Separate authentication for external and internal users?

Hello

Asked me to come with a CEP for a client who wants a new system APEX is accessible to internal and external users. The client security team want to have two separate copies of the request for the APEX and both copies of the auditor of the APEX on separate databases on two separate servers from Weblogic to support different security requirements for both internal and external users. I don't think that is necessary as APEX should be able to impose conditions depending on what type of user is connected, by questioning the cookie passed in which could contain a flag to say whether the user is internally and externally. In addition, CAE can be used to further restrict external access.

The middleware for the customer solution is managed by a third party, who have made the following recommendations:

The domestic channel requires SSO to configure on WebLogic while the outside lane. Internal users must be validated on Active Directory, with RSA Authentication Manager used for external users. We cannot set up a listener APEX instance to use and not to use SINGLE sign-on at the same time. Two applications are necessary.

Now, I understand from my understanding limited the listener of the APEX, it is possible to implement different rules depending on the type of user to access. However, might just as well not be managed from Magnatune APEX? We could write a custom authentication procedure that verifies again road and the SSO user authentication cookie or otherwise, as required.

So my question is this: can it really be necessary to implement two versions of an APEX application, with two distinct on different servers APEX headphones, to meet the security requirements of separate here? Ultimately at the end of the day if that's what the customer wants, we have to build it, but I'm looking to reassure them via a CEP that won't be necessary. I think that the seller of hardware/middleware recommend that the client just because they do not know available in APEX itself custom authentication options.

Please forgive any simplifications or the lack of details in the above - I'm more a developer APEX as a person of the infrastructure and a bit of a 'newbie' where the listener APEX is concerned. All advice gratefully appreciated!

Graham.

Hi Graham,

It's a matter of people paranoid how and to what extent they trust their own infrastructure. Things could be easier than to split the environments, but I don't know if I just depends on the cookie because cookie can be easily rigged. But I think that the following architecture would be safe:
1 internal users connect APEX listener somehow security team requires, come to APEX and maybe be identified using the internal IP address (range). To simulate the INVESTIGATION period should be difficult for external users.
2. external users connect APEX listener through a defined gateway, preferably a proxy. All future requests through this gateway would be considered external users.
You may add additional logic to the proxy, for example use something like 'mod_headers' in Apache HTTPD to add a page header to requests, so that you may identify as external users.
You could, of course, also put it the other Tower and allow internal users to use some proxy to enforce certain rules of IP based address, or perhaps a few additional references as authentication for access to the proxy (which again could be transparent user in AD-configuration, at least if you stick with IE).

You can easily implement the separation in your custom authentication process. But this architecture also allows some other compromise: even if someone does not trust your application logic to handle two types of application successfully, you can also use the proxy to enforce the specific call for an application id. Certainly you don't need to duplicate the infrastructure...
Most of the companies already have a proxy for external users, for example to activate SSL and to hide other internal resources, for load balancing,... so I think you just need to put some configuration of the existing infrastructure and end up needing no component additional. Even if there is no proxy and yet, it would be an element of very light weight, easy to handle.

So far, all this has nothing to do with the earpiece of the APEX. It's 'just' a web front-end for the instance of the APEX in the database. I wouldn't put a logic of network security in this service, but the split things upward front. The APEX listener can be patched to add some logic, but which was not supported.

I think that this would work and should be sufficient for most of the safety requirements.
If my picture was not painted understandable, let me know.

-Udo

Tags: Database

Similar Questions

The Developer Portal and internal users

Hello

I have configured on our ISE to use AD-users as sponsors. And it works perfectly.

but I also try to set up an internal user to the portal of the sponsor.

I've configured almost the same so I don't understand why the LSE reports:
Authentication of the sponsor has failed: not found for the user Sponsorgroup

My identity store is a sequence of the my and internal users and I can see from the log it looks like the right place:

Identity store:

Internal users

My condition is that the internal user, must be a member of the group identity: sponsorAllAccount

my home group:

Group membership:

SponsorAllAccount

and then get a group created promoter, this grop of sponsor which is allocated to the State, works very well for det AD-users.

Evaluate the politics of identity

5435 sponsor authentication failed

any suggestions why? I now use the lastes 1.1.1 version.

BR

Tuva

Yes,

For your internal groups use the condition of group identity preconfigured on the left.

