Search Results

Search found 9634 results on 386 pages for 'proxy pattern'.

Page 126/386 | < Previous Page | 122 123 124 125 126 127 128 129 130 131 132 133  | Next Page >

• Data Source Security Part 5

  - by Steve Felts

  If you read through the first four parts of this series on data source security, you should be an expert on this focus area.  There is one more small topic to cover related to WebLogic Resource permissions.  After that comes the test, I mean example, to see with a real set of configuration parameters what the results are with some concrete values. WebLogic Resource Permissions All of the discussion so far has been about database credentials that are (eventually) used on the database side.  WLS has resource credentials to control what WLS users are allowed to access JDBC resources.  These can be defined on the Policies tab on the Security tab associated with the data source.  There are four permissions: “reserve” (get a new connection), “admin”, “shrink”, and reset (plus the all-inclusive “ALL”); we will focus on “reserve” here because we are talking about getting connections.  By default, JDBC resource permissions are completely open – anyone can do anything.  As soon as you add one policy for a permission, then all other users are restricted.  For example, if I add a policy so that “weblogic” can reserve a connection, then all other users will fail to reserve connections unless they are also explicitly added.  The validation is done for WLS user credentials only, not database user credentials.  Configuration of resources in general is described at “Create policies for resource instances” http://docs.oracle.com/cd/E24329_01/apirefs.1211/e24401/taskhelp/security/CreatePoliciesForResourceInstances.html.  This feature can be very useful to restrict what code and users can get to your database. There are the three use cases: API Use database credentials User for permission checking getConnection() True or false Current WLS user getConnection(user,password) False User/password from API getConnection(user,password) True Current WLS user If a simple getConnection() is used or database credentials are enabled, the current user that is authenticated to the WLS system is checked. If database credentials are not enabled, then the user and password on the API are used. Example The following is an actual example of the interactions between identity-based-connection-pooling-enabled, oracle-proxy-session, and use-database-credentials. On the database side, the following objects are configured.- Database users scott; jdbcqa; jdbcqa3- Permission for proxy: alter user jdbcqa3 grant connect through jdbcqa;- Permission for proxy: alter user jdbcqa grant connect through jdbcqa; The following WebLogic Data Source objects are configured.- Users weblogic, wluser- Credential mapping “weblogic” to “scott”- Credential mapping "wluser" to "jdbcqa3"- Data source descriptor configured with user “jdbcqa”- All tests are run with Set Client ID set to true (more about that below).- All tests are run with oracle-proxy-session set to false (more about that below). The test program:- Runs in servlet- Authenticates to WLS as user “weblogic” Use DB Credentials Identity based getConnection(scott,***) getConnection(weblogic,***) getConnection(jdbcqa3,***) getConnection()  true  true Identity scottClient weblogicProxy null weblogic fails - not a db user User jdbcqa3Client weblogicProxy null Default user jdbcqaClient weblogicProxy null  false  true scott fails - not a WLS user User scottClient scottProxy null jdbcqa3 fails - not a WLS user User scottClient scottProxy null  true  false Proxy for scott fails weblogic fails - not a db user User jdbcqa3Client weblogicProxy jdbcqa Default user jdbcqaClient weblogicProxy null  false  false scott fails - not a WLS user Default user jdbcqaClient scottProxy null jdbcqa3 fails - not a WLS user Default user jdbcqaClient scottProxy null If Set Client ID is set to false, all cases would have Client set to null. If this was not an Oracle thin driver, the one case with the non-null Proxy in the above table would throw an exception because proxy session is only supported, implicitly or explicitly, with the Oracle thin driver. When oracle-proxy-session is set to true, the only cases that will pass (with a proxy of "jdbcqa") are the following.1. Setting use-database-credentials to true and doing getConnection(jdbcqa3,…) or getConnection().2. Setting use-database-credentials to false and doing getConnection(wluser, …) or getConnection(). Summary There are many options to choose from for data source security.  Considerations include the number and volatility of WLS and Database users, the granularity of data access, the depth of the security identity (property on the connection or a real user), performance, coordination of various components in the software stack, and driver capabilities.  Now that you have the big picture (remember that table in part 1), you can make a more informed choice.

  Read the article

• find substring and indices in mips

  - by ccc

  im trying find out substring and first occurrence indices. but something wrong. im comparing each element of pattern array and each element of string array until pointer reach to '\0'. and if any characater found it keep in temp array. and increasing pointers +1. whats the problem. algorithm is totaly wrong ? #Note: $v0 is a symbolic name used by the assember for $2. # $a0 is a symbolic name used by the assember for $4. .data prompt_str: .asciiz "Please type a text string: " prompt_ptr: .asciiz "Please type a pattern string: " print_yes: .asciiz "Yes, there is a match." print_no: .asciiz "No, there is no match." text_str: .asciiz "Text string : " pattern_str: .asciiz "Pattern string : " print_out: .asciiz "Output to be produced :" print_dash: .asciiz "----------------------" print_index: .asciiz "Starting index :" print_msg : .asciiz "Length of longest partial match = " nl: .asciiz "\n" str : .space 81 ptr : .space 81 tmp : .space 81 .text main: la $a0, prompt_str li $v0, 4 #print_string command. syscall la $a0,str #read string li $a1,81 li $v0,8 syscall la $t0,str #move string to $t0 la $a0,prompt_ptr li $v0,4 #print pattern command syscall la $a0,ptr #read pattern li $a1,81 li $v0,8 syscall la $t1,ptr #move pattern to $t1 la $t5,tmp #move temp to $t5 lb $t2,0($t0) #pointer first element array of string lb $t3,0($t1) #pointer first element array of pattern lb $t6,0($t5) #pointer first element array of temp loop : beq $t3,$0,end_loop beq $t2,$t3,match addiu $t0,$t0,1 j loop match : move $t6,$t2 addiu $t5,$t5,1 addiu $t0,$t0,1 addiu $t1,$t1,1 j print_match print_match : la $a0,text_str #print string li $v0,4 syscall move $a0,$t0 li $v0,4 syscall la $a0,nl #print newline character li $v0,4 syscall la $a0,pattern_str #print pattern string li $v0,4 syscall move $a0,$t1 li $v0,4 syscall la $a0,nl #print newline character li $v0,4 syscall la $a0,print_out #print output line and newline character li $v0,4 syscall la $a0,nl li $v0,4 syscall la $a0,print_dash li $v0,4 syscall la $a0,print_yes li $v0,4 syscall la $a0,print_index #print starting index li $v0,4 syscall li $v0,10 syscall end_loop : li $v0,10 syscall

  Read the article

• grep --exclude/--include syntax (do not grep through certain files)

  - by Piskvor

  I'm looking for the string "foo=" (without quotes) in text files in a directory tree. It's on a common Linux machine, I have bash shell: grep -ircl "foo=" * In the directories are also many binary files which match "foo=". As these results are not relevant and slow down the search, I want grep to skip searching these files (mostly JPEG and PNG images): how would I do that? I know there are the --exclude=PATTERN and --include=PATTERN options, but what is the pattern format? manpage of grep says: --include=PATTERN Recurse in directories only searching file matching PATTERN. --exclude=PATTERN Recurse in directories skip file matching PATTERN. Searching on grep include, grep include exclude, grep exclude and variants did not find anything relevant If there's a better way of grepping only in certain files, I'm all for it; moving the offending files is not an option, I can't search only certain directories (the directory structure is a big mess, with everything everywhere). Also, I can't install anything, so I have to do with common tools (like grep or the suggested find). UPDATES: @Adam Rosenfield's answer is just what I was looking for: grep -ircl --exclude=*.{png,jpg} "foo=" * @rmeador's answer is also a good solution: grep -Ir --exclude="*\.svn*" "pattern" * It searches recursively, ignores binary files, and doesn't look inside Subversion hidden folders.(...)

