Your organization likely has IT standards and policies relating to authentication. For instance, your network login may require a password value longer than 5 characters, or your network account may be locked after three failed login attempts. The E-Business
suite finally offers some of these same controls (although not until the later versions of 11i and Release 12). These controls are established within the E-Business Suite by setting system profile values.
The following E-Business Suite profile options address the basic User Authentication level in an Applications Security model.
- Signon Password Failure Limit - By default, there is no account lockout after a failed number of login attempts. This is just asking to be hacked! I recommend setting a failure limit using the Signon Password Failure Limit profile option. Prior to release
11.5.10, you needed to implement an alert (periodic), custom workflow or report to notify security administrators; now the system ‘locks’ the account. In addition, I recommend notifying security administrators of a lockout by monitoring FND_UNSUCCESSFUL_LOGINS
and ICX.ICX_FAILURES tables. Both the FND_UNSUCCESSFUL_LOGINS and ICX.ICX_FAILURES tables capture failed login attempts from the Personal Home Page (Self Service/Web Interface), but failed Forms sessions are only logged to FND_UNSUCCESSFUL_LOGINS.
- Signon Password Hard to Guess - The Signon Password Hard to Guess profile option sets internal rules for verifying passwords to ensure that they will be "hard to guess." Oracle defines a password as hard-to-guess if it follows these rules:
o The password contains at least one letter and at least one number
o The password does not contain repeating characters.
o The password does not contain the username.
- Signon Password Length - Signon Password Length sets the minimum length of an Oracle Applications password value. The default length is 5 and I recommended 8.
- Signon Password No Reuse - This profile option is set to the number of days that must pass before a user is allowed to reuse a password.
- Signon Password Custom - This profile option is used if you want to define your own password scheme (validated by custom Java code) in a custom Java class. This would be used if you have a more advanced and complex password value requirement that is not
supported by the site profiles described in this paper. For example, your password policy could state that the password value must have a numeric value, an uppercase value, and a special character. If this were the case, you would not be able to enforce that
password policy with the existing Oracle E-Business Suite profiles, so you would need to create a custom password java class and set the profile value to that class name for Signon Password Custom.
- Signon Password Case - This profile option is used to force case sensitivity in user passwords. By default in Release 11i, this profile is not populated and the system action defaults to being ‘Insensitive’. This option allows for tighter security, as well
as for better integration with Oracle Internet Directory, because it also allows case sensitive passwords. The Define Users form and the Signon form now accept case-sensitive passwords. I recommend setting the Signon Password Case profile value to “Sensitive”
at the site level. Setting this profile on an existing system has no affect on existing passwords already stored in the system. The case sensitivity will start to take affect the next time a password value is changed – it is then that the rule is applied.
Note that this profile option was introduced with 11i.ATG_PF_H Rollup 4. There was an earlier attempt in 11i.ATG_PF_H Rollup 3 to implement a similar profile option, ‘Set Password Case’ with three possible values, ‘Insensitive’, Sensitive’, and ‘Mixed’.
MetaLink Note 337274.1, “About Oracle Applications Technology 11i.ATG_PF_H Rollup 3 describes this deprecated profile. You will note that the profile option name for this profile did not match the naming convention used by the other password profiles. It appears
that Oracle has corrected this with MetaLink Note 365228.1, “About Oracle Applications 11i.ATG_PF.H Rollup 4 (RUP 4)” says that “Mixed” is no longer supported. Users can see, but not update this profile option.
o Insensitive - Passwords are treated as case insensitive. In this mode, the passwords are stored and compared in uppercase, similar to that in earlier releases. During user authentication password validation, the entered password and the decrypted password
are compared in uppercase. If the passwords do not match, an error is displayed.
o Sensitive - Passwords are stored and compared as they are, with the password case preserved. During validation, the entered password must match the decrypted version otherwise an error message is displayed. With Release 12, this option is the default behavior.
All newly created or changed passwords are treated as case sensitive.
Note: Users who have not changed their passwords since the installation of Release 12 are not affected until they do change their passwords.
Note that by default, Oracle generally does not set these parameters for you. You will need to set up or change the default values to explicitly configure/enable the profile parameters.
分享到:
相关推荐
android-beacon-libary的使用android-beacon-libary的使用android-beacon-libary的使用android-beacon-libary的使用android-beacon-libary的使用android-beacon-libary的使用android-beacon-libary的使用android-...
提供与信标交互的api的android库。请访问
This document describes the air interface of the Metropolitan Beacon System (MBS) system. MBS provides a high precision, reliable, consistent positioning system indoors and in urban canyons, ...
Android Beacon Library An Android library providing APIs to interact with beacons. Please visit the project website for how to use this library. IMPORTANT: By default, this library will only detect ...
Android使用android-beacon-library接收beacon
android beacon 开发库 可以放心使用,里面包含源代码和测试代码
变更日志2015年5月18日,v1.0.1:更新为nutella_lib 0.6.1,放弃了npm 2015年5月11日,v1.0.0:已更新至nutella_lib 0.5.4,已移至npm 2015年4月16日,v0.2.0:更新为nutella_lib 0.4.3#beacon-simulator-interface
learn beacon scanner with android
Android信标库 一个提供与信标交互的API的Android库。 请访问以了解如何使用该库。 重要说明:默认情况下,该库将仅检测符合AltBeacon规范的信标。 如果您希望该库与专有或自定义信标一起使用,请参见类。...
Cobal_Strike踩坑记录-DNS Beacon1
Team-Project-Beacon-App-Android-
Beacon技术未来发展猜想2014-04-25 阿尔法工场。
BEACON
Android AltBeacon库 Xamarin.Android绑定。 该库允许Android应用根据开放且可互操作的与BLE信标进行交互。 利用 从下载二进制文件 参考申请 此存储库中包含一个简单的,以演示测距邻近信标和... android-beacon-libr
luci-app-pymultimonaprs for all platform on openwrt 18.06 (20190415) add option to control beacon send or not send.
一款可以模拟BLE蓝牙的beacon信号的APP。 Beacon Simulator This app transforms your Android device into a virtual BLE beacon advertiser and transmitter. You can create your own collection of beacon ...
谷歌师兄的leetcode刷题笔记安装cups包 sudo apt-get install cups libcups2-dev 安装去 谷歌获取说明。 安装 Brother PT-P700 打印机 通过 USB 将标签打印机连接到 ..../beacon-barcode 使用-h显示命令行标志。
1、文档详解 2、无线-beacon 3、无线-认证 4、无线-认证全 无线抓包分析: Beacon 包:(无线没设密码) 2、beacon有无线密码 WPA1:WPA中有CCMP(AES)、无TKIP。无RSN ...6、认证 Auth
IoT Toolbox allows the end-user to improve their Out of the Box Experience, providing a user-friendly way to test the Bluetooth® LE zigbee and Thread demo applications developed for NXP Conectivity ...
基于Android Stuido的医疗类App,能够实现对社区居民的健康情况实现记录,并记录到数据库中。