I don't know why there is an option on the left, he has not worked for me either in the authorization policies.

Thank you

Sent by Cisco Support technique iPad App

How can I find my external and internal port number

I am trying to access the internet via a live ethernet cable from my router, except the computer im trying to use is new to the House, but is under xp. I also have a laptop which I use to ask these questions, which accesses the internet via a wireless connection. I open 'Internet Properties' and entered my IP address and I am now looking for my external and internal port numbers try to connect. Is it and most easy way? I'm on the right track? Help, please. :)

If you really have a router, then this router should affect your computer all the configuration settings that it needs to connect to the internet (or local) automatically via DHCP. The "TCP/IP properties" correct settings on your computer must be set to "Obtain an IP address automatically" and "Obtain DNS server address automatically". If your router is configured correctly, it will automatically load these settings, such as all you need to do is to connect your computer to your router. If this does not work, then you must download the manual of your router and verify its configuration.

HTH,
JW

WLC with ACS 5.1 (RADIUS) for management * AND * Network users

Hello

I have authentication RADIUS of installation for the users of the network AND management on my NM - WLC (5.2 ongoing execution) against ACS 5.1

My Question is:-

For users to log in to Admin, I need to come back "Service-Type = Administrative - User" in order to make it work.

Because the ACS sees all applications from the same device (WLC) for Admin and network users,

the way I am currently treats it is by creating a filter based on the user name

Thus, users that contain 'admin' in their ID, use a set of

Network access policy authorization, who has an authorization associated with the attributes RADIUS profile.

Normal users have a ' network access policy authorization different rule ", with a different profile.

While this DOES WORK fine, still me I was wondering if there is a better way to do it, rather than create a rule

based on the user name.

I could use GANYMEDE + for the management, but I don't think that ACS allows the same client AAA (WLC) to use both protocols.

Thank you

I think it's something very common for things to do

You may notice that ACS 5 comes preinstalled with a selection policy of service that differentiates them the Protocol-based queries and orders or service 'Access to the network by default' or "Default Device Admin" out of the box

If you want only to RAY can either disable or delete the rule for applications of GANYMEDE + or not choose GANYMEDE + in the definitions of the unit

Use the connection to the server externally and internally for PCoIP?

Another great video, very well explained. Just a question, it is not possible to use a connection to the server for both internal and external users PCoIP? You must use servers to separate connection, one at gateway PCoIP to external users and other to PCoIP direct links?

You could, but internal users would cross the bridge PCOIP. I' always found lve easier just have a broker for external users.

We need create separate extensions for CC and CC2014

I do not use Extension Builder.
If I create an extension of HTML5, should I create two separate .zxps and manifest of CC and CC2014 files? (Assuming that it will be some users who continue to use CC for some reason any).
I guess I can specify a version range to host it elements in the parameter Listehotes in the manifest for example <Host Name= "PHXS" Version= "[14.0,15.9]"/ >
But looking at the RequiredRuntime:Version and the ExtensionManager:Version in the manifestos - I'm not sure what they mean and that they oppose using a single manifesto for the CC and the CC2014.
Thanks for all the ideas.

You can support CC and CC2014, but you need to develop for the earlier example CC and RequiredRuntime:Version 4.0 version. You should expand the range of the version of the application to include CC versions and CC2014. We have many obvious examples that works for CC and CC 2014 at: https://github.com/Adobe-CEP/Samples

Releases of question on 2 separate, one for Playbook and the other for BB10

Hello

At the moment we have an application that is currently enabled for BB10 and Playbook. However, we've recently re-written the application take over much better phone interface, and we would like to submit a version that is not specific to BB10 and have a separate for Playbook version.

What I hope we can do is just uncheck the BB10 of the current version and let the Playbook checked, then submit a new version with only selected BB10. However, I wasn't sure if this overwrite the version of the Playbook and pull it store since the release "more recent" doesn't have the verified Playbook. Is it possible to have these 2 releases by-side, but be in the same "application"?

Thank you
Jake

It works as you expect it. In fact you don't have to uncheck the BB10 phones on the old version.