  Read the article

• Use RegEx in Java to extract parameters in between parentheses

  - by lars_bx

  I'm writing a utility to extract the names of header files from JSPs. I have no problem reading the JSPs line by line and finding the lines I need. I am having a problem extracting the specific text needed using regex. After looking at many similar questions I'm hitting a brick wall. An example of the String I'll be matching from within is: <jsp:include page="<%=Pages.getString(\"MY_HEADER\")%>" flush="true"></jsp:include> All I need is MY_HEADER for this example. Any time I have this tag: <%=Pages.getString I need what comes between this: <%=Pages.getString(\" and this: )%> Here is what I have currently (which is not working, I might add) : String currentLine; while ((currentLine = fileReader.readLine()) != null) { Pattern pattern = Pattern.compile("<%=Pages\\.getString\\(\\\\\"([^\\\\]*)"); Matcher matcher = pattern.matcher(currentLine); while(matcher.find()) { System.out.println(matcher.group(1).toString()); }} I need to be able to use the Java RegEx API and regex to extract those header names. Any help on this issue is greatly appreciated. Thanks! EDIT: Resolved this issue, thankfully. The tricky part was, after being given the right regex, it had to be taken into account that the String I was feeding to the regex was always going to have two " / " characters ( (/"MY_HEADER"/) ) that needed to be escaped in the pattern. Here is what worked (thanks to the help ;-)): Pattern pattern = Pattern.compile("<%=Pages\\.getString\\(\\\\\"([^\\\\\"]*)");

  Read the article

• WCF MessageHeaders in OperationContext.Current

  - by Nate Bross

  If I use code like this [just below] to add Message Headers to my OperationContext, will all future out-going messages contain that data on any new ClientProxy defined from the same "run" of my application? The objective, is to pass a parameter or two to each OpeartionContract w/out messing with the signature of the OperationContract, since the parameters being passed will be consistant for all requests for a given run of my client application. public void DoSomeStuff() { var proxy = new MyServiceClient(); Guid myToken = Guid.NewGuid(); MessageHeader<Guid> mhg = new MessageHeader<Guid>(myToken); MessageHeader untyped = mhg.GetUntypedHeader("token", "ns"); OperationContext.Current.OutgoingMessageHeaders.Add(untyped); proxy.DoOperation(...); } public void DoSomeOTHERStuff() { var proxy = new MyServiceClient(); Guid myToken = Guid.NewGuid(); MessageHeader<Guid> mhg = new MessageHeader<Guid>(myToken); MessageHeader untyped = mhg.GetUntypedHeader("token", "ns"); OperationContext.Current.OutgoingMessageHeaders.Add(untyped); proxy.DoOtherOperation(...); } In other words, is it safe to refactor the above code like this? bool isSetup = false; public void SetupMessageHeader() { if(isSetup) { return; } Guid myToken = Guid.NewGuid(); MessageHeader<Guid> mhg = new MessageHeader<Guid>(myToken); MessageHeader untyped = mhg.GetUntypedHeader("token", "ns"); OperationContext.Current.OutgoingMessageHeaders.Add(untyped); isSetup = true; } public void DoSomeStuff() { var proxy = new MyServiceClient(); SetupMessageHeader(); proxy.DoOperation(...); } public void DoSomeOTHERStuff() { var proxy = new MyServiceClient(); SetupMessageHeader(); proxy.DoOtherOperation(...); } Since I don't really understand what's happening there, I don't want to cargo cult it and just change it and let it fly if it works, I'd like to hear your thoughts on if it is OK or not.

  Read the article

• Exclude css & image resources in web.xml Security Constraint

  - by Tiggles

  I am using JSF2.1 and Glassfish 3.1.2. I specify a security constraint to block everything: <security-constraint> <web-resource-collection> <web-resource-name>Secured Content</web-resource-name> <!-- Block all --> <url-pattern>/*</url-pattern> </web-resource-collection> <!-- only users with at least one of these roles are allowed to access the secured content --> <auth-constraint> <role-name>ADMINISTRATOR</role-name> </auth-constraint> </security-constraint> and have another to allow access a subset of pages and the resources: <security-constraint> <web-resource-collection> <web-resource-name>Open Content</web-resource-name> <!-- Allow subscribe --> <url-pattern>/subscribe/*</url-pattern> <url-pattern>/javax.faces.resource/*</url-pattern> </web-resource-collection> <!-- No Auth Contraint! --> </security-constraint> This works fine. However, is the following <url-pattern>/javax.faces.resource/*</url-pattern> the correct way to allow all resources? I only did this by looking at the url that Facelets injects into the xhtml. Is there security holes with this approach? Thanks.

  Read the article

• Using java.util.regex in Android apps - are there issues with this?

  - by johnrock

  In an Android app I have a utility class that I use to parse strings for 2 regEx's. I compile the 2 patterns in a static initializer so they only get compiled once, then activities can use the parsing methods statically. This works fine except that the first time the class is accessed and loaded, and the static initializer compiles the pattern, the UI hangs for close to a MINUTE while it compiles the pattern! After the first time, it flies on all subsequent calls to parseString(). My regEx that I am using is rather large - 847 characters, but in a normal java webapp this is lightning fast. I am testing this so far only in the emulator with a 1.5 AVD. Could this just be an emulator issue or is there some other reason that this pattern is taking so long to compile? private static final String exp1 = "(insertratherlong---847character--regexhere)"; private static Pattern regex1 = null; private static final String newLineAndTagsExp = "[<>\\s]"; private static Pattern regexNewLineAndTags = null; static { regex1 = Pattern.compile(exp1, Pattern.CASE_INSENSITIVE); regexNewLineAndTags = Pattern.compile(newLineAndTagsExp); } public static String parseString(CharSequence inputStr) { String replacementStr = "replaceMentText"; String resultString = "none"; try { Matcher regexMatcher = regex1.matcher(inputStr); try { resultString = regexMatcher.replaceAll(replacementStr); } catch (IllegalArgumentException ex) { } catch (IndexOutOfBoundsException ex) { } } catch (PatternSyntaxException ex) { } return resultString; }

  Read the article

• web.xml : URL mapping

  - by Devashish Dixit

  I have these two lines in my web.xml <url-pattern>/</url-pattern> : Index Servletand <url-pattern>/login</url-pattern> : Login Servlet but whem I open http://localhost:8084/login/, it goes to Index Servlet and when I open http://localhost:8084/login, it goes to Login Servlet. Is there any difference in http://localhost:8084/login/ and http://localhost:8084/login? My web.xml <servlet> <servlet-name>Index</servlet-name> <servlet-class>Index</servlet-class> </servlet> <servlet> <servlet-name>Login</servlet-name> <servlet-class>Login</servlet-class> </servlet> and <servlet-mapping> <servlet-name>Index</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping> <servlet-mapping> <servlet-name>Login</servlet-name> <url-pattern>/login</url-pattern> </servlet-mapping>

  Read the article

• Configuring nginx to check for hard files in only a few directories,

  - by Evan Carroll

  For a node.js project I'm doing, I have a tree like this. +-- public ¦   +-- components ¦   +-- css ¦   +-- img +-- routes +-- views Essentially, I have the root to be set to public. I want all requests destined to /components/ /css/ /img/ To check to see if their appropriate destinations exist on disk. However, I don't want requests to other directories to even run an IO operation, /foo/asdf /bar /baz/index.html None of those should result in the disk being touched. I have a stansa that does the proxy to node.js, location @proxy { internal; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-NginX-Proxy true; proxy_pass http://localhost:3030; proxy_redirect off; } I just would like to know how to arrange this. My problem would be easily solved if try_files took a single argument, but it always wants a file first. location /components/ { try_files $uri, @proxy } location /css/ { try_files $uri, @proxy } location /img/ { try_files $uri, @proxy } However, there is nothing that I can find that will give me, location / { try_files @proxy } How do I get the effect I want?

