Join the Session after 3rd party authentication OAuth

I use 5 APEX and integrate my application with another 3rd party solution. This 3rd party solution uses OAuth2 for authentication, which has a static redirect_url (a successful authentication post) which cannot be defined in the URL to call. Rather, it is defined as part of their application.

I know it's confusing, so here is the whole process that happens:

  • Web server is Node.js (Express with Passport for OAuth authentication) makes queries APEX proxies to ADR 3 / Tomcat.
  • The user connects to the application of the APEX and gets a new session ID.
    • ex: f? p = 100:1:20953642103077
  • Once logged in, there are a few JS on Page 1 (P1) that detects whether the user has been authenticated with this 3rd party service (call the 3PS for that matter). It does this by looking at a custom cookie that is set by the web server for Node.js (let's call this 3ps_token).
    • If 3ps_token is null, then it will trigger the process of 3PS OAuth and use is redirected to their site to connect and to grant the appropriate privileges.
    • Once 3PS has granted the privileges, the user will be redirected to a predefined URL which is stored as an attribute in the 3PS area. I can't pass in the URL as a parameter to URL redirection and don't have, so no real way to back the session APEX I was coming.
    • The redirect URL is currently going back to the Node.js, which sets the 3ps_token in a cookie, and then tries to redirect to the APEX and 'join' the existing session. This is where I'm having issues as the URL that I provided is/ords/f? p = 100 (as I don't know the original session).

How can I join my existing session of APEX (in the example above, 20953642103077)? If the following solution here: login page of APEX 4.1 kills the existing session cookie but this would require a custom authentication which I was hoping to avoid. Christian Neumueller-Oracle made a comment at the bottom of its solution join session is not secure. Is their a best practice because this so?

Hi Martin,

I have good news for you, we implemented session to return to the APEX 5. It will allow you to have an APEX URLs without a session id. You must first enable this feature in the Administration of the proceedings (see https://docs.oracle.com/cd/E59726_01/doc.50/e39151/adm_wrkspc002.htm#BABJCGAG) and then at the page or application level. Please consider the implications of security in this article, because to return potentially open your application to XSS attacks from other applications on the same server.

Kind regards

Christian

Tags: Database

Similar Questions

  • Duplicate the presets of the editor after 3rd party re-install/upgrade at level

    Screen Shot 2016-05-05 at 2.52.04 PM.png

    Screen Shot 2016-05-05 at 2.51.39 PM.png

    I have two Macs, both running the latest Mac OS and last Lightroom CC.  This problem lasts for a long time and happens on both systems.  This happens with all 3rd party publishers install as plugins LR.  I think that something is screwed up in the environment of OS or LR on my two systems?

    The problem is that whenever there is an upgrade to one of these products, or I reinstall, I find myself with entries duplicated in the list in the preferences of publishers external and on the "Photo - change in" drop-down menu.  Please look at attached them two screenshots illustrating the situation with On1 plugins (I noticed there is also a duplicate for "Topaz" Glow)

    I then go into the preferences and the other by a select entry duplicated, then delete it.  Then do the following, etc. until I understand not cleaned.  But the next time there is an update/install they appear again.

    This happens with On1, Topaz, Nik, etc..

    Many times I searched the Internet and tried to find out what is the cause - other people have the same problem?  I tried to jump using third party offices, but they did no help.  In general, they want to do me a complete uninstall and reinstallation of their products, but that fixed it - the duplicates come back after the next update!

    Thanks in advance - Rick

    1. MAKE MANUELLEMENT in FINDER:

    If you go to your Presets folder - (preferences / Presets / show Lightroom Presets folder)

    You will find the 'Lightroom' folder and the presets 'External change', which is a subfolder where you can remove the unwanted presets.

    Restart Lightroom.

    2. MAKE IN LIGHTROOM PREFERENCES:

    Choose the preset in the - preferences / external publishing Tab / Select the preset (the one you want to delete in the drop-down below)

    Click on the drop down a second time, and then choose - 'delete the preset... '. »

    Also note that presets can be stored in two locations depending on how you set the preference-

  • How to install the software VPN 3rd party to R700?

    I'm trying to find a way to install the software VPN 3rd party to my router? NordVPN. I'm not sure how to proceed. Any advice?

    Griff

    No 3rd party software installs with stock firmware.

  • How to automatically restore the session after a crash/update / without asking me if I want to restore it?

    Hello, there are times that my Firefox crashes (well, it happens to all of us who use it to some extent) or updates asking to restart. I would like to know if there is an option that allows you to restore the previous session automatically without asking me even. It would be very useful for reasons. I had this kind of problem a couple of times ending me be upset. Sometimes I misclicked and lost all my important tabs. Other times my firefox has crashed/shifted on after reboot and guess what sound restart still has not even asking me if I wanted to restore my session crashed.

