Search Results

Search found 18808 results on 753 pages for 'security updates'.

facebook twitter digg google delicious technorati stumbleupon myspace wordpress linkedin gmail igoogle windows live tumblr viadeo yahoo buzz yahoo mail yahoo bookmarks favorites email print

Page 48/753 | < Previous Page | 44 45 46 47 48 49 50 51 52 53 54 55  | Next Page >

  • JSR updates - First Merged EC Ballots

    - by Heather VanCura
    As the second part of the JCP.Next effort, JCP 2.9 launched 2 weeks ago on 13 November, and the first JCP EC ballots with the Merged EC have concluded.   JSR 339, JAX-RS 2.0: The Java API for RESTful Web Services, passed EC Public Review Ballot and was approved by the EC -- 22 yes votes, 2 abstain, 2 did not vote -- view results. JSR 349, Bean Validation 1.1, passed EC Public Review Ballot and was approved by the EC --17 yes votes, 2 abstain, 5 did not vote --  view results.

    Read the article

  • Microsoft Launches Pre-release Updates of AppFabric, BizTalk

    Microsoft Application Infrastructure Virtual Conference highlights integration between new cloud-savvy, .NET middleware and Microsoft's integration server....Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • Microsoft Patch Tuesday Promises Critical Updates

    Microsoft revealed some plans last week for its upcoming Patch Tuesday release that should keep IT professionals busy. The latest Patch Tuesday falls on June 14 and it will bring with it 16 bulletins from Microsoft focused on fixing 34 vulnerabilities that stretch across several of the company s products.... Microsoft? Windows Azure Host, Scale, and Manage Web Apps In The Cloud. Learn More About Azure.

    Read the article

  • 139 updates wont update

    - by amnesia
    I cant seem to update the 139 files I need too. It is saying I am not connected to the internet yet I am typing this to you on the same computer?? I have deleted most of the errors as it shows the same IP all the time and I am not sure if that is mine or not ANy ideas would be greatly appreciated Failed to fetch http://au.archive.ubuntu.com/ubuntu/pool/main/i/icedtea-web/icedtea-netx-common_1.2-2ubuntu1.2_all.deb 404 Not Found

    Read the article

  • Updates for the Silverlight Training Kit

    We have had a good response to the free 8 module Silverlight Training Kit we released on Channel 9 back at MIX and that Scott Guthrie announced. We have since updated at the Silverlight 4 Launch with some new content and fixes. Weve also found 2 issues since then that you might run across. Ive corrected these in the source and will update them on the Channel 9 site in our next round (which I hope to include VB version of the courseware, too!) In the meantime, here are the fixes to the 2 problems...Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • Updates for the Silverlight Training Kit

    We have had a good response to the free 8 module Silverlight Training Kit we released on Channel 9 back at MIX and that Scott Guthrie announced. We have since updated at the Silverlight 4 Launch with some new content and fixes. Weve also found 2 issues since then that you might run across. Ive corrected these in the source and will update them on the Channel 9 site in our next round (which I hope to include VB version of the courseware, too!) In the meantime, here are the fixes to the 2 problems...Did you know that DotNetSlackers also publishes .net articles written by top known .net Authors? We already have over 80 articles in several categories including Silverlight. Take a look: here.

    Read the article

  • JSR Updates and EC Nominations open

    - by heathervc
    JSR 310, Date and Time API, has published an Early Draft Review 2.  This review closes 14 October. JSR 353, Java API for JSON Processing, has published an Early Draft Review.  This review closes 7 October. JSR 356, Java API for WebSocket, has published an Early Draft Review. This review closes 27 October. JSR 339,  JAX-RS 2.0: The Java API for RESTful Web Services, has published a Public Review. This review closes 12 November. The EC Nominations are now open until 11 October.  Any JCP Member may nominate themselves for the 2 open seats in the 2012 EC Elections.  Note that both seats will be for a 1 year term only, since all EC Members will stand for Election in 2013.  The merged EC will take effect in November 2012.