  Read the article

• HttpContext.Items and Server.Transfer/Execute

  - by Rick Strahl

  A few days ago my buddy Ben Jones pointed out that he ran into a bug in the ScriptContainer control in the West Wind Web and Ajax Toolkit. The problem was basically that when a Server.Transfer call was applied the script container (and also various ClientScriptProxy script embedding routines) would potentially fail to load up the specified scripts. It turns out the problem is due to the fact that the various components in the toolkit use request specific singletons via a Current property. I use a static Current property tied to a Context.Items[] entry to handle this type of operation which looks something like this: /// <summary> /// Current instance of this class which should always be used to /// access this object. There are no public constructors to /// ensure the reference is used as a Singleton to further /// ensure that all scripts are written to the same clientscript /// manager. /// </summary> public static ClientScriptProxy Current { get { if (HttpContext.Current == null) return new ClientScriptProxy(); ClientScriptProxy proxy = null; if (HttpContext.Current.Items.Contains(STR_CONTEXTID)) proxy = HttpContext.Current.Items[STR_CONTEXTID] as ClientScriptProxy; else { proxy = new ClientScriptProxy(); HttpContext.Current.Items[STR_CONTEXTID] = proxy; } return proxy; } } The proxy is attached to a Context.Items[] item which makes the instance Request specific. This works perfectly fine in most situations EXCEPT when you’re dealing with Server.Transfer/Execute requests. Server.Transfer doesn’t cause Context.Items to be cleared so both the current transferred request and the original request’s Context.Items collection apply. For the ClientScriptProxy this causes a problem because script references are tracked on a per request basis in Context.Items to check for script duplication. Once a script is rendered an ID is written into the Context collection and so considered ‘rendered’: // No dupes - ref script include only once if (HttpContext.Current.Items.Contains( STR_SCRIPTITEM_IDENTITIFIER + fileId ) ) return; HttpContext.Current.Items.Add(STR_SCRIPTITEM_IDENTITIFIER + fileId, string.Empty); where the fileId is the script name or unique identifier. The problem is on the Transferred page the item will already exist in Context and so fail to render because it thinks the script has already rendered based on the Context item. Bummer. The workaround for this is simple once you know what’s going on, but in this case it was a bitch to track down because the context items are used in many places throughout this class. The trick is to determine when a request is transferred and then removing the specific keys. The first issue is to determine if a script is in a Trransfer or Execute call: if (HttpContext.Current.CurrentHandler != HttpContext.Current.Handler) Context.Handler is the original handler and CurrentHandler is the actual currently executing handler that is running when a Transfer/Execute is active. You can also use Context.PreviousHandler to get the last handler and chain through the whole list of handlers applied if Transfer calls are nested (dog help us all for the person debugging that). For the ClientScriptProxy the full logic to check for a transfer and remove the code looks like this: /// <summary> /// Clears all the request specific context items which are script references /// and the script placement index. /// </summary> public void ClearContextItemsOnTransfer() { if (HttpContext.Current != null) { // Check for Server.Transfer/Execute calls - we need to clear out Context.Items if (HttpContext.Current.CurrentHandler != HttpContext.Current.Handler) { List<string> Keys = HttpContext.Current.Items.Keys.Cast<string>().Where(s => s.StartsWith(STR_SCRIPTITEM_IDENTITIFIER) || s == STR_ScriptResourceIndex).ToList(); foreach (string key in Keys) { HttpContext.Current.Items.Remove(key); } } } } along with a small update to the Current property getter that sets a global flag to indicate whether the request was transferred: if (!proxy.IsTransferred && HttpContext.Current.Handler != HttpContext.Current.CurrentHandler) { proxy.ClearContextItemsOnTransfer(); proxy.IsTransferred = true; } return proxy; I know this is pretty ugly, but it works and it’s actually minimal fuss without affecting the behavior of the rest of the class. Ben had a different solution that involved explicitly clearing out the Context items and replacing the collection with a manually maintained list of items which also works, but required changes through the code to make this work. In hindsight, it would have been better to use a single object that encapsulates all the ‘persisted’ values and store that object in Context instead of all these individual small morsels. Hindsight is always 20/20 though :-}. If possible use Page.Items ClientScriptProxy is a generic component that can be used from anywhere in ASP.NET, so there are various methods that are not Page specific on this component which is why I used Context.Items, rather than the Page.Items collection.Page.Items would be a better choice since it will sidestep the above Server.Transfer nightmares as the Page is reloaded completely and so any new Page gets a new Items collection. No fuss there. So for the ScriptContainer control, which has to live on the page the behavior is a little different. It is attached to Page.Items (since it’s a control): /// <summary> /// Returns a current instance of this control if an instance /// is already loaded on the page. Otherwise a new instance is /// created, added to the Form and returned. /// /// It's important this function is not called too early in the /// page cycle - it should not be called before Page.OnInit(). /// /// This property is the preferred way to get a reference to a /// ScriptContainer control that is either already on a page /// or needs to be created. Controls in particular should always /// use this property. /// </summary> public static ScriptContainer Current { get { // We need a context for this to work! if (HttpContext.Current == null) return null; Page page = HttpContext.Current.CurrentHandler as Page; if (page == null) throw new InvalidOperationException(Resources.ERROR_ScriptContainer_OnlyWorks_With_PageBasedHandlers); ScriptContainer ctl = null; // Retrieve the current instance ctl = page.Items[STR_CONTEXTID] as ScriptContainer; if (ctl != null) return ctl; ctl = new ScriptContainer(); page.Form.Controls.Add(ctl); return ctl; } } The biggest issue with this approach is that you have to explicitly retrieve the page in the static Current property. Notice again the use of CurrentHandler (rather than Handler which was my original implementation) to ensure you get the latest page including the one that Server.Transfer fired. Server.Transfer and Server.Execute are Evil All that said – this fix is probably for the 2 people who are crazy enough to rely on Server.Transfer/Execute. :-} There are so many weird behavior problems with these commands that I avoid them at all costs. I don’t think I have a single application that uses either of these commands… Related Resources Full source of ClientScriptProxy.cs (repository) Part of the West Wind Web Toolkit Static Singletons for ASP.NET Controls Post © Rick Strahl, West Wind Technologies, 2005-2010Posted in ASP.NET  

  Read the article

• Single click handler for all buttons in Javascript? Is it a pattern? Whats the benefit?

  - by Hasan Khan

  I have been told that when there are multiple buttons on the page for same purpose but targeting different item e.g. delete item on a grid of items, they say it is recommended to just register for click handler only on the top most element like 'body' and check what was clicked instead of hooking up click with every delete button. Whats the benefit of this? Creating more handlers causes problems? Is it an optimization of some sort? Is it a pattern? Does it have anything to do with performance? Where can I read more about it?

  Read the article

• Why does this mod_rewrite rule 'not-match'? (big rewrite log included)

