Windows Integrated Authentication Help From Middle Tier

We are trying to enable single sign-on using Windows Integrated Authentication so that the user does not have to enter a username or password, they just get logged in automatically. I created the current Oracle account on the database and it works just fine when I try to connect from my local computer to the database. Our problem is that our application calls an application that runs as a Windows services on the middle tier, and so it gets an invalid username/password error. I can see in the audit logs that it is trying to connect to the database as NT AUTHORITY\ANONYMOUS LOGON.
The client, middle tier, and database are all Windows based operating systems. The applications is a .Net application and we turned on Impersonation which we read will help pass the client OS user to middle tier so that the application runs as them. And that appears to be working correctly. Again we can get this working when we host the windows service locally, it just wont work when it is hosted on the middle tier. Any ideas how to get this to work?
Oracle version 11.2.0.2 and 11.2.0.3
Windows Server 2008 R2

Hi, jeff81.
I had same problem with Win2003 server. Try this:
Start -> Settings -> Control Panel -> Administrative Tools -> Services
then select "PROPERTIES/LOGON" for necessary service.
Change "Local System account" to your user account.
Make sure that user account have necessary grants.
ps. sorry my poor english :(

Similar Messages

WebLogic 10gR3 and Windows Integrated Authentication

Hi:
I have an intranet web application running on WebLogic 10gR3 and would like to make use of the Windows Integrated Authentication (SSO, SPNEGO, Active Directory) so that the intranet users don't have to log in to access the web application.
In weblogic, I've managed to create an ActiveDirectoryAuthenticator and can see all the users and groups from Active Directly. Also created a NegotiateIdentityAsserter with both WWW-Authenticate.Negotiate and Authorization.Negotiate options.
When I set the web.xml login-config to BASIC, the browser shows the login dialog and authentication happens through AD. I've changed the login-config to CLIENT_CERT as suggested by the documentation:
<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>but I'm getting the following error:
Error 401--Unauthorized
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
10.4.2 401 Unauthorized
The request requires user authentication. The response MUST include a
WWW-Authenticate header field (section 14.46) containing a challenge
applicable to the requested resource. The client MAY repeat the request
with a suitable Authorization header field (section 14.8). If the request
already included Authorization credentials, then the 401 response indicates
that authorization has been refused for those credentials. If the 401
response contains the same challenge as the prior response, and the user
agent has already attempted authentication at least once, then the user
SHOULD be presented the entity that was given in the response, since
that entity MAY include relevant diagnostic information. HTTP access
authentication is explained in section 11.Help is highly appreciated
Albert
Edited by: albertattard on Jul 13, 2009 3:40 PM
Edited by: albertattard on Jul 13, 2009 3:42 PM

Hi:
I have an intranet web application running on WebLogic 10gR3 and would like to make use of the Windows Integrated Authentication (SSO, SPNEGO, Active Directory) so that the intranet users don't have to log in to access the web application.
In weblogic, I've managed to create an ActiveDirectoryAuthenticator and can see all the users and groups from Active Directly. Also created a NegotiateIdentityAsserter with both WWW-Authenticate.Negotiate and Authorization.Negotiate options.
When I set the web.xml login-config to BASIC, the browser shows the login dialog and authentication happens through AD. I've changed the login-config to CLIENT_CERT as suggested by the documentation:
<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>but I'm getting the following error:
Error 401--Unauthorized
From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:
10.4.2 401 Unauthorized
The request requires user authentication. The response MUST include a
WWW-Authenticate header field (section 14.46) containing a challenge
applicable to the requested resource. The client MAY repeat the request
with a suitable Authorization header field (section 14.8). If the request
already included Authorization credentials, then the 401 response indicates
that authorization has been refused for those credentials. If the 401
response contains the same challenge as the prior response, and the user
agent has already attempted authentication at least once, then the user
SHOULD be presented the entity that was given in the response, since
that entity MAY include relevant diagnostic information. HTTP access
authentication is explained in section 11.Help is highly appreciated
Albert
Edited by: albertattard on Jul 13, 2009 3:40 PM
Edited by: albertattard on Jul 13, 2009 3:42 PM