    Read the article

  • Object array updates one instance repeatedly [on hold]

    - by MGN001
    I'm making a 2D shooter, and the player object holds an array of bullets that represent how many shots the player can have on screen at once. At least, this is what I'm trying for. What's happening is that each time any of the objects in the array is called, it seems to update a single object in memory. So, if I fire and then fire again, the object "starts over" from where I shot from and moves twice as fast. I've spent weeks trying to fix this and I've managed nothing. Hopefully another pair of eyes will see something I've missed. Player.cpp #include "Player.h" const int startLives = 3; const int maxHealth = 2; const float speed = 1; const int maxVelocity = 500; const int topBound = WINDOW_HEIGHT / 5 * 3; const int slowRate = 500; const int accRate = 1000; const int maxBullets = 5; const float spriteWidth = 99; const float spriteHeight = 75; const Vector2f startPosition = { (WINDOW_WIDTH / 2) - (spriteWidth / 2), (WINDOW_HEIGHT / 4 * 3) - (spriteHeight / 2) }; Bullet bullets[maxBullets]; Bullet * bulletPointers[maxBullets]; SDL_Texture * playerHealthy; SDL_Texture * playerDamaged; SDL_Texture * currentSprite; SDL_Rect * rect; Vector2f position; Vector2f velocity; int Health; int Lives; Player::Player() { rect = new SDL_Rect(); } Player::~Player() { SDL_DestroyTexture(playerHealthy); SDL_DestroyTexture(playerDamaged); SDL_DestroyTexture(currentSprite); rect = NULL; } void Player::Initialize(SDL_Renderer * renderer) { SDL_Surface * temp; temp = IMG_Load(".\\Sprites\\player.png"); if (temp == NULL) { printf("Initialization Error: %s\n", IMG_GetError()); exit(PLAYER_INITIALIZATION_ERROR); } playerHealthy = SDL_CreateTextureFromSurface(renderer, temp); temp = IMG_Load(".\\Sprites\\playerDamaged.png"); if (temp == NULL) { printf("Initialization Error: %s\n", IMG_GetError()); exit(PLAYER_INITIALIZATION_ERROR); } playerDamaged = SDL_CreateTextureFromSurface(renderer, temp); temp = IMG_Load(".\\Sprites\\laserGreen.png"); if (temp == NULL) { printf("Initialization Error: %s\n", IMG_GetError()); exit(PLAYER_INITIALIZATION_ERROR); } SDL_Texture * bullet = SDL_CreateTextureFromSurface(renderer, temp); temp = IMG_Load(".\\Sprites\\laserGreenShot.png"); if (temp == NULL) { printf("Initialization Error: %s\n", IMG_GetError()); exit(PLAYER_INITIALIZATION_ERROR); } SDL_Texture * explosion = SDL_CreateTextureFromSurface(renderer, temp); for (int i = 0; i < maxBullets; i++) { bullets[i].Initialize(renderer, bullet, explosion); bulletPointers[i] = NULL; } temp = NULL; rect->h = spriteHeight; rect->w = spriteWidth; Reset(); } void Player::Update(Input input, float deltaTime) { if (abs(velocity.x) < slowRate * deltaTime) { velocity.x = 0; } else if (velocity.x > 0) { velocity.x -= slowRate * deltaTime; } else if (velocity.x < 0) { velocity.x += slowRate * deltaTime; } if (abs(velocity.y) < slowRate * deltaTime) { velocity.y = 0; } if (velocity.y > 0) { velocity.y -= slowRate * deltaTime; } else if (velocity.y < 0) { velocity.y += slowRate * deltaTime; } if (Health <= 0) { --Lives; Spawn(); } velocity.x += UnitVector(input.InputNew.movement).x * accRate * deltaTime; velocity.y += UnitVector(input.InputNew.movement).y * accRate * deltaTime; if (Magnitude(velocity) > maxVelocity) { velocity.x = UnitVector(velocity).x * maxVelocity; velocity.y = UnitVector(velocity).y * maxVelocity; } position.x += velocity.x * deltaTime * speed; position.y += velocity.y * deltaTime * speed; if (input.InputNew.JumpLeft && !input.InputOld.JumpLeft) { position.x -= spriteWidth; } if (input.InputNew.JumpRight && !input.InputOld.JumpRight) { position.x += spriteWidth; } Boundaries(); rect->x = position.x; rect->y = position.y; if (input.InputNew.Fire && !input.InputOld.Fire) { Fire(); } for (int i = 0; i < maxBullets; ++i) { if (bulletPointers[i] != NULL) { bullets[i].Update(deltaTime); if (bullets[i].getPosition().y < -33) { bulletPointers[i] = NULL; } } } } void Player::Draw(SDL_Renderer * renderer) { for (int i = 0; i < maxBullets; ++i) { if (bulletPointers[i] != NULL) { bullets[i].Draw(renderer); } } SDL_RenderCopy(renderer, currentSprite, NULL, rect); } void Player::Spawn() { position = startPosition; Health = maxHealth; currentSprite = playerHealthy; rect->x = position.x; rect->y = position.y; } void Player::Boundaries() { if (position.x < 0) { position.x = 0; velocity.x *= -1; } else if (position.x > WINDOW_WIDTH - spriteWidth) { position.x = WINDOW_WIDTH - spriteWidth; velocity.x *= -1; } if (position.y < topBound) { position.y = topBound; velocity.y *= -1; } else if (position.y > WINDOW_HEIGHT - spriteHeight) { position.y = WINDOW_HEIGHT - spriteHeight; velocity.y *= -1; } } int Player::getLives() { return Lives; } void Player::Reset() { Lives = startLives; Spawn(); } void Player::Fire() { for (int i = 0; i < maxBullets; ++i) { if (bulletPointers[i] == NULL) { bulletPointers[i] = &bullets[i]; bullets[i].Fire(position,velocity.x/2); break; } } } Bullet.cpp #include "Bullet.h" const int speed = 500; Vector2f bulletVelocity; float ExplosionMax = 0.5f; float ExplosionTimer; const Vector2f fireOffset = { 45.5f, 10.0f }; const Vector2f explosionOffset = { 23.5f, -27.0f }; const Vector2i bulletSize = { 9, 33 }; const Vector2i explosionSize = { 56, 54 }; Vector2f bulletPosition; SDL_Texture * bulletSprite; SDL_Texture * explosionSprite; SDL_Texture * bulletCurrentSprite; SDL_Rect * bulletRect; Bullet::Bullet() { } Bullet::~Bullet() { } void Bullet::Initialize(SDL_Renderer * renderer, SDL_Texture * bullet, SDL_Texture * explosion) { bulletSprite = bullet; explosionSprite = explosion; bulletRect = new SDL_Rect(); } void Bullet::Update(float deltaTime) { bulletPosition.y -= bulletVelocity.y * deltaTime; bulletPosition.x += bulletVelocity.x * deltaTime; bulletRect->x = static_cast<int>(bulletPosition.x); bulletRect->y = static_cast<int>(bulletPosition.y); } void Bullet::Draw(SDL_Renderer * renderer) { SDL_RenderCopy(renderer, bulletCurrentSprite, NULL, bulletRect); } void Bullet::Fire(Vector2f pos, float xSpeed) { bulletPosition.x = pos.x + fireOffset.x; bulletPosition.y = pos.y + fireOffset.y; bulletVelocity.x = xSpeed; bulletVelocity.y = speed; bulletCurrentSprite = bulletSprite; bulletRect->h = bulletSize.y; bulletRect->w = bulletSize.x; bulletRect->x = static_cast<int>(bulletPosition.x); bulletRect->y = static_cast<int>(bulletPosition.y); } Vector2f Bullet::getPosition() { return bulletPosition; } void Bullet::Hit() { bulletCurrentSprite = explosionSprite; bulletVelocity = { 0.0f, 0.0f }; ExplosionTimer = ExplosionMax; bulletPosition.x += explosionOffset.x; bulletPosition.y += explosionOffset.y; bulletRect->w = explosionSize.x; bulletRect->h = explosionSize.y; }

    Read the article

  • Securing Plugin Data in WordPress From Access by Other Plugins?