  - by Christopher

  I've got a scenario involving two domains: WordPress site hosted on domain1.com domain2.co.uk, simply redirecting users to domain1 via mod_rewrite This rule applies irrespective of whether www. is specified or not. (It's eventually removed from the URL, I'm a no-WWW fan.) There's nothing on domain2.co.uk at all except for an .htaccess with some mod_rewrite rules. However, I want to be able to allow users to be redirected to the correct article URI even if they specify the "wrong" URL (i.e., a 301 redirect preserving the stuff after the first forward slash). I'm currently achieving this with this ruleset: RewriteCond %{HTTP_HOST} ^((www\.)?[^\.]+)\.domain2\.co\.uk [NC,OR] RewriteCond %{HTTP_HOST} ^domain2\.co\.uk [NC] RewriteRule ^(.*)$ http://domain1.com/$1 [R=301,L] This works but is uglier than I want it to be. I'm not a mod_rewrite zen master, but from what I can tell the top rule should match irrespective of whether www. is specified... But it doesn't. In order to catch www-less requests, I need the second RewriteCond. From the rewrite log, with just the first RewriteCond: [domain2.co.uk/sid#e200498][rid#e670168/initial] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] strip per-dir prefix: /home/devnull/domains/domain2.co.uk/public_html/ -> [domain2.co.uk/sid#e200498][rid#e670168/initial] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] applying pattern '^(.*)$' to uri '' [domain2.co.uk/sid#e200498][rid#e670168/initial] (4) [perdir /home/devnull/domains/domain2.co.uk/public_html/] RewriteCond: input='domain2.co.uk' pattern='^((www\.)|[^\.]+)\.domain2\.co\.uk' [NC] => not-matched [domain2.co.uk/sid#e200498][rid#e670168/initial] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/ [domain2.co.uk/sid#e200498][rid#e653868/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.html [domain2.co.uk/sid#e200498][rid#e65f8b8/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.htm [domain2.co.uk/sid#e200498][rid#e653868/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.shtml [domain2.co.uk/sid#e200498][rid#e65f8b8/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.php [domain2.co.uk/sid#e200498][rid#e653868/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.php5 [domain2.co.uk/sid#e200498][rid#e666c98/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.php4 [domain2.co.uk/sid#e200498][rid#e65f8b8/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.php3 [domain2.co.uk/sid#e200498][rid#e653868/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.phtml [domain2.co.uk/sid#e200498][rid#e65f8b8/subreq] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/index.cgi [domain2.co.uk/sid#e200498][rid#e66c370/initial/redir#1] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] strip per-dir prefix: /home/devnull/domains/domain2.co.uk/public_html/403.shtml -> 403.shtml [domain2.co.uk/sid#e200498][rid#e66c370/initial/redir#1] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] applying pattern '^(.*)$' to uri '403.shtml' [domain2.co.uk/sid#e200498][rid#e66c370/initial/redir#1] (4) [perdir /home/devnull/domains/domain2.co.uk/public_html/] RewriteCond: input='domain2.co.uk' pattern='^((www\.)|[^\.]+)\.domain2\.co\.uk' [NC] => not-matched [domain2.co.uk/sid#e200498][rid#e66c370/initial/redir#1] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/403.shtml [domain2.co.uk/sid#e200498][rid#e668ca8/initial] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] strip per-dir prefix: /home/devnull/domains/domain2.co.uk/public_html/favicon.ico -> favicon.ico [domain2.co.uk/sid#e200498][rid#e668ca8/initial] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] applying pattern '^(.*)$' to uri 'favicon.ico' [domain2.co.uk/sid#e200498][rid#e668ca8/initial] (4) [perdir /home/devnull/domains/domain2.co.uk/public_html/] RewriteCond: input='domain2.co.uk' pattern='^((www\.)|[^\.]+)\.domain2\.co\.uk' [NC] => not-matched [domain2.co.uk/sid#e200498][rid#e668ca8/initial] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/favicon.ico [domain2.co.uk/sid#e200498][rid#f160b40/initial/redir#1] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] strip per-dir prefix: /home/devnull/domains/domain2.co.uk/public_html/404.shtml -> 404.shtml [domain2.co.uk/sid#e200498][rid#f160b40/initial/redir#1] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] applying pattern '^(.*)$' to uri '404.shtml' [domain2.co.uk/sid#e200498][rid#f160b40/initial/redir#1] (4) [perdir /home/devnull/domains/domain2.co.uk/public_html/] RewriteCond: input='domain2.co.uk' pattern='^((www\.)|[^\.]+)\.domain2\.co\.uk' [NC] => not-matched [domain2.co.uk/sid#e200498][rid#f160b40/initial/redir#1] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] pass through /home/devnull/domains/domain2.co.uk/public_html/404.shtml However with the second RewriteCond added, the rule works, and the logs show this: [domain2.co.uk/sid#e200498][rid#e65fe58/initial] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] strip per-dir prefix: /home/devnull/domains/domain2.co.uk/public_html/ -> [domain2.co.uk/sid#e200498][rid#e65fe58/initial] (3) [perdir /home/devnull/domains/domain2.co.uk/public_html/] applying pattern '^(.*)$' to uri '' [domain2.co.uk/sid#e200498][rid#e65fe58/initial] (4) [perdir /home/devnull/domains/domain2.co.uk/public_html/] RewriteCond: input='domain2.co.uk' pattern='^((www\.)?[^\.]+)\.domain2\.co\.uk' [NC] => not-matched [domain2.co.uk/sid#e200498][rid#e65fe58/initial] (4) [perdir /home/devnull/domains/domain2.co.uk/public_html/] RewriteCond: input='domain2.co.uk' pattern='^domain2\.co\.uk' [NC] => matched [domain2.co.uk/sid#e200498][rid#e65fe58/initial] (2) [perdir /home/devnull/domains/domain2.co.uk/public_html/] rewrite '' -> 'http://domain1.com/' [domain2.co.uk/sid#e200498][rid#e65fe58/initial] (2) [perdir /home/devnull/domains/domain2.co.uk/public_html/] explicitly forcing redirect with http://domain1.com/ [domain2.co.uk/sid#e200498][rid#e65fe58/initial] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] escaping http://domain1.com/ for redirect [domain2.co.uk/sid#e200498][rid#e65fe58/initial] (1) [perdir /home/devnull/domains/domain2.co.uk/public_html/] redirect to http://domain1.com/ [REDIRECT/301] Can anybody help me figure out why it just won't work with the one rule? I feel like I'm missing the bleeding obvious, and while the second RewriteCond is a valid workaround, it's a kludge and that annoys me. ;-) All help appreciated...

  Read the article

• Should I be using the command pattern? Seems like a lot of work...

  - by Fedor

  My Room class has a lot of methods I used before I decided to use the command pattern. Previously, I was invoking a lot of commands and now it seems I have to make a method in my roomParser class for every method. If I wanted to invoke say, setHotelCode I would have to create a method in roomParser that iterates through and invokes the method. Is this the way I should be using the command pattern? <?php interface Parseable { public function parse( $arr, $dept ); } class Room implements Parseable { protected $_adults; protected $_kids; protected $_startDate; protected $_endDate; protected $_hotelCode; protected $_sessionNs; protected $_minRate; protected $_maxRate; protected $_groupCode; protected $_rateCode; protected $_promoCode; protected $_confCode; protected $_currency = 'USD'; protected $_soapAction; protected $_soapHeaders; protected $_soapServer; protected $_responseXml; protected $_requestXml; public function __construct( $startdate,$enddate,$rooms=1,$adults=2,$kids=0 ) { $this->setNamespace(SESSION_NAME); $this->verifyDates( $startdate, $enddate ); $this->_rooms= $rooms; $this->_adults= $adults; $this->_kids= $kids; $this->setSoapAction(); $this->setRates(); } public function parse( $arr, $dept ) { $this->_price = $arr * $dept * rand(); return $this; } public function setNamespace( $namespace ) { $this->_sessionNs = $namespace; } private function verifyDates( $startdate, $enddate ) {} public function setSoapAction( $str= 'CheckAvailability' ) { $this->_soapAction = $str; } public function setRates( $rates='' ) { } public function setHotelCode($code ) { $this->_hotelCode = $code; } private function getSoapHeader() { return '<?xml version="1.0" encoding="utf-8"?> <soap:Header> </soap:Header>'; } private function getSoapFooter() { return '</soap:Envelope>'; } private function getSource() { return '<POS> <Source><RequestorId ID="" ID_Context="" /></Source> </POS>'; } function requestXml() { $this->_requestXml = $this->getSoapHeader(); $this->_requestXml .='<soap:Body></soap:Body>'; return $this->_requestXml; } private function setSoapHeaders ($contentLength) { $this->_soapHeaders = array('POST /url HTTP/1.1', 'Host: '.SOAP_HOST, 'Content-Type: text/xml; charset=utf-8', 'Content-Length: '.$contentLength); } } class RoomParser extends SplObjectStorage { public function attach( Parseable $obj ) { parent::attach( $obj ); } public function parseRooms( $arr, $dept ) { for ( $this->rewind(); $this->valid(); $this->next() ) { $ret = $this->current()->parse( $arr, $dept ); echo $ret->getPrice(), PHP_EOL; } } } $arrive = '12/28/2010'; $depart = '01/02/2011'; $rooms = new RoomParser( $arrive, $depart); $rooms->attach( new Room( '12/28/2010', '01/02/2011') ); $rooms->attach( new Room( '12/29/2010', '01/04/2011') ); echo $rooms->count(), ' Rooms', PHP_EOL; Edit: I'm thinking it may be easier if I made the RoomParser less generic by storing properties that all the objects will share. Though I'll probably have to make methods if I want to override for a certain object.