Windows Integrated Authentication on an ABAP data source

Dear Experts,
I have to implement Windows Integrated Authentication in my portal. By using Kerberos & SPNEGO, we can implement very easily if portal user id & windows (ADS) user id is same. But my scenario is windows id & portal id is different & data source is already configured as ABAP. Can you suggest me how we can achieve this requirement.
Regards,
VENU

Hi,
isnt the property krb5principalname used to define the mapping of the user ID when you cannot use the AD standard samaccountname?
I think that the mapped user ID (as provided by krb5principalname) must be identically with the ABAP userID. When the ABAP user ID isn't present in the LDAP information, SSO won't be possible. Somehow he needs to publish the ABAP user ID into the AD.
SAP Help:
http://help.sap.com/SAPHELP_NW70EHP1/helpdata/EN/43/4c363ac31e30f3e10000000a11466f/frameset.htm
http://help.sap.com/SAPHELP_NW70EHP1/helpdata/EN/43/4c3725aeaf30b4e10000000a11466f/frameset.htm
br,
Tobais

Exchange 2013 CU1 Outlook Web App LogOff with Basic or Windows Integrated Authentication

Hi all,
Exchange 2013 CU1 has a new OWA LogOff behaviour when Basic or Windows Integrated Authentication is configured. When clicking the LogOff Button you receive the message "Close All your Browser Windows.." but OWA does not sign out. This is not the
case when using Formbased Authentication...
The problem in our case is the OWA publishing over the Internet via TMG. When publishing via TMG, only Basic and NTLM authentication is supported. This means you have to change the Authentication for the OWA Virtual Directory to basic or Windows Integrated.
OK so far, now we can use the TMG Authentication Form. but... TMG is not able to Catch the OWA LogOff. So we will still receive "Close all your Browser Settings.." and no log out from OWA.
It is a known issue that TMG cannot catch the OWA Logoff with the Exchange 2013 CU1 Release..So my Question:
Does anyone get that "Real LogOut" fixed via TMG or directly on the CAS Server for Exchange 2013 CU1?
I know another possibility is to activate Form Based Authentication on the CAS Servers and external users directly authenticate against the CAS Server without pre-authentication at TMG Level, but this of course does not provide the highest security
we can have.

Hi SLShare,
As far as I know, if there is no TMG involved, with Exchange 2013 when the user signs out of mail, the authentication tokens are cleared and the user will be presented with the
Login Screen. There will not be a need to click on "Close Window" or any other pop ups that may appear.
Therefore, you may ask the TMG forum about this question and see whether there are still some other workaround we can temporary bypass this issue. For your convenience:
Forefront TMG and ISA Server Forum - TechNet - Microsoft
http://social.technet.microsoft.com/Forums/forefront/en-US/home?forum=Forefrontedgegeneral
Thanks,
If you have feedback for TechNet Subscriber Support, contact
[email protected]
Simon Wu
TechNet Community Support

JavaMail Exchange Server Windows Integrated Authentication

I need to send an email using Java Mail by Exchange Server that uses Windows Integrated Authentication.
Is it possible? If so how?
(I read some old posts and I get some info but I have to sure is it possible or not just sending mail)

Hi, jeff81.
I had same problem with Win2003 server. Try this:
Start -> Settings -> Control Panel -> Administrative Tools -> Services
then select "PROPERTIES/LOGON" for necessary service.
Change "Local System account" to your user account.
Make sure that user account have necessary grants.
ps. sorry my poor english :(