    - by farinspace
    There probably is some solution to this, whether it involves code running on just the wordpress installation or a combination of a wordpress installation and a master server I am not sure yet, but please remember not to have tunnel vision and consider any and all possible solutions: The scenario is this: A WordPress plugin (plugin-A) that manages some sort of valuable data (something that the admin would not want stolen), lets say, lead data with user's name and email addresses, the plugin uses its own db tables. Other than the obvious (which is the admin installing plugin-B, not knowing its malicious intent), what is to prevent another WordPress plugin (plugin-B) from accessing plugin-A data or hacking plugin-A files to circumvent security.

    Read the article

  • Best practice to send secure information over e-mail?

    - by Zolomon
    I have to send sensitive information (name, address, social security number etc.) collected from a website, that has been entered by a user, to an e-mail address. What is the best course of action to make the information secure and easy to extract on the receiver side? Edit: I will be using ASP.NET for the website, not sure what it has for capabilities on this matter. Edit: If I decide to store the information in a database and just send a mail when a new entry has been made, would this be better? And create some secure way to dump the information instead.

    Read the article

  • Is there really a need for encryption to have true wireless security? [closed]

    - by Cawas
    I welcome better key-wording here, both on tags and title. I'm trying to conceive a free, open and secure network environment that would work anywhere, from big enterprises to small home networks of just 1 machine. I think since wireless Access Points are the most, if not only, true weak point of a Local Area Network (let's not consider every other security aspect of having internet) there would be basically two points to consider here: Having an open AP for anyone to use the internet through Leaving the whole LAN also open for guests to be able to easily read (only) files on it, and even a place to drop files on Considering these two aspects, once everything is done properly... What's the most secure option between having that, or having just an encrypted password-protected wifi? Of course "both" would seem "more secure". But it shouldn't actually be anything substantial. That's the question, but I think it may need more elaborating on. If you don't think so, please feel free to skip the next (long) part. Elaborating more on the two aspects ... I've always had the feeling using any kind of the so called "wireless security" methods is actually a bad design. I'm talking mostly about encrypting and pass-phrasing (which are actually two different concepts), since I won't even consider hiding SSID and mac filtering. I understand it's a natural way of thinking. With cable networking nobody can access the network unless they have access to the physical cable, so you're "secure" in the physical way. In a way, encrypting is for wireless what building walls is for the cables. And giving pass-phrases would be adding a door with a key. But the cabling without encryption is also insecure. If someone plugin all the data is right there. So, while I can see the use for encrypting data, I don't think it's a security measure in wireless networks. It's wasting resources for too little gain. I believe we should encrypt only sensitive data regardless of wires. That's already done with HTTPS, so I don't really need to encrypt my torrents, for instance. They're torrents, they are meant to be freely shared! As for using passwords, they should be added to the users, always. Not to wifi. For securing files, truly, best solution is backup. Sure all that doesn't happen that often, but I won't consider the most situations where people just don't care. I think there are enough situations where we actually use passwords on our OS users, so let's go with that in mind. I keep promoting the Fonera concept as an instance. It opens up a free wifi port, if you choose so, and anyone can connect to the internet through that, without having any access to your LAN. It also uses a QoS which will never let your bandwidth drop from that public usage. That's security, and it's open. But it's lacking the second aspect. I'll probably be bashed for promoting the non-usage of WPA 2 with AES or whatever, but I wanted to know from more experienced (super) users out there: what do you think?