  Read the article

• Timeout Considerations for Solicit Response

  - by Michael Stephenson

  Background One of the clients I work with had been experiencing some issues for a while surrounding web service timeouts.  It's been a little challenging to work through the problems due to limitations in the diagnostic information available from one of the applications, but I learned some interesting things while troubleshooting the problem which don't seem to have been discussed much in the community so I thought I'd share my findings. In the scenario we have BizTalk trying to make calls to a .net web service which was exposed as a WSE 2 endpoint.  In the process BizTalk will try to make a large number of concurrent web service calls to the application, and the backend application has more than enough infrastructure and capability to handle the load. We have configured the <ConnectionManagement> section of the BizTalk configuration file to support up to 100 concurrent connections from each of our 2 BizTalk send servers to the web servers of the application. The problem we were facing was that the BizTalk side was reporting a significant number of timeouts when calling the web service.   One of the biggest issues was the challenge of being able to correlate a message from BizTalk to the IIS log in the .net application and the custom logs in the application especially when there was a fairly large number of servers hosting the web services.  However the key moment came when we were able to identify a specific call which had taken 40 seconds to execute on the server (yes a long time I know but that's a different story!).  Anyway we were able to identify that this had timed out on the BizTalk side.  Based on the normal 2 minute timeout we knew something unexpected was going on. From here I decided to do some experimentation and I wanted to start outside of BizTalk because my hunch was this was not a BizTalk behaviour but something which was being highlighted by BizTalk because of our large load.     Server-side - Sample Web Service To begin with I created a sample web service.  Nothing special just a vanilla asmx web service hosted in IIS6 on Windows 2003 Standard Edition.  The web service is just a hello world style web service as shown in the below picture.  The only key feature is that the server side web method has a 30 second sleep in it and will trace out some information before and after the thread is set to sleep.      In the configuration for this web service there again is nothing special it's pretty much the most plain simple web service you could build. Client-Side To begin looking at what was happening with our example I created a number of different ways to consume the web service. SoapHttpClientProtocol Example I created a small application which would use a normal proxy generated to call the web service.  It would iterate around a loop and make calls using the begin/end methods so I can do this asynchronously.  I would do a loop of 20 calls with the ConnectionManager configuration section supporting only 5 concurrent connections to the server.     <connectionManagement> <remove address="*"/> <add address = "*" maxconnection = "12" /> <add address = "http://<ServerName>" maxconnection = "5" />                         </connectionManagement> </system.net>     The below picture shows an example of the service calling code, key points are: I have configured the timeout of 40 seconds for the proxy I am using the asynchronous methods on the proxy to call the web service         The Test I would run the client and execute 21 calls to the web service.   The Results  Below is the client side trace showing what's happening on the client. In the below diagram is the web service side trace showing what's happening on the server Some observations on the results are: All of the calls were successful from the clients perspective You could see the next call starting on the server as soon as the previous one had completed Calls took significantly longer than 40 seconds from the start of our call to the return. In fact call 20 took 2 minutes and 30 seconds from the perspective of my code to execute even though I had set the timeout to 40 seconds     WSE 2 Sample In the second example I used the exact same code to call the web service again with a single exception that I modified the web service proxy to derive from WebServiceClient protocol which is part of WSE 2 (using SP3).  The below picture shows the basic code and the key points are: I have configured the timeout of 40 seconds for the proxy I am using the asynchronous methods on the proxy to call the web service        The Test This test would execute 21 calls from the client to the web service.   The Results  The below trace is from the client side: The below trace is from the server side:   Some observations on the trace results for this scenario are: With call 4 if you look at the server side trace it did not start executing on the server for a number of seconds after the other 4 initial calls which were accepted by the server. I re-ran the test and this happened a couple of times and not on most others so at this point I'm just putting this down to something unexpected happening on the development machine and we will leave this observation out of scope of this article. You can see that the client side trace statement executed almost immediately in all cases All calls after the initial few calls would timeout On the client side the calls that did timeout; timed out in a longer duration than the 40 seconds we set as the timeout You can see that as calls were completing on the server the next calls were starting to come through The calls that timed out on the client did actually connect to the server and their server side execution completed successfully     Elaboration on the findings Based on the above observations I have drawn the below sequence diagram to illustrate conceptually what is happening.  Everything except the final web service object is on the client side of the call. In the diagram below I've put two notes on the Web Service Proxy to show the two different places where the different base classes seem to start their timeout counters. From the earlier samples we can work out that the timeout counter for the WSE web service proxy starts before the one for the SoapHttpClientProtocol proxy and the WSE one includes the time to get a connection from the pool; whereas the Soap proxy timeout just covers the method execution. One interesting observation is if we rerun the above sample and increase the number of calls from 21 to 100,000 then for the WSE sample we will see a similar pattern where everything after the first few calls will timeout on the client as soon as it makes a connection to the server whereas the soap proxy will happily plug away and process all of the calls without a single timeout. I have actually set the sample running overnight and this did happen. At this point you are probably thinking the same thoughts I was at the time about the differences in behaviour and which is right and why are they different? I'm not sure there is a definitive answer to this in the documentation, or at least not that I could find! I think you just have to consider that they are different and they could have different effects depending on your messaging solution. In lots of situations this is just not an issue as your concurrent requests doesn't get to the situation where you end up throttling the web service calls on the client side, however this is definitely more common with an integration broker such as BizTalk where you often have high throughput requirements.  Some of the considerations you should make Based on this behaviour you should be aware of the following: In a .net application if you are making lots of concurrent web service calls from an application in an asynchronous manner your user may thing they are experiencing poor performance but you think your web service is working well. The problem could be that the client will have a default of 2 connections to remote servers so you should bear this in mind When you are developing a BizTalk solution or a .net solution with the WSE 2 stack you may experience timeouts under load and throttling the number of connections using the max connections element in the configuration file will not help you For an application using WSE2 or SoapHttpClientProtocol an expired timeout will not throw an error until after a connection to the server has been made so you should consider this in your transaction and durability patterns     Our Work Around In the short term for our specific scenario we know that we can handle this by just increasing our timeout value.  There is only a specific small window when we get lots of concurrent traffic that causes this scenario so we should be able to increase the timeout to take into consideration the additional client side wait, and on the odd occasion where we do get a timeout the BizTalk send port retry will handle this. What was causing our original problem was that for that short window we were getting a lot of retries which significantly increased the load on our send servers and highlighted the issue.  Longer Term Solution As a longer term solution this really gives us more ammunition to argue a migration to WCF. The application we are calling has some factors which limit the protocols we can use but with WCF we would have more control on the various timeout options because in WCF you can configure specific parts of the timeout. Summary I've had this blog post on my to do list for ages but hopefully it will be useful to some people to just understand this behaviour and to possibly help you with some performance issues you may have. I do not believe there is too much in the way of documentation particularly around WSE2 and ASMX in this area so again another bit of ammunition for migrating to WCF. I'll try to do a follow up post with the sample for WCF to show how this changes things.