Windows Integrated Authentication & SAP Logon tickets

1) We have configured windows authentication and the IISproxy on a SPS frontend server to our SAP portal environment.
2)We have configured SAP logon tickets on the SAP portal (running on hp-ux).
3) Both the IIS server and the sap portal server exist on the same domain inside our firewall (iis_server.lsv.internal_company_name.com and sap_portal_server.lsv.internal_company_name.com)
4) A virtual URL has been created on the IIS server, http://sap_portal.external_company_name.com, using a domain alias.
5) When an authenticated user is passed from the IIS server to the SAP portal the SAP logon ticket that is created is for external_company_name.com alias rather than lsv.internal_company_name.com. This logon ticket is not accepted by any of the backend SAP systems that have been configured to except logon tickets because they all exist in the lsv.internal_company_name.com domain.
6) The portal security guide says:
"The Portal Server issues a SAP logon ticket for the Internet domain or a sub-domain of the
Portal Server only."
Given this scenario, is there some configuration that can be added to allow the use of this alias or is there a bug in the SAP portal code that needs to be addressed?

Hi,
You cannot use the external alias. You can however set SSO on the portal not to look to the total url. For example it would work if you use:
sap_portal_server.lsv.internal.company_name.com
and
sap_portal.external.company_name.com
The prerequisite here is that at least the domain name should be the same i.e. the last two parts.
Greetings,
Vincent

Windows Integrated Authentication to SAP R/3

Hi,
I dont know weather this issue has to be posted here or in WAS or GUI.
Is there any way to do the Integrates Windows Authentication to SAP R/3. Once the Users logs in to the Network domain adn then to SAP GUI, the User should not prompt for User id and should directlt take in to the Role Menu.
I know for Portal it is possible, but i am not sure for R/3. Please let me know if there is any documentation for the same.
Thanks & Regards
Sumanth

Sumath,
there are various variants to do so:
If your R/3 is running on Windows (and in the same / trusted domain), you can use SNC with either NTLM or Kerberos authentication
Otherwise you can log on with SAP Logon Tickets. You mentioned already that you know NTLM/Kerberos is feasible with EP. Now, if you simply integrate your R/3 systems in EP by means of SAP logon tickets you have essentially a smooth SSO for your users.
Finally, you can use ITS up to 6.20 on Windows to SSO to R/3 (the latter on not neccessarily on Windows, too). Simply setup webgui, active SAP logon tickets and configure the PAS service to use Windows authentication.
Whatever you decide on, al alternatives are a piece of cake to set up.
Regards,
Dominik

J2ee security newbie: integrated authentication help

I am trying to build a set of JSPs/servlets that require authentication and probably authorization. The jsp / sevlets should be able to authenticate against any underlying password system, or should cope with most common systems such as win2k / unix etc. I do not want to force the organisation to build a new database of users / passwords or to type in passwords in clear text in xml files.
I would preferably like to use form-based authentication to avoid Http basic clear text password sending. This will also allow me to custmize the UI of the login screen.
The solution should not be container specific. or at least the containers (tomcat + webspehere) should allow for it in their own way.
After a lot of reseasrch on the web, I cant seem to find an accepted way of doing this. I would like comments on the choices I have made so far and the choices I should be making. Any links to reading material would be helpful. I would like to understand which lower level technologies to depend upon eg LDAP / Kerberos etc. Any help will be appreciated
TIA,
Zdz

Most container come with the ability to put security constraints in the web.xml file.
Then, you can set up your container to do the authentication (tomcat call this Realm). And there is a JAAS realm that can be configured a little bit like PAM in Unix/Linux.
There is also a Security Filter around on the net.
Hope this helps.