    Read the article

  • Ruby - Feedzirra and updates

    - by mplacona
    Hi, trying to get my head around Feedzirra here. I have it all setup and everything, and can even get results and updates, but something odd is going on. I came up with the following code: def initialize(feed_url) @feed_url = feed_url @rssObject = Feedzirra::Feed.fetch_and_parse(@feed_url) end def update_from_feed_continuously() @rssObject = Feedzirra::Feed.update(@rssObject) if @rssObject.updated? puts @rssObject.new_entries.count else puts "nil" end end Right, what I'm doing above, is starting with the big feed, and then only getting updates. I'm sure I must be doing something stupid, as even though I'm able to get the updates, and store them on the same instance variable, after the first time, I'm never able to get those again. Obviously this happens because I'm overwriting my instance variable with only updates, and lose the full feed object. I then thought about changing my code to this: def update_from_feed_continuously() feed = Feedzirra::Feed.update(@rssObject) if feed.updated? puts feed.new_entries.count else puts "nil" end end Well, I'm not overwriting anything and that should be the way to go right? WRONG, this means I'm doomed to always try to get updates to the same static feed object, as although I get the updates on a variable, I'm never actually updating my "static feed object", and newly added items will be appended to my "feed.new_entries" as they in theory are new. I'm sure I;m missing a step here, but I'd really appreciate if someone could shed me a light on it. I've been going through this code for hours, and can't get to grips with it. Obviously it should work fine, if I did something like: if feed.updated? puts feed.new_entries.count @rssObject = initialize(@feed_url) else Because that would reinitialize my instance variable with a brand new feed object, and the updates would come again. But that also means that any new update added on that exact moment would be lost, as well as massive overkill, as I'd have to load the thing again. Thanks in advance!

    Read the article

  • IIS6.0 asking for credentials after MS Updates

    - by Adam M.
    We have an IIS6.0 Server running on a Windows 2003 Server. Last weekend it went though maintenance, and updated a quite a few Windows updates, it is now brought up to current updates (as of March 29th). Previous to these updates we could connect to the Web page via the hostname or via a alias (there is a DNS and a WINS alias (the alias is the same name in both) that are both pointing to the system). Now since the updates it asks for credentials to access the page, when trying to access the page via IP, or by name. If you use the alias it will go right into the page. I had added a new alias in DNS and tried to access it via this name with the same effect. So it appears that the WINS alias allows the page to show up properly. I have seen this KB but http://support.microsoft.com/kb/871179 though not sure if it really is relevant to this issue. As it does refer to the 3 strikes rules to display the 401.1 error. The IIS Application pool is running under a domain account. Teh default page is allowing Anonymous login under a local account. Any thoughts? Thanks Adam