    Thank you in advance.

    Cesarius Hi, I think I understand, but I have not explained completely.

    The browser.sessionstore.max_resumed_crashes preference is to avoid an infinite loop. The default value 1 means an attempt to restore the session automatically once and if it fails (for example, it crashes before it can finish to restore), then display the "embarrassing". You could try to increase the value of 2 or 3 and see if it works on the second or third time. If you still see the screen "This is awkward" after a crash, Firefox still does not make a failback.

    You can also check if there is a file user.js in your profile folder. A user.js file is a file of optional parameters that Firefox reads at startup and uses to override the settings saved in your previous session. Unless you create a user.js file yourself, you can usually just remove it. This article includes a section on the hunt for a possible user.js file: How to fix preferences that will not save.

    Note: by default, Windows hides the .js file extension. Precise work with file names, I suggest setting windows to show all file extensions. This article has the steps: https://www.mozilla.org/firefox/all/

  • Advantages, disadvantages of the use of 3rd party firewall vs WIndows firewall?

    At the suggestion of PA Bear, I open this thread to learn about firewalls.

    I have a Dell Latitude D600 with XP Pro SP3. I use ZoneAlarms free firewall. It seems however, ZA conflicted with my WiFi USB NetGear adapter and threw me the network after about an hour (in one place, totally crashing the machine to a blue screen). At the suggestion of the PA Pooh, I unloaded ZA and activated Windows Firewall - no more conflict.

    But I'm missing a couple of other functions, I had with ZA: - visual indication on the taskbar of traffic flow - permit/deny internet access to specific programs - completely locking all internet activity

    So is a decent firewall program that offers good firewall protection AND these conflicts of WITHOUT Extras?

    Or:

    Why should I stay with Windows Firewall and not look elsewhere for additional features?

    Ed

    Hey, Joel. Thanks for the reply.

    I liked the alerts because there seems to be a lot of things happening in the background that I had never heard. I enjoyed being able to see what was going on and kill him. "what do you say every time I open a file that you want to connect to the internet?"

    The other part is that I use my laptop and more in environments where I don't have an internet connection I do in coffee shops where I have WiFi. I didn't want the constant slowdown of who-knows-what-and-how-many programs to make repeated calls for a connection.

    Router? Everything I do is turn on my computer and plug my USB adapter and connect. (There's a guy at Starbucks, almost every day that comes out of three laptops and one buncha other things - it's his corner office!) I don't know what I'd do with a router - it's just me and my laptop and Starbucks (or elsewhere).

    Ed

    Hi Ed:

    If you use your laptop frequently on the public networks, a third-party firewall is maybe a good option. I detect not just since your original post. You should look at the link below for a list of the popular options. Comodo, however, would be my choice if I had to use a.

    http://www.techsupportalert.com/best-free-firewall.htm

    I do not vote for me I'm not here for points. If this post helps you, vote. Visit my forum @ http://repairbotsonline.com/

  • Database contains the session after having disconnected the DB!

    Dear friends,

    I use Oracle10g database (10.2.0.4) than our production server to AIX 6.1. Recently, we buy
    an application that is used for a banking module. The username "INCHEQS" application.

    Now the problem is, when we are connecting through this user from the client end then,
    many users logged on, even if the users are not logged. for example, if a disconnection from the user
    Since his session but it connected session always in my database.

    Please see the output:

    SQL > select count (*) in the session $ v where username = "INCHEQS";

    COUNT (*)
    ----------
    100

    SQL > select username, status from v$ session where username like ' INCHEQS %;

    STATUS OF USER NAME
    ------------------------------ --------
    IDLE INCHEQS
    IDLE INCHEQS
    IDLE INCHEQS
    IDLE INCHEQS
    IDLE INCHEQS
    IDLE INCHEQS
    .......................................
    .......................................

    100 selected lines.


    In the output above of my production database, all users above are not connected, but the
    continuous session on the database. Now, how can I solve the problem. Is there a partners
    Oracle parameter (rather than RESOURCE_LIMT) to remove all INACTIVE users above after awhile.
    Here, I mentioned that it is not possible to activate the 'RESOURCE_LIMIT' parameter in my database.
    Edited by: shipon_97 26 August 2010 14:04

    Hello

    Create a new profile with a few seconds idle (based on your observation and discussion with the owner of the application) and send it back to the user.

    Anand

  • Is it possible to join the railways after developing appearances?