  Read the article

• Quick guide to Oracle IRM 11g: Configuring SSL

  - by Simon Thorpe

  Quick guide to Oracle IRM 11g index So far in this guide we have an IRM Server up and running, however I skipped over SSL configuration in the previous article because I wanted to focus in more detail now. You can, if you wish, not bother with setting up SSL, but considering this is a security technology it is worthwhile doing. Contents Setting up a one way, self signed SSL certificate in WebLogic Setting up an official SSL certificate in Apache 2.x Configuring Apache to proxy traffic to the IRM server There are two common scenarios in which an Oracle IRM server is configured. For a development or evaluation system, people usually communicate directly to the WebLogic Server running the IRM service. However in a production environment and for some proof of concept evaluations that require a setup reflecting a production system, the traffic to the IRM server travels via a web server proxy, commonly Apache. In this guide we are building an Oracle Enterprise Linux based IRM service and this article will go over the configuration of SSL in WebLogic and also in Apache. Like in the past articles, we are going to use two host names in the configuration below,irm.company.com will refer to the public Apache server irm.company.internal will refer to the internal WebLogic IRM server Setting up a one way, self signed SSL certificate in WebLogic First lets look at creating just a simple self signed SSL certificate to be used in WebLogic. This is a quick and easy way to get SSL working in your environment, however the downside is that no browsers are going to trust this certificate you create and you'll need to manually install the certificate onto any machine's communicating with the server. This is fine for development or when you have only a few users evaluating the system, but for any significant use it's usually better to have a fully trusted certificate in use and I explain that in the next section. But for now lets go through creating, installing and testing a self signed certificate. We use a library in Java to create the certificates, open a console and running the following commands. Note you should choose your own secure passwords whenever you see password below. [oracle@irm /] source /oracle/middleware/wlserver_10.3/server/bin/setWLSEnv.sh [oracle@irm /] cd /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/ [oracle@irm /] java utils.CertGen -selfsigned -certfile MyOwnSelfCA.cer -keyfile MyOwnSelfKey.key -keyfilepass password -cn "irm.oracle.demo" [oracle@irm /] java utils.ImportPrivateKey -keystore MyOwnIdentityStore.jks -storepass password -keypass password -alias trustself -certfile MyOwnSelfCA.cer.pem -keyfile MyOwnSelfKey.key.pem -keyfilepass password [oracle@irm /] keytool -import -trustcacerts -alias trustself -keystore TrustMyOwnSelf.jks -file MyOwnSelfCA.cer.der -keyalg RSA We now have two Java Key Stores, MyOwnIdentityStore.jks and TrustMyOwnSelf.jks. These contain keys and certificates which we will use in WebLogic Server. Now we need to tell the IRM server to use these stores when setting up SSL connections for incoming requests. Make sure the Admin server is running and login into the WebLogic Console at http://irm.company.intranet:7001/console and do the following; In the menu on the left, select the + next to Environment to expose the submenu, then click on Servers. You will see two servers in the list, AdminServer(admin) and IRM_server1. If the IRM server is running, shut it down either by hitting CONTROL + C in the console window it was started from, or you can switch to the CONTROL tab, select IRM_server1 and then select the Shutdown menu and then Force Shutdown Now. In the Configuration tab select IRM_server1 and switch to the Keystores tab. By default WebLogic Server uses it's own demo identity and trust. We are now going to switch to the self signed one's we've just created. So select the Change button and switch to Custom Identity and Custom Trust and hit save. Now we have to complete the resulting fields, the setting's i've used in my evaluation server are below. IdentityCustom Identity Keystore: /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/MyOwnIdentityStore.jks Custom Identity Keystore Type: JKS Custom Identity Keystore Passphrase: password Confirm Custom Identity Keystore Passphrase: password TrustCustom Trust Keystore: /oracle/middleware/user_projects/domains/irm_domain/config/fmwconfig/TrustMyOwnSelf.jks Custom Trust Keystore Type: JKS Custom Trust Keystore Passphrase: password Confirm Custom Trust Keystore Passphrase: password Now click on the SSL tab for the IRM_server1 and enter in the alias and passphrase, in my demo here the details are; IdentityPrivate Key Alias: trustself Private Key Passphrase: password Confirm Private Key Passphrase: password And hit save. Now lets test a connection to the IRM server over HTTPS using SSL. Go back to a console window and start the IRM server, a quick reminder on how to do this is... [oracle@irm /] cd /oracle/middleware/user_projects/domains/irm_domain/bin [oracle@irm /] ./startManagedWeblogic IRM_server1 Once running, open a browser and head to the SSL port of the server. By default the IRM server will be listening on the URL https://irm.company.intranet:16101/irm_rights. Note in the example image on the right the port is 7002 because it's a system that has the IRM services installed on the Admin server, this isn't typical (or advisable). Your system is going to have a separate managed server which will be listening on port 16101. Once you open this address you will notice that your browser is going to complain that the server certificate is untrusted. The images on the right show how Firefox displays this error. You are going to be prompted every time you create a new SSL session with the server, both from the browser and more annoyingly from the IRM Desktop. If you plan on always using a self signed certificate, it is worth adding it to the Windows certificate store so that when you are accessing sealed content you do not keep being informed this certificate is not trusted. Follow these instructions (which are for Internet Explorer 8, they may vary for your version of IE.) Start Internet Explorer and open the URL to your IRM server over SSL, e.g. https://irm.company.intranet:16101/irm_rights. IE will complain that about the certificate, click on Continue to this website (not recommended). From the IE Tools menu select Internet Options and from the resulting dialog select Security and then click on Trusted Sites and then the Sites button. Add to the list of trusted sites a URL which mates the server you are accessing, e.g. https://irm.company.intranet/ and select OK. Now refresh the page you were accessing and next to the URL you should see a red cross and the words Certificate Error. Click on this button and select View Certificates. You will now see a dialog with the details of the self signed certificate and the Install Certificate... button should be enabled. Click on this to start the wizard. Click next and you'll be asked where you should install the certificate. Change the option to Place all certificates in the following store. Select browse and choose the Trusted Root Certification Authorities location and hit OK. You'll then be prompted to install the certificate and answer yes. You also need to import the root signed certificate into the same location, so once again select the red Certificate Error option and this time when viewing the certificate, switch to the Certification Path tab and you should see a CertGenCAB certificate. Select this and then click on View Certificate and go through the same process as above to import the certificate into the store. Finally close all instances of the IE browser and re-access the IRM server URL again, this time you should not receive any errors. Setting up an official SSL certificate in Apache 2.x At this point we now have an IRM server that you can communicate with over SSL. However this certificate isn't trusted by any browser because it's path of trust doesn't end in a recognized certificate authority (CA). Also you are communicating directly to the WebLogic Server over a non standard SSL port, 16101. In a production environment it is common to have another device handle the initial public internet traffic and then proxy this to the WebLogic server. The diagram below shows a very simplified view of this type of deployment. What i'm going to walk through next is configuring Apache to proxy traffic to a WebLogic server and also to use a real SSL certificate from an official CA. First step is to configure Apache to handle incoming requests over SSL. In this guide I am configuring the IRM service in Oracle Enterprise Linux 5 update 3 and Apache 2.2.3 which came with OpenSSL and mod_ssl components. Before I purchase an SSL certificate, I need to generate a certificate request from the server. Oracle.com uses Verisign and for my own personal needs I use cheaper certificates from GoDaddy. The following instructions are specific to Apache, but there are many references out there for other web servers. For Apache I have OpenSSL and the commands are; [oracle@irm /] cd /usr/bin [oracle@irm bin] openssl genrsa -des3 -out irm-apache-server.key 2048 Generating RSA private key, 2048 bit long modulus ............................+++ .........+++ e is 65537 (0x10001) Enter pass phrase for irm-apache-server.key: Verifying - Enter pass phrase for irm-apache-server.key: [oracle@irm bin] openssl req -new -key irm-apache-server.key -out irm-apache-server.csr Enter pass phrase for irm-apache-server.key: You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [GB]:US State or Province Name (full name) [Berkshire]:CA Locality Name (eg, city) [Newbury]:San Francisco Organization Name (eg, company) [My Company Ltd]:Oracle Organizational Unit Name (eg, section) []:Security Common Name (eg, your name or your server's hostname) []:irm.company.com Email Address []:[email protected] Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:testing An optional company name []: You must make sure to remember the pass phrase you used in the initial key generation, you will need this when later configuring Apache. In the /usr/bin directory there are now two new files. The irm-apache-server.csr contains our certificate request and is what you cut and paste, or upload, to your certificate authority when you purchase and validate your SSL certificate. In response you will typically get two files. Your server certificate and another certificate file that will likely contain a set of certificates from your CA which validate your certificate's trust. Next we need to configure Apache to use these files. Typically there is an ssl.conf file which is where all the SSL configuration is done. On my Oracle Enterprise Linux server this file is located in /etc/httpd/conf.d/ssl.conf and i've added the following lines. <VirtualHost irm.company.com> # Setup SSL for irm.company.com ServerName irm.company.com SSLEngine On SSLCertificateFile /oracle/secure/irm.company.com.crt SSLCertificateKeyFile /oracle/secure/irm.company.com.key SSLCertificateChainFile /oracle/secure/gd_bundle.crt </VirtualHost> Restarting Apache (apachectl restart) and I can now attempt to connect to the Apache server in a web browser, https://irm.company.com/. If all is configured correctly I should now see an Apache test page delivered to me over HTTPS. Configuring Apache to proxy traffic to the IRM server Final piece in setting up SSL is to have Apache proxy requests for the IRM server but do so securely. So the requests to Apache will be over HTTPS using a legitimate certificate, but we can also configure Apache to proxy these requests internally across to the IRM server using SSL with the self signed certificate we generated at the start of this article. To do this proxying we use the WebLogic Web Server plugin for Apache which you can download here from Oracle. Download the zip file and extract onto the server. The file extraction reveals a set of zip files, each one specific to a supported web server. In my instance I am using Apache 2.2 32bit on an Oracle Enterprise Linux, 64 bit server. If you are not sure what version your Apache server is, run the command /usr/sbin/httpd -V and you'll see version and it its 32 or 64 bit. Mine is a 32bit server so I need to extract the file WLSPlugin1.1-Apache2.2-linux32-x86.zip. The from the resulting lib folder copy the file mod_wl.so into /usr/lib/httpd/modules/. First we want to test that the plug in will work for regular HTTP traffic. Edit the httpd.conf for Apache and add the following section at the bottom. LoadModule weblogic_module modules/mod_wl.so <IfModule mod_weblogic.c>    WebLogicHost irm.company.internal    WebLogicPort 16100    WLLogFile /tmp/wl-proxy.log </IfModule> <Location /irm_rights>    SetHandler weblogic-handler </Location> <Location /irm_desktop>    SetHandler weblogic-handler </Location> <Location /irm_sealing>    SetHandler weblogic-handler </Location> <Location /irm_services>    SetHandler weblogic-handler </Location> Now restart Apache again (apachectl restart) and now open a browser to http://irm.company.com/irm_rights. Apache will proxy the HTTP traffic from the port 80 of your Apache server to the IRM service listening on port 16100 of the WebLogic Managed server. Note above I have included all four of the Locations you might wish to proxy. http://irm.company.internalirm_rights is the URL to the management website, /irm_desktop is the URL used for the IRM Desktop to communicate. irm_sealing is for web services based document sealing and irm_services is for IRM server web services. The last two are typically only used when you have the IRM server integrated with another application and it is unlikely you'd be accessing these resources from the public facing Apache server. However, just in case, i've mentioned them above. Now let's enable SSL communication from Apache to WebLogic. In the ZIP file we extracted were some more modules we need to copy into the Apache folder. Looking back in the lib that we extracted, there are some more files. Copy the following into the /usr/lib/httpd/modules/ folder. libwlssl.so libnnz11.so libclntsh.so.11.1 Now the documentation states that should only need to do this, but I found that I also needed to create an environment variable called LD_LIBRARY_PATH and point this to the folder /usr/lib/httpd/modules/. If I didn't do this, starting Apache with the WebLogic module configured to SSL would throw the error. [crit] (20014)Internal error: WL SSL Init failed for server: (null) on 0 So I had to edit the file /etc/profile and add the following lines at the bottom. You may already have the LD_LIBRARY_PATH variable defined, therefore simply add this path to it. LD_LIBRARY_PATH=/usr/lib/httpd/modules/ export LD_LIBRARY_PATH Now the WebLogic plug in uses an Oracle Wallet to store the required certificates.You'll need to copy the self signed certificate from the IRM server over to the Apache server. Copy over the MyOwnSelfCA.cer.der into the same folder where you are storing your public certificates, in my example this is /oracle/secure. It's worth mentioning these files should ONLY be readable by root (the user Apache runs as). Now lets create an Oracle Wallet and import the self signed certificate from the IRM server. The file orapki was included in the bin folder of the Apache 1.1 plugin zip you extracted. orapki wallet create -wallet /oracle/secure/my-wallet -auto_login_only orapki wallet add -wallet /oracle/secure/my-wallet -trusted_cert -cert MyOwnSelfCA.cer.der -auto_login_only Finally change the httpd.conf to reflect that we want the WebLogic Apache plug-in to use HTTPS/SSL and not just plain HTTP. <IfModule mod_weblogic.c>    WebLogicHost irm.company.internal    WebLogicPort 16101    SecureProxy ON    WLSSLWallet /oracle/secure/my-wallet    WLLogFile /tmp/wl-proxy.log </IfModule> Then restart Apache once more and you can go back to the browser to test the communication. Opening the URL https://irm.company.com/irm_rights will proxy your request to the WebLogic server at https://irm.company.internal:16101/irm_rights. At this point you have a fully functional Oracle IRM service, the next step is to create a sealed document and test the entire system.

