow "username" to read the feed. But still the 401 server response. What would you suggest I don now?
TIA,
Abel
Edited by: Abel on Jan 18, 2008 8:36 AM
Changed title

I have been reading the 'JSSE Reference Guide for Java SE 6' document (http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html).
What I can't seem to wrap my head around is what I need to do in a client (the Applet mentioned in the previous post) to authenticate. I know it should be possible, as there is a getNeedClientAuth() (Returns true if the socket will require client authentication) method in javax.net.ssl.SSLSocket.
So, through what hoop do I need to jump through to be able to authenticate a user in the Applet?
Background:
I want to read the contents of a RSS Feed coming from a https page. The user of the Applet needs to authenticate him/herself using his/her username and password.

Cisco Security Manager Local RBAC Authentication Radius assign user role

Is it possible to use Cisco Security Manager with local RBAC, authenticate the user to Radius and retrieve it's role from Radius. Getting the authentication to work isn't the problem, but is it also possible to return the role the user has (i.e. Super Admin) via Radius, without having to create all the users one-by-one in the local CSM database with the correct role.
Can i use a certain Cisco-AV-Pair attribute to return the user role via Radius?

I just got asked to look at the same situation by one of our security people.
We have exactly the same problem but it reports a username of "*****" and we are running CSM 4.7 (upgraded last week)

SSL authentication + Radius

Similar Messages

Maybe you are looking for