Currently, Siebel Business Applications provide options for authenticating HTTP EAI and HTTP Web service requests through credentials that can either be passed as a part of the request body, or as a part of the request URL.
From Siebel CRM version 8.2.2.0 and Siebel CRM version 8.1.1.9, Oracle recommends that you do not use URL-based authentication for any integration with a Siebel application. By default, this authentication method will be disabled in Siebel Business Applications. Following the release of Innovation Pack 2013, Oracle will no longer support any use of URL-based authentication.
Why this change?
Oracle is committed to providing customers with a range of solutions for authentication. However, a number of attack vectors have been established for URL-based authentication and, accordingly, URL- based authentication is no longer regarded as an acceptably secure mechanism for enterprise applications. In addition, the inclusion of credentials in the URL can lead to the inadvertent exposure of a user’s credentials if the user shares a URL as a bookmark or favorite.
What is supported?
Siebel Business Applications support the Web Services Security (WS-Security) specification industry standard. The WS-Security specification is a Web services standard that supports, integrates, and unifies multiple security models and technologies, allowing a variety of systems to interoperate in a platform-independent and language-independent environment.
Transitional solution
Oracle understands that some customers will need time to implement these changes, and that in the case of integrations, many of the users of URL-based authentication are either external consumers, or in projects not directly related to the Siebel CRM program.
As a transitional arrangement, therefore, Oracle is providing a parameter, EnableURLCredentials, which you can add to the eapps.cfg file. Set the value of the EnableURLCredentials parameter to TRUE to enable the continued use of URL-based authentication.
The following table shows how the EnableURLCredentials parameter affects the default setting for URL-based security credentials authentication that has been configured for a Siebel CRM release.
Siebel Application Version Default Setting for URL-based Authentication EnableURLCredentials Parameter Value TRUE FALSE Any Other Value 8.2.2.0 or higher Disabled Enabled Disabled Disabled 8.1.1.9 or higher Enabled Enabled Disabled Enabled
End of transitional solution
Following the release of Innovation Pack 2013, Oracle will no longer support any use of URL-based authentication, and the EnableURLCredentials parameter will be removed from the Siebel CRM product. All customers must plan on using alternative authentication schemes before this time.
0 comments:
Post a Comment