  Read the article

• Securing an ADF Application using OES11g: Part 2

  - by user12587121

  To validate the integration with OES we need a sample ADF Application that is rich enough to allow us to test securing the various ADF elements.  To achieve this we can add some items including bounded task flows to the application developed in this tutorial. A sample JDeveloper 11.1.1.6 project is available here. It depends on the Fusion Order Demo (FOD) database schema which is easily created using the FOD build scripts.In the deployment we have chosen to enable only ADF Authentication as we will delegate Authorization, mostly, to OES.The welcome page of the application with all the links exposed looks as follows: The Welcome, Browse Products, Browse Stock and System Administration links go to pages while the Supplier Registration and Update Stock are bounded task flows.  The Login link goes to a basic login page and once logged in a link is presented that goes to a logout page.  Only the Browse Products and Browse Stock pages are really connected to the database--the other pages and task flows do not really perform any operations on the database. Required Security Policies We make use of a set of test users and roles as decscribed on the welcome page of the application.  In order to exercise the different authorization possibilities we would like to enforce the following sample policies: Anonymous users can see the Login, Welcome and Supplier Registration links. They can also see the Welcome page, the Login page and follow the Supplier Registration task flow.  They can see the icon adjacent to the Login link indicating whether they have logged in or not. Authenticated users can see the Browse Product page. Only staff granted the right can see the Browse Product page cost price value returned from the database and then only if the value is below a configurable limit. Suppliers and staff can see the Browse Stock links and pages.  Customers cannot. Suppliers can see the Update Stock link but only those with the update permission are allowed to follow the task flow that it launches.  We could hide the link but leave it exposed here so we can easily demonstrate the method call activity protecting the task flow. Only staff granted the right can see the System Administration link and the System Administration page it accesses. Implementing the required policies In order to secure the application we will make use of the following techniques: EL Expressions and Java backing beans: JSF has the notion of EL expressions to reference data from backing Java classes.  We use these to control the presentation of links on the navigation page which respect the security contraints.  So a user will not see links that he is not allowed to click on into. These Java backing beans can call on to OES for an authorization decision.  Important Note: naturally we would configure the WLS domain where our ADF application is running as an OES WLS SM, which would allow us to efficiently query OES over the PEP API.  However versioning conflicts between OES 11.1.1.5 and ADF 11.1.1.6 mean that this is not possible.  Nevertheless, we can make use of the OES RESTful gateway technique from this posting in order to call into OES. You can easily create and manage backing beans in Jdeveloper as follows: Custom ADF Phase Listener: ADF extends the JSF page lifecycle flow and allows one to hook into the flow to intercept page rendering.  We use this to put a check prior to rendering any protected pages, again calling on to OES via the backing bean.  Phase listeners are configured in the adf-settings.xml file.  See the MyPageListener.java class in the project.  Here, for example,  is the code we use in the listener to check for allowed access to the sysadmin page, navigating back to the welcome page if authorization is not granted:                         if (page != null && (page.equals("/system.jspx") || page.equals("/system"))){                             System.out.println("MyPageListener: Checking Authorization for /system");                             if (getValue("#{oesBackingBean.UIAccessSysAdmin}").toString().equals("false") ){                                   System.out.println("MyPageListener: Forcing navigation away from system" +                                       "to welcome");                                 NavigationHandler nh = fc.getApplication().getNavigationHandler();                                   nh.handleNavigation(fc, null, "welcome");                               } else {                                 System.out.println("MyPageListener: access allowed");                              }                         } Method call activity: our app makes use of bounded task flows to implement the sequence of pages that update the stock or allow suppliers to self register.  ADF takes care of ensuring that a bounded task flow can be entered by only one page.  So a way to protect all those pages is to make a call to OES in the first activity and then either exit the task flow or continue depending on the authorization decision.  The method call returns a String which contains the name of the transition to effect. This is where we configure the method call activity in JDeveloper: We implement each of the policies using the above techniques as follows: Policies 1 and 2: as these policies concern the coarse grained notions of controlling access to anonymous and authenticated users we can make use of the container’s security constraints which can be defined in the web.xml file.  The allPages constraint is added automatically when we configure Authentication for the ADF application.  We have added the “anonymousss” constraint to allow access to the the required pages, task flows and icons: <security-constraint>    <web-resource-collection>      <web-resource-name>anonymousss</web-resource-name>      <url-pattern>/faces/welcome</url-pattern>      <url-pattern>/afr/*</url-pattern>      <url-pattern>/adf/*</url-pattern>      <url-pattern>/key.png</url-pattern>      <url-pattern>/faces/supplier-reg-btf/*</url-pattern>      <url-pattern>/faces/supplier_register_complete</url-pattern>    </web-resource-collection>  </security-constraint> Policy 3: we can place an EL expression on the element representing the cost price on the products.jspx page: #{oesBackingBean.dataAccessCostPrice}. This EL Expression references a method in a Java backing bean that will call on to OES for an authorization decision.  In OES we model the authorization requirement by requiring the view permission on the resource /MyADFApp/data/costprice and granting it only to the staff application role.  We recover any obligations to determine the limit.  Policy 4: is implemented by putting an EL expression on the Browse Stock link #{oesBackingBean.UIAccessBrowseStock} which checks for the view permission on the /MyADFApp/ui/stock resource. The stock.jspx page is protected by checking for the same permission in a custom phase listener—if the required permission is not satisfied then we force navigation back to the welcome page. Policy 5: the Update Stock link is protected with the same EL expression as the Browse Link: #{oesBackingBean.UIAccessBrowseStock}.  However the Update Stock link launches a bounded task flow and to protect it the first activity in the flow is a method call activity which will execute an EL expression #{oesBackingBean.isUIAccessSupplierUpdateTransition}  to check for the update permission on the /MyADFApp/ui/stock resource and either transition to the next step in the flow or terminate the flow with an authorization error. Policy 6: the System Administration link is protected with an EL Expression #{oesBackingBean.UIAccessSysAdmin} that checks for view access on the /MyADF/ui/sysadmin resource.  The system page is protected in the same way at the stock page—the custom phase listener checks for the same permission that protects the link and if not satisfied we navigate back to the welcome page. Testing the Application To test the application: deploy the OES11g Admin to a WLS domain deploy the OES gateway in a another domain configured to be a WLS SM. You must ensure that the jps-config.xml file therein is configured to allow access to the identity store, otherwise the gateway will not b eable to resolve the principals for the requested users.  To do this ensure that the following elements appear in the jps-config.xml file: <serviceProvider type="IDENTITY_STORE" name="idstore.ldap.provider" class="oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider">             <description>LDAP-based IdentityStore Provider</description>  </serviceProvider> <serviceInstance name="idstore.ldap" provider="idstore.ldap.provider">             <property name="idstore.config.provider" value="oracle.security.jps.wls.internal.idstore.WlsLdapIdStoreConfigProvider"/>             <property name="CONNECTION_POOL_CLASS" value="oracle.security.idm.providers.stdldap.JNDIPool"/></serviceInstance> <serviceInstanceRef ref="idstore.ldap"/> download the sample application and change the URL to the gateway in the MyADFApp OESBackingBean code to point to the OES Gateway and deploy the application to an 11.1.1.6 WLS domain that has been extended with the ADF JRF files. You will need to configure the FOD database connection to point your database which contains the FOD schema. populate the OES Admin and OES Gateway WLS LDAP stores with the sample set of users and groups.  If  you have configured the WLS domains to point to the same LDAP then it would only have to be done once.  To help with this there is a directory called ldap_scripts in the sample project with ldif files for the test users and groups. start the OES Admin console and configure the required OES authorization policies for the MyADFApp application and push them to the WLS SM containing the OES Gateway. Login to the MyADFApp as each of the users described on the login page to test that the security policy is correct. You will see informative logging from the OES Gateway and the ADF application to their respective WLS consoles. Congratulations, you may now login to the OES Admin console and change policies that will control the behaviour of your ADF application--change the limit value in the obligation for the cost price for example, or define Role Mapping policies to determine staff access to the system administration page based on user profile attributes. ADF Development Notes Some notes on ADF development which are probably typical gotchas: May need this on WLS startup in order to allow us to overwrite credentials for the database, the signal here is that there is an error trying to access the data base: -Djps.app.credential.overwrite.allowed=true Best to call Bounded Task flows via a CommandLink (as opposed to a go link) as you cannot seem to start them again from a go link, even having completed the task flow correctly with a return activity. Once a bounded task flow (BTF) is initated it must complete correctly  via a return activity—attempting to click on any other link whilst in the context of a  BTF has no effect.  See here for example: When using the ADF Authentication only security approach it seems to be awkward to allow anonymous access to the welcome and registration pages.  We can achieve anonymous access using the web.xml security constraint shown above (where no auth-constraint is specified) however it is not clear what needs to be listed in there….for example the /afr/* and /adf/* are in there by trial and error as sometimes the welcome page will not render if we omit those items.  I was not able to use the default allPages constraint with for example the anonymous-role or the everyone WLS group in order to be able to allow anonymous access to pages. The ADF security best practice advises placing all pages under the public_html/WEB-INF folder as then ADF will not allow any direct access to the .jspx pages but will only allow acces via a link of the form /faces/welcome rather than /faces/welcome.jspx.  This seems like a very good practice to follow as having multiple entry points to data is a source of confusion in a web application (particulary from a security point of view). In Authentication+Authorization mode only pages with a Page definition file are protected.  In order to add an emty one right click on the page and choose Go to Page Definition.  This will create an empty page definition and now the page will require explicit permission to be seen. It is advisable to give a unique context root via the weblogic.xml for the application, as otherwise the application will clash with any other application with the same context root and it will not deploy