    Read the article

  • The Unintended Consequences of Sound Security Policy

    - by Tanu Sood
    v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} Normal 0 false false false EN-US X-NONE X-NONE MicrosoftInternetExplorer4 /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin:0in; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Calibri","sans-serif"; mso-bidi-font-family:"Times New Roman";} Author: Kevin Moulton, CISSP, CISM Meet the Author: Kevin Moulton, Senior Sales Consulting Manager, Oracle Kevin Moulton, CISSP, CISM, has been in the security space for more than 25 years, and with Oracle for 7 years. He manages the East Enterprise Security Sales Consulting Team. He is also a Distinguished Toastmaster. Follow Kevin on Twitter at twitter.com/kevin_moulton, where he sometimes tweets about security, but might also tweet about running, beer, food, baseball, football, good books, or whatever else grabs his attention. Kevin will be a regular contributor to this blog so stay tuned for more posts from him. When I speak to a room of IT administrators, I like to begin by asking them if they have implemented a complex password policy. Generally, they all nod their heads enthusiastically. I ask them if that password policy requires long passwords. More nodding. I ask if that policy requires upper and lower case letters – faster nodding – numbers – even faster – special characters – enthusiastic nodding all around! I then ask them if their policy also includes a requirement for users to regularly change their passwords. Now we have smiles with the nodding! I ask them if the users have different IDs and passwords on the many systems that they have access to. Of course! I then ask them if, when they walk around the building, they see something like this: Thanks to Jake Ludington for the nice example. Can these administrators be faulted for their policies? Probably not but, in the end, end-users will find a way to get their job done efficiently. Post-It Notes to the rescue! I was visiting a business in New York City one day which was a perfect example of this problem. First I walked up to the security desk and told them where I was headed. They asked me if they should call upstairs to have someone escort me. Is that my call? Is that policy? I said that I knew where I was going, so they let me go. Having the conference room number handy, I wandered around the place in a search of my destination. As I walked around, unescorted, I noticed the post-it note problem in abundance. Had I been so inclined, I could have logged in on almost any machine and into any number of systems. When I reached my intended conference room, I mentioned my post-it note observation to the two gentlemen with whom I was meeting. One of them said, “You mean like this,” and he produced a post it note full of login IDs and passwords from his breast pocket! I gave him kudos for not hanging the list on his monitor. We then talked for the rest of the meeting about the difficulties faced by the employees due to the security policies. These policies, although well-intended, made life very difficult for the end-users. Most users had access to 8 to 12 systems, and the passwords for each expired at a different times. The post-it note solution was understandable. Who could remember even half of them? What could this customer have done differently? I am a fan of using a provisioning system, such as Oracle Identity Manager, to manage all of the target systems. With OIM, and email could be automatically sent to all users when it was time to change their password. The end-users would follow a link to change their password on a web page, and then OIM would propagate that password out to all of the systems that the user had access to, even if the login IDs were different. Another option would be an Enterprise Single-Sign On Solution. With Oracle eSSO, all of a user’s credentials would be stored in a central, encrypted credential store. The end-user would only have to login to their machine each morning and then, as they moved to each new system, Oracle eSSO would supply the credentials. Good-bye post-it notes! 3M may be disappointed, but your end users will thank you. I hear people say that this post-it note problem is not a big deal, because the only people who would see the passwords are fellow employees. Do you really know who is walking around your building? What are the password policies in your business? How do the end-users respond?