    I paint very simple forms to send to a cutting laser and I need them to be symmetrical. I use the tool 'transform' mirror my drawing, then developing the appearance at the end. But once I have 2 full paths, I can't illustrator to join them. I have grouped, separated them, made a copy of the drawing, tried everything I can think of. I swear he actually used to do this then maybe my software is corrupted (I use CS4 - Yes, the dark ages!) so if I need to go just before it's cool - but if there is an easy way to get this working I might just stick with the old stuff since that's really all I use it, and very rarely.  Thanks for any thoughts!

    Julia,

    Now it is clear that you meant, well, sorry.

    You need Ctrl / Cmd + SHIFT + G, twice two have two lanes as simple traces, then it should work.

    In addition, you can see reflect directly after each anchor Point if you start as follows (for the pen tool with vertical reflection):

    (1) create the first two Points of your main trajectory anchor;

    (2) effect > warp & Transform > transform > ReflectX with 1 copy and one on the right side of the reference Points chosen;

    (3) with the new ClickDrag tool of the second Point of anchorage and dedicated pen.

    CTRL / Cmd + Z Undo is your friend: you can simply go back and redo all drawing the original path.

  • Muse of the synchronized text fields disabled during the download of 3rd party hosting

    The customer site is done in the office and in a version of the phone. The text field for the menu of the day, which he is editing with the 'inbrowserediting.com' function is implemented as a synchronized text. Great, but it does not work! I assumed that it is has something to do with PHP, then I changed hosting and now all these features (also the supplier confirmed it).

    But once again: it does not work.

    After downloading by ftp to a third host, I get the message, that muse disabled the inbrowser function because it seems the host does not support redirection of Web sites.

    -> and then... the text synchronized the ist field cannot be changed.

    I contacted the supplier and that he thinks that all actions are enabled and it should work

    The question now is:

    Which confirms exactly MUSE during the download? are there other technical bases that must be met? I can't find something. No description about this article.

    Y at - it ideas? Thanks in advance!

    I found the solution in this discussion (which I have not found before... Sorry ;-).

    Re: Why I can't use in browser with synchronized text editing?

    Thanks anyway!

  • APEX_ITEMS does not store the value in the SESSION after the validation error

    Hello

    I'm build dynamically using APEX_ITEMS, but it does not keep the value when the page is submitted and the validation error occurs. Here are the following steps that I am following.

    When I enter SUE (more than 8 characters), SUBMIT, validation fails and the error is displayed on the page (which is fine)
    BUT it does not keep SUE value (which I got) and filled with the old value which is ABC.

    WHY it does not keep the value that the user entered (even as the normal Page items)

    Region PL\SQL
    declare
      v_value varchar2(20);
    begin
      v_value := 'ABC'; 
      htp.p(apex_item.text(7,v_value));
    end;
    Validation (function returning the error text)
    DECLARE
     v_count number;
     v_value varchar2(50);
     v_value1 number;
    BEGIN
      v_value := apex_application.g_f07(1);
      select length(v_value) into v_value1 from dual;
    
          if v_value1 > 8 then
              return 'Field must have less than 9 character';
          ELSE
             return null;
          END IF;
    END;

    You use collections if you want the State to show if, after a validation error. Unfortunately, this is the case if you do not use the normal tabular forms.

    Denes Kubicek
    -------------------------------------------------------------------
    http://deneskubicek.blogspot.com/
    http://www.Apress.com/9781430235125
    https://Apex.Oracle.com/pls/Apex/f?p=31517:1
    http://www.Amazon.de/Oracle-Apex-XE-Praxis/DP/3826655494
    -------------------------------------------------------------------

  • I'm having problems to make one of the 3rd party fitness on my watch applications

    I'm having a lot of trouble getting my watch to load up one of the applications of 3rd party fitness. Apps for example Strava & Wahoo fitness... In particular, two applications have support iwatch announced when download you from the App store. You don't know if there is a problem with my watch or not because I recently bought a wahoo HRM ability that has the Bluetooth, etc & I paired with my phone, but trying to make a pair of Bluetooth with my watch looking for Bluetooth 'of health devices"it captures anything. I tried to obtain the support of Strava thinking it was their app, but I did exactly what they said to do IE désapparier shows, to remove and reinstall app & his continues to do exactly the same thing. Both apps show on my watch, but when I select to load just makes the circle of reflection and then the app is de-energized so it brings back me to the screen of application on my watch. I've updated my privacy settings to let my watch & the apps read each other, but still does not.

    Hello

    If you have not already done so, it can help to upgrade your iPhone and Apple Watch to the latest version of the software.