  Read the article

• .NET HttpListener - no traffic when listening to "https://*.8080" when browser proxy is set???

  - by Greg

  Hi, Background - I can get HttpListener working fine for HTTP traffic. I'm having trouble with HTTPS traffic however. QUESTION: How can I change the code below so that a browser request to a "https" URL will actually be picked up by my HttpListener? Notes - At the moment with firefox's proxy settings set to "localhost:8080", when I listen to traffic on port 8080 ("https://*:8080/"), and I enter a HTTPS url in firefox, I am getting no traffic being picked up? (when I listen to just http and enter normal http url's it works fine) _httpListener = new HttpListener(); _httpListener.Prefixes.Add("https://*:8080/"); _httpListener.Start(); thanks

  Read the article

• When should I open and close a website's cached WCF proxy?

  - by Brandon Linton

  I've browsed around the other articles on StackOverflow that relate to caching WCF proxies for reuse, and I've read this article explaining why I should explicitly open the proxy before calling anything on it. I'm still a little hazy on the best implementation details. My question is: when should I open and close proxies for service calls on a website, and what should their lifetime be (per call, per request, or per web app)? We aren't planning on leveraging cached security contexts at the moment (but it's not unforeseeable). Thanks!

  Read the article

• Using LINQ to query database through a proxy server of some kind?

  - by Mustafakidd

  Hey All Sorry for using (perhaps) the wrong lingo, but my question may be clearer if you view this diagram as you read it. http://dl.dropbox.com/u/13256/DIAGRAM.PNG Our client is requiring us to adhere to the server configuration (poorly) diagrammed in the above image. The web server is accessible over port 80 and is where our web application is hosted - a second firewall permits this web server to access a second server which in turn is the only server permitted to access the database server. My question is: How do I deploy a web application that uses LINQ-to-SQL in this environment? Is there a way to proxy my LINQ queries through the app server so that the database connection goes through that server? This is uncharted territory for me, as we always have had access to the DB server directly from our web server in the past. Any help is appreciated. Thanks Mustafa

  Read the article

• Can you use back references in the pattern part of a regular expression?

  - by Camsoft

  I there a way to back reference in the regular expression pattern? Example input string: Here is "quoted text" some quoted text. Say I want to pull out the quoted text, I could create the following expression: "([^"]+)" This regular expression would match quoted text. Say I want it to also support single quotes, I could change the expression to: ["']([^"']+)["'] But what if the input string has a mixture of quotes say Here is 'quoted text" some quoted text. I would not want the regex to match. Currently the regex in the second example would still match. What I would like to be able to do is if the first quote is a double quote then the closing quote must be a double. And if the start quote is single quote then the closing quote must be single. Can I use a back reference to achieve this?

  Read the article

• Command Pattern : How to pass parameters to a command ?

  - by Romain Verdier

  My question is related to the command pattern, where we have the following abstraction (C# code) : public interface ICommand { Execute(); } Let's take a simple concrete command, which aims to delete an entity from our application. A Person instance, for example. I'll have a DeletePersonCommand, which implements ICommand. This command needs the Person to delete as a parameter, in order to delete it when Execute method is called. What is the best way to manage parametrized commands ? How to pass parameters to commands, before executing them ?

  Read the article

• Using Scanner in Java how can I hasNext(aString) where the string is not regex pattern?

  - by Parris

  Hi, I am trying to do as my question states, sooo I have the following code which would find the match. String test = scan.next(); if (test.equals("$let")) return 1; However, I would prefer to use hasNext as to not consume a token; however, when i do the following it fails. if (scan.hasNext("$let")) return 1; I realize the when giving has next a variable it expects a pattern, but I thought if i don't have any regex symbols it should work. I also thought $ was possibly some regex symbol so I tried /$ however, that did not work! Thanks for the help!

  Read the article

• Is it possible to change WCF service without regenerating & recompiling client proxy?

  - by Buu Nguyen

  Let's say I have a WCF service which has a method returning object Person. In one of the clients of this service, I can add service reference to the service and start using its method. Now, let's say the Person class is changed on the server, having a new DataMember added. Other clients will make use of this new DataMember, but my client doesn't. Therefore, this client shouldn't even be aware that the service returns s/t "more" than what it needs. Is there any way that my client can still work with the service without having to update the service reference (which, as I understand, means regenerating the proxy & compiling it)?

  Read the article

• [C#] How to consume web service adheres to the Event-based Asynchronous Pattern?

  - by codemonkie

  I am following the example from http://msdn.microsoft.com/en-us/library/8wy069k1.aspx to consume a web service implemented (by 3rd party) using the Event-based Asynchronous Pattern. However, my program needs to do multiple calls to the DoStuffAsync() hence will get back as many DoStuffCompleted. I chose the overload which takes an extra parameter - Object userState to distinguish them. My first question is: Is it valid to cast a GUID to Object as below, where GUID is used to generate unique taskID? Object userState = Guid.NewGuid(); Secondly, do I need to spawn off a new thread for each DoStuffAsync() call, since I am calling it multiple times? Also, would be nice to have some online examples or tutorials on this subject. (I've been googling for it the whole day and didn't get much back) Many thanks

  Read the article

• Is there a pattern that allows a constructor to be called only from a specific factory and from nowh

  - by willem

  We have a class, say LegacyUserSettingsService. LegacyUserSettingsService implements an interface, IUserSettingsService. You can get an instance of the IUserSettingsService by calling our ApplicationServicesFactory. The factory uses Spring.NET to construct the concrete LegacyUserSettingsService. The trouble is that new developers sometimes do their own thing and construct new instances of the LegacyUserSettingsService directly (instead of going via the factory). Is there a way to protect the constructor of the concrete class so it can only be called from the factory? A well-known pattern perhaps? Note that the concrete class resides in a different assembly (separate from the Factory's assembly, so the internal keyword is not a solution). The factory assembly references the other assembly that contains the concrete class. Any ideas?

  Read the article

< Previous Page | 122 123 124 125 126 127 128 129 130 131 132 133  | Next Page >