Recovering from middle tier loss

I have a box that died that had ias 1021 on it that was last brought down nicely. I have another box that I have installed ias 1021 on and avoided the portal install and instead just configured modplsql to point to this db/portal configuration. This new box has the same IP and hostname (exactly).
When I try and access the portal (modplsql works fine outside of portal) I get an internal error with the apache error_log following content:
---------- start here ----------
java.lang.NullPointerException
at org.apache.jserv.JServServletManager.load_init(JServServletManager.java:585)
at org.apache.jserv.JServServletManager.loadServlet(JServServletManager.java:535)
at org.apache.jserv.JServServletManager.loadStartupServlets(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServServletManager.init(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServ.start(JServ.java, Compiled Code)
at org.apache.jserv.JServ.main(JServ.java, Compiled Code)
Exception in thread "main" java.lang.NullPointerException
at org.apache.jserv.JServServletManager.load_init(JServServletManager.java:585)
at org.apache.jserv.JServServletManager.loadServlet(JServServletManager.java:535)
at org.apache.jserv.JServServletManager.loadStartupServlets(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServServletManager.init(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServ.start(JServ.java, Compiled Code)
at org.apache.jserv.JServ.main(JServ.java, Compiled Code)
Exception in thread "main" java.lang.NullPointerException
at org.apache.jserv.JServServletManager.load_init(JServServletManager.java:585)
at org.apache.jserv.JServServletManager.loadServlet(JServServletManager.java:535)
at org.apache.jserv.JServServletManager.loadStartupServlets(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServServletManager.init(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServ.start(JServ.java, Compiled Code)
at org.apache.jserv.JServ.main(JServ.java, Compiled Code)
Exception in thread "main" java.lang.NullPointerException
at org.apache.jserv.JServServletManager.load_init(JServServletManager.java:585)
at org.apache.jserv.JServServletManager.loadServlet(JServServletManager.java:535)
at org.apache.jserv.JServServletManager.loadStartupServlets(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServServletManager.init(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServ.start(JServ.java, Compiled Code)
at org.apache.jserv.JServ.main(JServ.java, Compiled Code)
Exception in thread "main" java.lang.NullPointerException
at org.apache.jserv.JServServletManager.load_init(JServServletManager.java:585)
at org.apache.jserv.JServServletManager.loadServlet(JServServletManager.java:535)
at org.apache.jserv.JServServletManager.loadStartupServlets(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServServletManager.init(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServ.start(JServ.java, Compiled Code)
at org.apache.jserv.JServ.main(JServ.java, Compiled Code)
Exception in thread "main" java.lang.NullPointerException
at org.apache.jserv.JServServletManager.load_init(JServServletManager.java:585)
at org.apache.jserv.JServServletManager.loadServlet(JServServletManager.java:535)
at org.apache.jserv.JServServletManager.loadStartupServlets(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServServletManager.init(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServ.start(JServ.java, Compiled Code)
at org.apache.jserv.JServ.main(JServ.java, Compiled Code)
Exception in thread "main" java.lang.NullPointerException
at org.apache.jserv.JServServletManager.load_init(JServServletManager.java:585)
at org.apache.jserv.JServServletManager.loadServlet(JServServletManager.java:535)
at org.apache.jserv.JServServletManager.loadStartupServlets(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServServletManager.init(JServServletManager.java, Compiled Code)
at org.apache.jserv.JServ.start(JServ.java, Compiled Code)
at org.apache.jserv.JServ.main(JServ.java, Compiled Code)
Exception in thread "main"
----------- end here -----------------
What do I need to do to resurrect this portal?
Thanks,
Mike Sale

It turns out that the failure of the Discoverer portion of the EE install left artifacts around that caused the problem.
I removed these and was up and running.

Passing identification to db from middle-tier

Hi all,
I have a vb script/asp application that connects through odbc to a 10g r2 database.My problem is that i cant audit who did what and when because at the v$session i can only see the username in the odbc connection string.
I realy want to get to the top of these.Has anyone had such a a situation or knows how to solve it?
Thanks
Jimmy

In v$session, there's a a column "client_info" can give you the information.

Can we Run a simple SQL statement from OBIEE Middle Tier node

Hi
i am working in OBIEE 11g environment. Database is installed on one node and Middle tier (BI services ) in other node,
Can i use any utility to run a simple SQL statement from Middle tier ?
Thanks
Reddy

Any utility means?
We can create an ODBC connection on the BI server and run the sql.
Mark if helps.

