Authentication URL responded with an illegal response code error in ADF - web-services

I am trying to create an authentication in ADF mobile where the login URL is the peoplesoft login page. When i give in the username and password in the emulator, it throws an error.\
Terminating
Authentication URL responded with an illegal response code.
It is not basic authentication end point.
Please contact administrator
I have followed the following tutorial
https://blogs.oracle.com/shay/entry/accessing_secure_web_services_from
Here instead of creating a remote secured login server, I want to use peoplesoft to authenticate.Any Ideas?
I have also seen somewhere that you can authenticate each web service you call by adding the username and password in the SOAP header. Any tutorials for ADF would be much appreciated and #Shay Shmeltzer any ideas would be helpful
Thanks

Oracle MAF only supports security authentication against HTTP Basic Authentication pages, so I don't think you can use peoplesoft login page to authenticate neither your application nor you web services.
Otherwise you can create a secure ADF page the validates login through peoplesoft login credentials(username-password) then deploy that page to a server and secure your MAF application using that page.
Some useful links
Accessing Secure Web Services from ADF Mobile
ADF Mobile - Secured Web Service Access
ADF Mobile Application Security
And about your second question yes you can customize the envelop header being send from MAF application to a soap webservice (add username and password or any other attributes) by extending the SOAPProvider class and add it to the datacontrol.dcx file as the provider for the webservice.
The only example I can find online
http://docs.oracle.com/cd/E37975_01/doc.111240/e24475/amxwebservices.htm#autoId3

Related

Need Help to do Login authentication oauth2.0 while load testing

I have a BlazeMeter Pro account and I am stuck on the step I try to record in Jmeter and also try with BlazeMeter recording but not able to do it.
Now flow is I have to login into the system and perform the operation, we implement oAuh2.0 from the development side to authenticate the user from the Gmail and we face issue while record script that user is not able to authenticate to login when you hit with single or multiple users.
to authenticate I need all the below parameters and I have all details but now in Jmeter or BlazeMeter, I do not understand where I add all details.
client_id=
client_secret=
refresh_token=
grant_type=refresh_token
we are implementing a following steps at record time
Load a respective URL and open Gmail Login page
After Enter email and password page is redirect and particular website will be display
After enter user name and password on the website UI is display.
Please guide me on how I implement this and process my flow for load testing.
As per Google documentation in OAuth 2.0 for Client-side Web Applications you need to
Send a request to https://accounts.google.com/o/oauth2/v2/auth with:
client_id
redirect_uri
response_type
scope
parameters.
This request you should be able to record using your favourite recording option.
In your case you need to change this redirect_uri to some web server which you control as you will receive the token there in form of https://your_redirect_url_here/callback#access_token=your_token_will_be_here&token_type=Bearer&expires_in=3600
It's a good idea to use HTTP Mirror Server for this purpose.
Once you get the token you will be able to add HTTP Header Manager and configure it to send Authorization header with the value of Bearer ${your_token}
More information:
OAuth 2.0 Documentation
OAuth 2.0 Playground (if your application uses different flow you can replicate it there and see relevant requests/responses which can be later on implemented in JMeter)

Can we publish a web application running on a different server in WSO2 APP Manager 1.0.0?

I am publishing a web application in WSO2 APP manager 1.0.0.After subscription, I am able to land on the login page of the application but once providing the credentials, blank page is seen.I would like to know if there are any configurations needed in the wso2 app manager for the server in which web app is running for invoking the web app properly.
When you say you were able to land on the 'login page' do you mean the login page of App Manager Login or the log in page of the Web App?
What are the errors/exceptions logged on the console?
If it is the App Manager log in page this could be related to incorrect service provider details recorded against the web application (Eg: incorrect Assertion Consumer URLs etc).
If you are referring to the Application's log in page, this could happen due to the App being secured with username/password.
When an App is secured, App Manager needs to send a JWT token as a HTTP header to the back-end Application once the user is authenticated.
In this case a few changes are required to be made in the App itself to support this.
The App should be modified to read the JWT token and identify the user and skip giving the login page.
The document [1] explains this in detail.
[1] https://docs.wso2.com/display/APPM100/Securing+Web+Applications+Using+JWT

Websphere Portal 7 Custom Login Portlet

I want to develop custom form based login portlet because I have to validate the user crendential (username/password) using calling some webservice provided by the customer as he is maintaining the user credential in his side not in the portal side, So that if the webservices returns true then I need to authenticate the user to the Portal and redirect to some specific portal page.
Note: based on the customer request, the user's password is not stored in default portal LDAP which means, I can not use the portal Login service.
How can ask the portal to authenticate some user without passing the password in my custom login portlet?
thanks in advance.
You'll want to look at the WebSphere Application Server Trust Association Interceptor mechanism for what (to the portal and appserver) is password-less authentication.
Here is a post that outlines the steps you'll take. You won't be using WPS mechanisms other than your custom portlet for gathering credentials. The rest uses a common technique in the underlying WebSphere App Server.

passing user credentials to web service

I have the following scenario:
I have an application (html files + javascripts hosted in a webserver)
There is a SOAP web service that we need to develop.
Web service will be called from java script (AJAX calls).
User will access the application in intranet scenario. Users are validated against active drectory.
Requirement states that user need to be logging in using logged in users network credentials. There should not be a login screen shown to user.
Web service interfaces need to be invoked with logged in users credentials. A login inteface of web service specifically needs to be called as first call.
I have a specific question on how to pass user credential to web service.
I am planning to configure Integrated windows authentication (NTLM) for web application to avoid login screen.
However I do not know a way to capture and send user id and password to login interface of web service.
Most of the questions and answers around this topic has been for microsoft technlogies. Any specific ideas?
Further research and several blog posts pointed me to Kerberos authentication and a single sign on framework. With NTLM i cannot delegate credentials to web service. However with Kerberos i can. I will be using SPNEGO and delegate the credentials after authentication. Please refer to below link for further details.
http://spnego.sourceforge.net/

login password web service Java

i'm developping a mobile application in Android and blackberry, I want that Users can connect from their Smartphones to Webservice witch will verify their login and password in an Oracle Database, I should maintain connection between Client and server within Sessions.
my webservice should be under apache Tomcat using Axis2.
how can I implement this Session via Soap Messages ???
Thanks in advance :)
its best if you could get this without having to maintain sessions. if maintaining session is a must, you'll have to pass authentication details with each soap request along with a token or a session status object where at each end you'll be manually updating with status.