    If not, try the following steps, trying to open the application after each:

    • Place your Apple Watch on its charger with power connected and also connect your iPhone to the power.
    • On your iPhone: open the music application and start playing a song (through your iPhone pregnant is fine).
    • On your iPhone, in the application of the watch, go to: My Watch (tab) > scroll down and tap the name of the application that does not open > turn off the option to show App on Apple Watch > to pause for a few moments > turn on the option.

    If this does not resolve the problem, the other recommended steps is trying to disconnect and rematching of your watch. As you've already tried this, you can ignore this:

    More information:

    Get help with applications on your Apple Watch - Apple Support

  • Order of port re-auth authentication and switch / stop of the session

    Hi all

    We are implementing an ISE (1,4) and met regarded questions on the agenda of the authentication and a stop of the session after posture in line. We got mab, dot1x as authentication order (priority of authentication is set to dot1x, mab). We have configured a reauthentication in the ports of the switch. Windows uses begging all-connect NAM (see 4.2) to dot1x and posture. During the re-authentication, either all-connecting NAM or switch does not start an eapol start and switch allows the session to the MAB, where - as when seen dot1x and mab authentication switch order generates eapol start. The switches are 3750 (15.0 (2) SE8).

    Any possibility we could force the switch/NAM agent sent an eapol start during re-auth?

    Regarding the posture, posture once conform for an endpoint (after dot1x authentication passes) following a judgment of the ISE manual session for an endpoint, switch creates a new session in ISE changes and switch the State of the unknown port to posture. Posture ise AC client still shows status of complaint of posture in the endpoint. It seems do not know about the stop of the session. During NAM endpoint agent session performs a re-auth component however posture remains unchanged "in line".

    Does anyone have experience this problem?.

    Thanks in advance.

    Concerning

    GA

    Hi Gaj-

    I had the similar problem in the past and for setting the following attribute:

    Termination-action-AVPair attribute modifier = 1

    Give that a go and let us know if you still have any questions.

    Thank you for evaluating useful messages!

  • Saving and loading of values on a 3rd party ownership of arbitrary data to the plugin?

    Here I am again, asking weird questions.

    I am trying to find a way that I can save and restore values/keyframes on a 3rd party property of the plugin.

    It's easy to do with standard property types as I can just get/set values, but with arbitrary data, I don't see a clear way to do this.

    I can make a preset effect which will restore the correct arbitrary values when applied and use ExecuteScript() to apply the preset.

    But, I prefer a method that does not need to apply a preset, because this solution would require the installation of a special it somethere preset in path predefined AE.

    It is the risk that the user could delete the preset, and then the plugin is broken.


    I thought that maybe I could trick the plugin from 3rd party to give me a copy of the flattened data of arbitrary property by sending PF_Cmd_ARBITRARY_CALLBACK, passes along a custom made PF_ArbParamsExtra with the which_function the PF_Arbitrary_COPY_FUNCvalue.  Now, I have a copy of arbitrary data.  I can use the same trick to get the flat size of data (PF_Arbitrary_FLAT_SIZE_FUNC), flatten the dataset (PF_Arbitrary_FLATTEN_FUNC), and then save the data flattened on the disk in a binary file.

    If it works, I would basically do the opposite to restore data from the disk and apply arbitrary to a new/different instance of will assume it.


    Typing all this, it sounds pretty crazy, and I barely understand the arbitrary data how works.  I'm not even sure I can do the above without things get messy.

    Any ideas on that?  I'm far from base? This is another technique that can do this with techniques less hacky?

    Thank you!

    -Andy

    your assumptions are correct.

    You cannot change add an effect to a layer while your effect is

    ground of appeal.

    It doesn't have the o effect with javascript. It's just, as you say,

    change the scene while working on it.

    How to work around this problem:

    have two plug-ins effect and a CEAP.

    result call the CEAP via a special series (see "order" and)

    samples of "honey" to see how it works) and set some data there.

    do not have the CEAP run changes immediately! store these data only!

    Let the effect finish its execution and return.

    now.

    during the call to idle_hook, the CEAP checks all messages left by the effect.

    new data is present? God. run now that the effect is not in call mi.

    TADA!

    with regard to the getPlatformData,.

    platform commands specific for data such as the path to self

    .dll, but you can just have the effect the data desired in the CEAP

    When it sends the message.

  • Failure of the session! Please log in again

    Hello

    I get an error "failed Session! Please sign in again"whenever trying to change my router settings. Even when I try to put it on dynamic IP address static IP it says failed session and I am automatically disconnected. To change the settings of the router, I always need to reset, and then use the parameters of desire first installation, after that is not allowing me to modify one of these.