    Read the article

  • Data Source Security Part 5

    - by Steve Felts
    If you read through the first four parts of this series on data source security, you should be an expert on this focus area.  There is one more small topic to cover related to WebLogic Resource permissions.  After that comes the test, I mean example, to see with a real set of configuration parameters what the results are with some concrete values. WebLogic Resource Permissions All of the discussion so far has been about database credentials that are (eventually) used on the database side.  WLS has resource credentials to control what WLS users are allowed to access JDBC resources.  These can be defined on the Policies tab on the Security tab associated with the data source.  There are four permissions: “reserve” (get a new connection), “admin”, “shrink”, and reset (plus the all-inclusive “ALL”); we will focus on “reserve” here because we are talking about getting connections.  By default, JDBC resource permissions are completely open – anyone can do anything.  As soon as you add one policy for a permission, then all other users are restricted.  For example, if I add a policy so that “weblogic” can reserve a connection, then all other users will fail to reserve connections unless they are also explicitly added.  The validation is done for WLS user credentials only, not database user credentials.  Configuration of resources in general is described at “Create policies for resource instances” http://docs.oracle.com/cd/E24329_01/apirefs.1211/e24401/taskhelp/security/CreatePoliciesForResourceInstances.html.  This feature can be very useful to restrict what code and users can get to your database. There are the three use cases: API Use database credentials User for permission checking getConnection() True or false Current WLS user getConnection(user,password) False User/password from API getConnection(user,password) True Current WLS user If a simple getConnection() is used or database credentials are enabled, the current user that is authenticated to the WLS system is checked. If database credentials are not enabled, then the user and password on the API are used. Example The following is an actual example of the interactions between identity-based-connection-pooling-enabled, oracle-proxy-session, and use-database-credentials. On the database side, the following objects are configured.- Database users scott; jdbcqa; jdbcqa3- Permission for proxy: alter user jdbcqa3 grant connect through jdbcqa;- Permission for proxy: alter user jdbcqa grant connect through jdbcqa; The following WebLogic Data Source objects are configured.- Users weblogic, wluser- Credential mapping “weblogic” to “scott”- Credential mapping "wluser" to "jdbcqa3"- Data source descriptor configured with user “jdbcqa”- All tests are run with Set Client ID set to true (more about that below).- All tests are run with oracle-proxy-session set to false (more about that below). The test program:- Runs in servlet- Authenticates to WLS as user “weblogic” Use DB Credentials Identity based getConnection(scott,***) getConnection(weblogic,***) getConnection(jdbcqa3,***) getConnection()  true  true Identity scottClient weblogicProxy null weblogic fails - not a db user User jdbcqa3Client weblogicProxy null Default user jdbcqaClient weblogicProxy null  false  true scott fails - not a WLS user User scottClient scottProxy null jdbcqa3 fails - not a WLS user User scottClient scottProxy null  true  false Proxy for scott fails weblogic fails - not a db user User jdbcqa3Client weblogicProxy jdbcqa Default user jdbcqaClient weblogicProxy null  false  false scott fails - not a WLS user Default user jdbcqaClient scottProxy null jdbcqa3 fails - not a WLS user Default user jdbcqaClient scottProxy null If Set Client ID is set to false, all cases would have Client set to null. If this was not an Oracle thin driver, the one case with the non-null Proxy in the above table would throw an exception because proxy session is only supported, implicitly or explicitly, with the Oracle thin driver. When oracle-proxy-session is set to true, the only cases that will pass (with a proxy of "jdbcqa") are the following.1. Setting use-database-credentials to true and doing getConnection(jdbcqa3,…) or getConnection().2. Setting use-database-credentials to false and doing getConnection(wluser, …) or getConnection(). Summary There are many options to choose from for data source security.  Considerations include the number and volatility of WLS and Database users, the granularity of data access, the depth of the security identity (property on the connection or a real user), performance, coordination of various components in the software stack, and driver capabilities.  Now that you have the big picture (remember that table in part 1), you can make a more informed choice.