Windows Integrated Security with SSRS, Sharepoint 2013 and SSAS over http

I have the following setup and problem:
Sharepoint 2013 with SSRS in Sharepoint integrated mode
SSAS 2012 SP1 with http access (IIS + msmdpump) enabled on the same box as SSAS
Every component I have tried works fine with this (PerformancePoint, .bism connections, SSIS packages etc.), connecting over http using Kerberos and windows integrated authentication.
SSRS (.rsds) connections in Sharepoint fail a connection test when using the same http connection string + Windows integrated authentication which works for everything else. The error is: "Unsupported data format: -> Microsoft.ReportingServices.DataExtensions.AdomdTestConnectionException:
Unsupported data format:"
SQL server profiler shows that the windows username is reaching the SSAS server is all cases.
Kerberos delegation is set up for SSAS and is working.
Switching the .rsds connection to saved credentials (same user as I tried with Windows integrated auth) works fine and SQL server profile logs look the same as the Windows integrated case.
So, everything seems to work with Kerberos + http apart from SSRS ... any idea welcome. I did read that SSPI is not supported for http connections but then again, there are sites which give examples of exactly such connection strings. I can't find any
mention of this case or exact problem anywhere ...

For information, this was fixed by applying the .NET 4.5.1 patch as advised by MS support. Now http connections from integrated mode SSRS work ok.

SSRS and SharePoint Integration Authentication Issue

We recently turned on SSRS for our SharePoint 2010 Test Environment. We are using an account that has rights to SharePoint as a site collection administrator, the feature is enabled on the site collection and site level, it has access to the SQL instance
to pull the reports. The report config file specifies NTLM authentication. It acts as if it will configure and goes through the SP Central Administration steps successfully. When I try to deploy a report, I receive the following error:
Exception encountered for SOAP method GetSystemProperties: System.Net.WebException: The request failed with HTTP status 401: Unauthorized.     at Microsoft.SqlServer.ReportingServices2010.RSConnection2010.SetConnectionProtocol()
at Microsoft.SqlServer.ReportingServices2010.RSConnection2010.SoapMethodWrapper`1.ExecuteMethod(Boolean setConnectionProtocol) 1afe9dfd-9846-4194-bddf-fcb0ded634be
06/14/2012 15:37:43.03 w3wp.exe (0x1E78)                       0x1754 SQL Server Reporting Services SOAP Client Proxy
0000 High    Exception encountered for SOAP method GetSystemProperties: System.Net.WebException: The request failed with HTTP status 401: Unauthorized.     at Microsoft.SqlServer.ReportingServices2010.RSConnection2010.SetCo
If I turn on trusted accounts, it works, but then it argues when the report loads because our reports use windows integrated authentication. We would prefer to have windows integrated authentication to control who can see reports by their
login name. Any ideas? I feel like I have exhausted options.