    I already tried updating firmware twice but nothing happened.

    Router E1200

    Model V2.

    Any Suggestions or troubleshooting.

    Thank you

    aarvii.

    FurryNutz wrote:

    PC 3 Party security software Configurations
    Disable all antivirus programs and firewall on the PC during the test. 3rd party firewalls is not usually necessary when using routers as they are effective on the blocking of malicious incoming traffic.

    PC Web browser configurations
    What browser do you use?
    Try Opera or FF? If IE 8, 9, 10 or 11, test value and mode of compatibility again.
    Disable any security browser addons such as No Script and Ad-Block or set them to allow all Pages when it is connected to the router.
    Clear all caches browser.
    Don't forget to log on to the Admin account on the router.
    Try disabling these features in Chrome:
    Top right corner, few bars options > settings > settings (left) > see the advanced settings.
    Uncheck the box for these:
    Use a web service to help solve the navigational errors
    Use a service forecast for complete searches and URLS typed in the address bar
    Predict the actions of the network to improve the performance of page loading
    Activate the protection from phishing and malware

    I tried all these solutions, but the same problem persists. Nothing else except these?

  • VPN / Natting issue - connectivity to 3rd Party Partner Site

    Hello

    I received a request to provide a connectivity solution between our private server 10.102.x.y and a3rd advantage partner server. 10.247.x.y solution of VPN site to site. I want to hide our real IP of 10.102.x.y and replace 10.160.x.y (using Natting).

    The configuration is the following:

    3rd party partner server->

    3rd party ASA FW-> Tunnel VPN IPSec Internet-> Our ASA FW-> Our server private
    10.247.x.y

    10.102.x.y private IP

    NAT'd IP10.160.xy

    My dogs entered so far (still awaiting 3rd party to set up their ASA)

    name 10.160.x.y OurNat'dServer

    crypto ISAKMP policy 6
    preshared authentication
    aes-256 encryption
    sha hash
    Group 5
    lifetime 28800

    Crypto ipsec transform-set 3rd Party esp-aes-256 esp-sha-hmac

    3rd party ip host 10.160.x.y host 10.247.x.y allowed extended access list

    tunnel-group 80.x.x.x type ipsec-l2l
    80.x.x.x group of tunnel ipsec-attributes
    pre-shared key xxxxxxxxx

    football match 117 card crypto vpnmap address 3rd party

    card crypto vpnmap 117 counterpart set 80.x.x.x

    card crypto vpnmap 117 the transform-set 3rd Party value

    public static 10.160.x.y (Interior, exterior) 10.102.x.y netmask 255.255.255.255

    The config goes to meet my requirements and the solution envisaged, or is my inaccurate understanding?

    Any help on this would be appreciated.

    Thanks in advance,

    Select this option.

    Hello

    Who will break actually internet traffic with this server because the external address that is sent over the internet is considered to be a 10.160.x.y.  In the past, I did something like this:

    public static 10.160.x.y (Interior, exterior), list-dest-3rdParty access policy

    policy-dest-3rdParty of the ip host 10.102.x.y host 10.247.x.y allowed extended access list

    Who will ONLY perform NAT traffic on this server if traffic is coming from the 10.247.x.y.

  • certificate of network invites you to join the network

    I have dell laptop computer wireless and the desktop of windows xp with the electrician cannot join the network certificate request.

    I need some advice please

    I find the solution by myself. It's the home network application certificate join the network on 3rd computer with XP

    Other computer 2 connect to the same network without any problems.

    The solution is on XP computer I just changed time internet Sync on XP
    then the computer recognize wireless network. Now everything works fine thanks for the advice guys.

Maybe you are looking for

  • Why Downloadhelper does not work with Youtube?

    I used the add-on video Downloadhelper years on my laptop without a problem. I noticed about three days ago, that he did more work with Youtube videos. Rotation icon still works, and when I click it, it still gives me the choice of file type to downl

  • Hello, new Member... need help ;)

    Bought v3-771 acer two days ago tried to register several times without success would be very gratfull for advice cordially spitfire789

  • I have 'Unknown' in my shared files. How can I fix it?

    I keep seeing CONTACT UNKNOWN on shared files. My spouse could be hiding with someone under this unknown contact that I don't know? Original title: CONTACT UNKNOWN

  • Problems with "Cultures".

    The problem is that it will not crop! I was using version 4, me frustrated and downloaded the version 6, having the same problem. I read all the posts that I found, read the Manual 4 times. I tried the arrows of positioning in corners and dragging, t

  • Mac OS

    What is required to use the Cloud Creative Mac OS? I use 10.6.8.!