    Read the article

  • Data Source Security Part 2

    - by Steve Felts
    In Part 1, I introduced the default security behavior and listed the various options available to change that behavior.  One of the key topics to understand is the difference between directly using database user and password values versus mapping from WLS user and password to the associated database values.   The direct use of database credentials is relatively new to WLS, based on customer feedback.  Some of the trade-offs are covered in this article. Credential Mapping vs. Database Credentials Each WLS data source has a credential map that is a mechanism used to map a key, in this case a WLS user, to security credentials (user and password).  By default, when a user and password are specified when getting a connection, they are treated as credentials for a WLS user, validated, and are converted to a database user and password using a credential map associated with the data source.  If a matching entry is not found in the credential map for the data source, then the user and password associated with the data source definition are used.  Because of this defaulting mechanism, you should be careful what permissions are granted to the default user.  Alternatively, you can define an invalid default user to ensure that no one can accidentally get through (in this case, you would need to set the initial capacity for the pool to zero so that the pool is populated only by valid users). To create an entry in the credential map: 1) First create a WLS user.  In the administration console, go to Security realms, select your realm (e.g., myrealm), select Users, and select New.  2) Second, create the mapping.  In the administration console, go to Services, select Data sources, select your data source name, select Security, select Credentials, and select New.  See http://docs.oracle.com/cd/E24329_01/apirefs.1211/e24401/taskhelp/jdbc/jdbc_datasources/ConfigureCredentialMappingForADataSource.html for more information. The advantages of using the credential mapping are that: 1) You don’t hard-code the database user/password into a program or need to prompt for it in addition to the WLS user/password and 2) It provides a layer of abstraction between WLS security and database settings such that many WLS identities can be mapped to a smaller set of DB identities, thereby only requiring middle-tier configuration updates when WLS users are added/removed. You can cut down the number of users that have access to a data source to reduce the user maintenance overhead.  For example, suppose that a servlet has the one pre-defined, special WLS user/password for data source access, hard-wired in its code in a getConnection(user, password) call.  Every WebLogic user can reap the specific DBMS access coded into the servlet, but none has to have general access to the data source.  For instance, there may be a ‘Sales’ DBMS which needs to be protected from unauthorized eyes, but it contains some day-to-day data that everyone needs. The Sales data source is configured with restricted access and a servlet is built that hard-wires the specific data source access credentials in its connection request.  It uses that connection to deliver only the generally needed day-to-day information to any caller. The servlet cannot reveal any other data, and no WebLogic user can get any other access to the data source.  This is the approach that many large applications take and is the reasoning behind the default mapping behavior in WLS. The disadvantages of using the credential map are that: 1) It is difficult to manage (create, update, delete) with a large number of users; it is possible to use WLST scripts or a custom JMX client utility to manage credential map entries. 2) You can’t share a credential map between data sources so they must be duplicated. Some applications prefer not to use the credential map.  Instead, the credentials passed to getConnection(user, password) should be treated as database credentials and used to authenticate with the database for the connection, avoiding going through the credential map.  This is enabled by setting the “use-database-credentials” to true.  See http://docs.oracle.com/cd/E24329_01/apirefs.1211/e24401/taskhelp/jdbc/jdbc_datasources/ConfigureOracleParameters.html "Configure Oracle parameters" in Oracle WebLogic Server Administration Console Help. Use Database Credentials is not currently supported for Multi Data Source configurations.  When enabled, it turns off credential mapping on Generic and Active GridLink data sources for the following attributes: 1. identity-based-connection-pooling-enabled (this interaction is available by patch in 10.3.6.0). 2. oracle-proxy-session (this interaction is first available in 10.3.6.0). 3. set client identifier (this interaction is available by patch in 10.3.6.0).  Note that in the data source schema, the set client identifier feature is poorly named “credential-mapping-enabled”.  The documentation and the console refer to it as Set Client Identifier. To review the behavior of credential mapping and using database credentials: - If using the credential map, there needs to be a mapping for each WLS user to database user for those users that will have access to the database; otherwise the default user for the data source will be used.  If you always specify a user/password when getting a connection, you only need credential map entries for those specific users. - If using database credentials without specifying a user/password, the default user and password in the data source descriptor are always used.  If you specify a user/password when getting a connection, that user will be used for the credentials.  WLS users are not involved at all in the data source connection process.

    Read the article

  • Which is more secure GET or POST sending parameters with cURL at PHP

    - by Steve
    I want to connect in a secure way with an API and I am using cURL to do it using HTTPS and SSL. Now, i was wondering what is better in terms of security, sending the data through GET or POST: $ch = curl_init("http://api.website.com/connect.php?user=xxx&pass=xxxx); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); $result = curl_exec($ch); curl_close($ch); Or $param['user'] = 'xxxx'; $param['pass'] = 'xxxx'; $ch = curl_init("http://api.website.com/connect.php); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $Parameters); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, FALSE); curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 2); $result = curl_exec($ch); curl_close($ch); I also realized that POST is much more slower retrieving the data.

    Read the article

facebook twitter digg google delicious technorati stumbleupon myspace wordpress linkedin gmail igoogle windows live tumblr viadeo yahoo buzz yahoo mail yahoo bookmarks favorites email print

< Previous Page | 44 45 46 47 48 49 50 51 52 53 54 55  | Next Page >