I would like to make benefit of ADF security features by enabling it in my application, the application's identity store is a database table. How is it possible to let ADF authenticates users based on this identity store?
How are enterprise roles, and application roles mapped to the user defined in database?
I am using WebLogic as a web container.
To use enterprise roles and users from database you need a configuration like described in this blog:
http://soadev.blogspot.co.uk/2010/04/sqlauthenticator-simply-best.html
Every enterprise role name will be automatically converted to Application Role. So you won't need a an explicit mapping.
Related
I'm developing a web application and I'm wondering if i can set the authentication to check the oracle users instead of a user table I that I manually make.
Basically I want this to make it easier to trace user activities using oracle's native logs and add an extra layer to manage permissions.
How to create a new user account in OBIEE 12c? What is LDAP?
enter image description here
I go to Application Roles to create a role.
See: Provider Oracle Database (not LDAP)
Honest answer is "it depends".
OBI comes with a security provider which is embedded inside Weblogic where you can manage users and groups.
I say can because that's an approach which Oracle itself does not suggest for production systems. Pretty much every implementation uses some proper enterprise level LDAP or MS Active Directory which is then configured as an additional security provider for the Weblogic backend.
Best first try to understand how security works and then take your decision based on what is the most appropriate for your use case:
https://youtu.be/JUCZwQOmBn8
I configure store user into database (SQL Server) on bpm suite v6.4.0. How to insert user into database (don't insert by manual), i want know bpm suite v6.4.0 have library support for this doesn't. I don't find document mention this problem.
Thanks for any idea or your help
Authentication/authorization is delegated to an underlying security configuration. I assume you are configuring your security domain to retrieve login information from database? jBPM has some basic user and group mgmt UI (for creating users / groups etc.) that will push these changes to the underlying service. We do have an adapter for RH-SSO so I would recommend to configure your app server to delegate authentication/authorization to RH-SSO, which could be configured to use a database for storing users.
I am not a DBA, and am having a hard time conveying the need for an ACL to allow LDAP authentication from my Oracle Apex instance out to my domain controller, which is mycompany.net port 3268.
Do I need to create the ACL and assign the ACL to the APEX_0400 user, or to the parsing schema of the application I will be using LDAP authentication for. Is it the parsing schema which makes the LDAP request on behalf of the application, or the central APEX_0400 schema.
Or is the ACL something which is created at the instance level, i.e. it may need an owner/principle defining to own the ACL, but the ACL applies to the Oracle instance as a whole and I dont need to grant the ACL to individual Oracle schemas?
Any advice appreciated.
Depends.
Using the built-in LDAP authentication scheme will make it so the apex user will make the calls. Meaning you'll need to grant privileges to the correct APEX_###### user - refer to the documentation for your version on which user this is. (4.2 = APEX_040200, 5 = APEX_050000)
Also read: Enabling Network Services in Oracle Database 11g or Later (Apex 5 Docs)
If you want to make your own calls from the database, you'll need to grant the privilege to that user (too) (usually the parsing schema). For example, you're running some additional queries over LDAP.
Either way: the network ACL was made to increase security. If you want to set the gates wide open to allow all network traffic that's entirely your choice. I've been in a firm where there were many schema's and it's never bothered me to correctly assign the ACL privileges. It's a one-time operation usually and all changes are tracked and in a repo.
If you ever get a security audit, would it fly? Where in the network is the database? What sort of apps are hosted, are they public? Don't remove security in favour of ease-of-use.
I want to add an external JDBC user store to WSO2 Identity Server v3.2.3
WSO2 documentation (http://docs.wso2.org/display/identity/Configuring+an+External+JDBC+User+Store) does not specify how this is done for a custom user schema. An older version of Identity Server supported "Add External User Storage" (or similar) in the management console where one could specify SQL statements for user data queries. However, v3.2.3 does not have this in the UI anymore.
So, is a custom user schema possible or does Identity Server require a fixed user schema?
BR,
Harri
In case your custom schema vastly differs from what we have by default (please see the commented out section in user-mgt.xml) then you need to extend JDBCUserStoreManager and override some of it methods to cater your requirements.