Can you please elaborate on how to avoid using Kerberos and use the Secure Store to access our external SQL data? In our test environment, we have SharePoint 2013 Ent, SQL 2012 Ent. I am trying to use PowerView to access a Direct Query data model created
in SSAS tabular mode. My connection from SharePoint to the model is successful but fails with a reporting service error:
Cannot create a connection to data source 'EntityDataSource'.
<detail><ErrorCode xmlns="rsErrorOpeningConnection</ErrorCode><HttpStatus">http://www.microsoft.com/sql/reportingservices">rsErrorOpeningConnection</ErrorCode><HttpStatus xmlns="400</HttpStatus><Message">http://www.microsoft.com/sql/reportingservices">400</HttpStatus><Message
xmlns="Cannot">http://www.microsoft.com/sql/reportingservices">Cannot create a connection to data source 'EntityDataSource'.</Message><HelpLink xmlns="http://go.microsoft.com/fwlink/?LinkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsErrorOpeningConnection&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.3000.0</HelpLink><ProductName">http://www.microsoft.com/sql/reportingservices">http://go.microsoft.com/fwlink/?LinkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsErrorOpeningConnection&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.3000.0</HelpLink><ProductName
xmlns="Microsoft">http://www.microsoft.com/sql/reportingservices">Microsoft SQL Server Reporting Services</ProductName><ProductVersion xmlns="11.0.3000.0</ProductVersion><ProductLocaleId">http://www.microsoft.com/sql/reportingservices">11.0.3000.0</ProductVersion><ProductLocaleId
xmlns="1033</ProductLocaleId><OperatingSystem">http://www.microsoft.com/sql/reportingservices">1033</ProductLocaleId><OperatingSystem xmlns="OsIndependent</OperatingSystem><CountryLocaleId">http://www.microsoft.com/sql/reportingservices">OsIndependent</OperatingSystem><CountryLocaleId
xmlns="1033</CountryLocaleId><MoreInformation">http://www.microsoft.com/sql/reportingservices">1033</CountryLocaleId><MoreInformation xmlns="<Source>Microsoft.ReportingServices.ProcessingCore</Source><Message">http://www.microsoft.com/sql/reportingservices"><Source>Microsoft.ReportingServices.ProcessingCore</Source><Message
msrs:ErrorCode="rsErrorOpeningConnection" msrs:HelpLink="http://go.microsoft.com/fwlink/?LinkId=20476&EvtSrc=Microsoft.ReportingServices.Diagnostics.Utilities.ErrorStrings&EvtID=rsErrorOpeningConnection&ProdName=Microsoft%20SQL%20Server%20Reporting%20Services&ProdVer=11.0.3000.0"
xmlns:msrs="Cannot">http://www.microsoft.com/sql/reportingservices">Cannot create a connection to data source 'EntityDataSource'.</Message><MoreInformation><Source>Microsoft.AnalysisServices.AdomdClient</Source><Message></Message><MoreInformation><Source>mscorlib</Source><Message>Access
is denied.
</Message></MoreInformation></MoreInformation></MoreInformation><Warnings xmlns="http://www.microsoft.com/sql/reportingservices" /></detail>

Windows Intergrated Authentication with reverse proxy issue with Safari

Hi All
I having a application which has Windows Integrated Authentication, for Internet users we are having a reverse proxy which has a IIS server which will authenticate using basic authentication then redirected to the actual application, every thing works as expected in IE and firefox but in safari there is a second login dialog box appears. When I did a packet capture using wireshark I noticed that in IE and FF the basic authentication which is carried forward to the actual application from IIS server but in Safari there is a NTLM negotiation in between because there is a 401 response so my application asks for on more login dialog. Dose any one knows why safari is behaving like this?
Thanks & Regards
Karthikeyan Vaithilingam

I found a related post https://discussions.apple.com/thread/3274071?start=0&tstart=0. There is an issue with basic authentication and Http Redirect.

Error while doing sqlplus on middle tier

hi all,
while i am trying to connect to sqlplus from middle tier i am getting this error. please let me know what wrong. thank you
SQL*Plus: Release 10.1.0.4.2 - Production on Mon Sep 15 09:55:08 2008
Copyright (c) 1982, 2005, Oracle. All rights reserved.
ERROR:
ORA-12545: Connect failed because target host or object does not exist
Enter user-name:

ERROR:
ORA-12545: Connect failed because target host or object does not exist
$ oerr ora 12545
12545, 00000, "Connect failed because target host or object does not exist"
// *Cause: The address specified is not valid, or the program being
// connected to does not exist.
// *Action: Ensure the ADDRESS parameters have been entered correctly; the
// most likely incorrect parameter is the node name. Ensure that the
// executable for the server exists (perhaps "oracle" is missing.)
// If the protocol is TCP/IP, edit the TNSNAMES.ORA file to change the
// host name to a numeric IP address and try again.
$ Please post your tnsnames.ora from midtier Home.

Windows Integrated Authentication Help From Middle Tier

Similar Messages

Maybe you are looking for