I was surfing this evening and found a nice entry in Frank Nimphius's weblog from about a week ago. The entry is entitled http://www.orablogs.com/fnimphius/archives/000730.html - (broken link) J2EE Security: Struts “Shale” proposal does improve web application security.
This is an excellent short article that looks at J2EE security in web applications. Frank notes that current frameworks do not integrate well with the tools needed to build secure applications. He goes on to note that the current implementations of having security in the client, controller and business model is not ideal and multiple non synchronised configuration files or repositories are needed. Frank suggests that JAAS is suitable but doesn't implement end top end security. He talks about JSF and its problems of no application security integration and he goes on to introduce Asegi's security architecture.
Frank discusses Asegi framework and the issues of JAAS and discusses the Struts 2.x 'Shale' proposal. Frank finishes with his views of the possible future of this area. Interesting post, http://www.orablogs.com/fnimphius/archives/000730.html - (broken link) again its here.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Arup Nanda has a paper on Oracle Security Auditing part 1 on dbazine.com"] [Next entry: "Amis blog talks about SQuirrel - an open source database tool"]
December 2004
- Another great recovery disk - This time a CD - 12/01/2004 by 12/01/2004
- Three great papers on shell codes and encoding and decoding - 12/02/2004 by 12/02/2004
- Next Edward Stangler post in the missing catpatch.sql series - 12/03/2004 by 12/03/2004
- Edwards next post in the series of catpatch.sql issues. - 12/04/2004 by 12/04/2004
- Ed's final post in the issues with not running catpatch.sql is there - 12/05/2004 by 12/05/2004
- SANS announces the new Securing Oracle training course - 12/06/2004 by 12/06/2004
- Mary Ann Davidson held a guru chat session at OOW - 12/07/2004 by 12/07/2004
- Oracle Database 10g Release 2 keynote at Oracle Open World - 12/08/2004 by 12/08/2004
- Frank has a good example of simple J2EE form based authentication for ADF UIX - 12/09/2004 by 12/09/2004
- Justin Kestelyn sums up Oracle Open World - 12/10/2004 by 12/10/2004
- News.com article : Finally, a sensible security scheme - 12/11/2004 by 12/11/2004
- Comments have been disabled from my weblog - 12/12/2004 by 12/12/2004
- A useful post on c.d.o.s about ADMIN_RESTRICTIONS_{listener_name} - 12/13/2004 by 12/13/2004
- Arup Nanda has a paper on Oracle Security Auditing part 1 on dbazine.com - 12/14/2004 by 12/14/2004
- Amis blog talks about SQuirrel - an open source database tool - 12/15/2004 by 12/15/2004
- Howard Rogers on dropping the DBA, CONNECT and RESOURCE roles - 12/16/2004 by 12/16/2004
- Tools page updated - 12/17/2004 by 12/17/2004
- Mark has found a good paper on programming Java in stored procedures - 12/18/2004 by 12/18/2004
- Post about setting up and using autotrace - 12/19/2004 by 12/19/2004
- Tools page updated - 12/20/2004 by 12/20/2004
- Database user account status's in SYS.USER_ASTATUS_MAP - 12/21/2004 by 12/21/2004
- SYS.USER_ASTATUS_MAP missing values solved - 12/22/2004 by 12/22/2004
- All the JDeveloper presentations from Oracle Open World - 12/23/2004 by 12/23/2004
- Web site statistics page added - 12/24/2004 by 12/24/2004
- Encrypting JDBC thin connections with SQL*Net - 12/27/2004 by 12/27/2004
- XML DB Beta program for Oracle 10g release 2 - 12/28/2004 by 12/28/2004
- Role based security management in Oracle designer - 12/29/2004 by 12/29/2004
- A free Perl based Log Analysis tool - 12/30/2004 by 12/30/2004
- Happy new year for 2005 - 12/31/2004 by 12/31/2004
Archives
Syndication
Powered by gm-rss 2.0.0