Do we need to buy separate licenses for ESXi and VCenter and 5

Hello
I have confusion about the licensing model, I have 2 servers (2 socket) physical with 4 licenses of VMWARE VSPHERE 5 STANDARD 1 PROCESSOR, you can clear my doubts if I need to buy a separate license for VCenter Server and if so, which is the right one?
Thank you

Yes, vCenter Server needs to be licensed separately (VMware also offers packaged essentials and acceleration kits). Since you already have the CPU licenses, you can either watch the "vCenter Server Foundation" license that allows to manage up to 3 guests or 'vCenter Server Standard' license without this limitation.

André

work around the internal security gateway and the same url for web access external and internal

role of the broker 1 quest
1 security with the roles of web access gateway
1 Server terminal server

I configured the default gateway with the parameter security rule: "vworkspace security gateway".
I created a custom with the 172.16.1.177 value rule (it's my client internal windows7).
When I navigate to the internal url (fqdn's secure gateway server) I bypassed (tsdebug shows no sslgateway).

But now I want to use 1 internal and external URL to type the same URL.
Now when I navigate to an external URL of the machine internal with above ip I always get through security gateway, I see a SSLGateway

Hi Erik,

I think that this has been fixed in our latest version 8.5 - documents.software.dell.com/DOC252107

Please download and upgrade your farm and let us know if you still see this problem.

If you do, it may be best to save a service request so that we can see exactly what is happening.

Thanks, Sam

Can I have a unique password and ID authentication for accounts and FireFox Sync?

I can't keep my ID and password held for accounts of Firefox, Firefox Sync and Mozilla. Some how I have used two different e-mail accounts, and they have different passwords.
I use a MacBook with OS X 10.1.1 and FireFox 34.0

Sync and Firefox accounts use the same e-mail (user name) and the same password. There is a service - Sync uses Firefox web logins.

The extent of the "Mozilla", do you mean this forum?
You can use the same e-mail address and the same password, but different Mozilla Web sites and services use separate record and data connection; none are connected with other sites.

Pavilion dv7-4285dx: cannot BOOT/POST/VGA external and internal LCD is dead (cracked)

I cracked the screen of my HP Pavilion dv7-4285dx so bad that I can't read anything on the subject. I'm trying to start to an external monitor to the VGA port, but never to get a signal.

I tried the key switch monitor, but that does nothing. I tried to unplug the LCD internal of the motherboard - not different. I tried a CMOS reset by removing the laptop battery, remove the CMOS battery, cut the power and hold the power button / stop for > 1 minute, then by restarting with external LCD just attached, but STILL no video on the VGA port.

The video card is OK, because it starts with Windows and then I have the video on the external monitor.

Although it is good that I can use the monitor to post once Windows starts, I need to have the video when the BIOS starts to change.

Does anyone have another suggestion how I can get the BIOS to detect and display external VGA at boot time?

Hello Todd_in_LA,

Welcome to the HP Forums, I hope you enjoy your experience! To help you get the most out of the Forums of HP, I would like to draw your attention to the Guide of the Forums HP first time here? Learn how to publish and more.

I read your post about how you try to start on an external monitor, and I would be happy to guide you to a resolution!

Based on the information provided in your post, I recommend you contact our technical support at the 1-800-474-6836. If you do not live in the United States / Canada region please click the link below to get help from your region number.

http://www.HP.com/cgi-bin/hpsupport/index.pl

I hope this helps!

Concerning

AAA authentication for external router through PIX 515

I have been in vain, to get the authentication AAA works to my external router, through the PIX.

When I connect the router directly within that network (bypassing the PIX) AAA works fine, so I know the configuration of the AAA works between the router and the ACS server.

Initially, I got the PIX configured with a static map between a global external address 192.x.x.12 and a 10.200.1.187 for the ACS server local address, but that didn't work either. So, currently I am using NAT exemption for the ACS server, but it does not work either.

If I activate the debug on the PIX package, I see the ACS authentication request and response between the router and GBA when I try to connect to the router, but it is not successful. After the three way TCP handshake, the router repeats it is last receipt, and then the ACS asked an RST.

The attached diagram shows the simple connection that I'm trying to create.

The configuration of the PIX is also attached. (too large messages size):

Thanks in advance for your help. I tried EAC for two days and have not found solutions that look like this.

Ron Buchalski

What to do is:

1 PIX:

-static map the ACS/GANYMEDE to a public IP address

static (inside, outside) x.x.x.10 10.1.1.25 netmask 255.255.255.255

-otherwise, if you have enough public IP, use the port forwarding for card IP ACS to PIX outside IP of the interface, IE x.x.x.2, via a specific TCP 49:

public static tcp (indoor, outdoor) interface 49 10.1.1.25 49 netmask 255.255.255.255

* allow ACS talk to external router via public IP

Create/add entry for ACL applied to the outside interface to allow the GANYMEDE Protocol + switch router external to the ACS:

access outside permit tcp host XXX1 host x.x.x.10 eq 49 list (Ganymede + use tcp 49)

outside access-group in external interface

* x.x.x.1 = outside the router

2 ACS

-Add the outside router IP (FastEthernet face PIX outside interface) interface as a client of the AAA

-Making of course secret key is identical at ACS and router

3. the outside router

-Add the ACS as radius-server using its IP public, as mapped in PIX which is x.x.x.10.

-check the key AAA statement is accurate.

The test without saving the config is outside the router. Save ok once confirmed.

I have similar facility before, and it worked very well.

Pls note all useful message (s)

AK

Change the default file for downloads and some user folders locations

A big thank you to all who have helped me, more recently DAXnnn and try * 3. I come once more in need with questions. For the cleaning of my boot partition before cloning to a smaller SSD, I'm getting cause folders USER My Documents, my music, my pictures, and my videos to be moved to a different physical disk drive. I also want to do the same with the downloads. After trying to use MKLINK (without success) and the location of the tab in the properties for folders (in vain), try * 3 put me on editing the registry. While I did not yet any change, I followed his instructions to look under HKEY > CurrentUser > software > Microsoft > Windows > CurrentVersion > Explorer > Shell user folders and confirm watch registry.

What I found is that the actions I took before running into problems using the options of localities had caused registry entries updated to show the new names of path of My Documents (under personal in the registry path) and my music. This leaves downloads, my pictures, and my videos to be changed before the data transfer of the boot partition to reduce before cloning. I discovered the writings of my pictures and my videos contain a variable %UserProfile% then the names of folders. My assumption (often a wrong thing to do, I know) is that I can change these entries replacing %UserProfile% with the name of path, including the drive etc letter describing where I want to move the old data and write new data and changes. IS THAT CORRECT?

Regarding downloads, what I discovered is the second entry in HKEY > CurrentUser > software > Microsoft > Windows > CurrentVersion > Explorer > User Shell Folders, below (default) is a name {374DE290-123F-4565-9164-...}, displayed once indicating the value of % USERPROFILE%\Downloads. Using my penchant for the skip logic, I assume that I can edit this article replace the value data with the path name where I want future writing downloads. IS THAT CORRECT?

If I can confirm or correct information, I am very close to stripping the size of my partition boot prefixed operation clone to place what's left on my SSD.

Thanks to all for participating in such a large forum community!

HR

Yes you are right. If you want that your download location for be moved, just change:

Old: %userprofile%\downloads

New: E:\OtherDrive\Some Windows\

This will make all your downloads stored in the folder 'folder of some '. Just be sure to include a folder name and make sure that this folder actually exists. Make sure not to say a disc like E:\ or all your documents could get dumped at the top of this reader, rather than in a folder.

separate channels for bass and drums

Hi, I want to be able to separate the channels of learning right goal: piano and battery left. bass and drums.

All of the suggestions. I've done it before, but I forgot how...:)

Thanks Stan

Hey Stan,

Thanks for posting your question in the Microsoft Community!

I suggest using your favorite search engine and find an app that helps you in learning

Note: Using third-party software, including hardware drivers can cause serious problems that may prevent your computer from starting properly. Microsoft cannot guarantee that problems resulting from the use of third-party software can be solved. Software using third party is at your own risk.

I hope this helps.

Discovers the connection Broker (the same external and internal DNS) URL

I am trying to determine if its possible to connect internal broker who resolves internal view.compay.com (10.1.1.10) and say a security server located in the DMZ that resolves itself into view.company com (199.10.10.10). Is it possible to keep this view.company.com for both? At the moment we just solve internally to desktops.company.com, but I am trying to determine how it would be possible to use the same in both.

You can have the will of the URL to the same name. We have our internal DNS pointing to the name company.view.com and then from outside company.view.com resolves to our security server.

Separate authentication for external and internal users?

Similar Questions

Maybe you are looking for