Focal Point Banner


As of December 1, 2020, Focal Point is retired and repurposed as a reference repository. We value the wealth of knowledge that's been shared here over the years. You'll continue to have access to this treasure trove of knowledge, for search purposes only.

Join the TIBCO Community
TIBCO Community is a collaborative space for users to share knowledge and support one another in making the best use of TIBCO products and services. There are several TIBCO WebFOCUS resources in the community.

  • From the Home page, select Predict: WebFOCUS to view articles, questions, and trending articles.
  • Select Products from the top navigation bar, scroll, and then select the TIBCO WebFOCUS product page to view product overview, articles, and discussions.
  • Request access to the private WebFOCUS User Group (login required) to network with fellow members.

Former myibi community members should have received an email on 8/3/22 to activate their user accounts to join the community. Check your Spam folder for the email. Please get in touch with us at community@tibco.com for further assistance. Reference the community FAQ to learn more about the community.


Focal Point    Focal Point Forums  Hop To Forum Categories  WebFOCUS/FOCUS Forum on Focal Point     Bypass security check for self-service page

Read-Only Read-Only Topic
Go
Search
Notify
Tools
Bypass security check for self-service page
 Login/Join
 
DKWAN
Silver Member
posted
Our reporting server is secured, and a signon page will be poped when any self-service page is executed.
However, there is a new page that we would like to allow public to see.
I'm told by the help line to hard-coded a userid/pw in the html page, or fex. this method is not the best because a VIEW SOURCE will see the id/pw by the world, so he suggested me to seek help here.

Do you have any idea that I can accomplish the OPENup of a html page to the world? thanks so much.



Prod: WebFOCUS 7.1.1 CGI - Self Service - Report Caster,Win2000/IIS
Output: HTML, Excel 2000 and PDF
 
Posts: 36 | Location: LOS ANGELES | Registered: February 01, 2006Report This Post
dhagen
Virtuoso
posted Hide Post
You could use a JSP page as the action of your form. That JSP page can then forward the request to the WFServlet including the required IBIC_user IBIC_pass and IBIF_ex parms. I suggest puting the IBIF_ex in the JSP so that it can only be used to execute that one report and not be a security problem.


"There is no limit to what you can achieve ... if you don’t care who gets the credit." Roger Abbott
 
Posts: 1102 | Location: Toronto, Ontario | Registered: May 26, 2004Report This Post
dhagen
Virtuoso
posted Hide Post
Example of JSP to do this. Note: this has to be part of the web focus web application. This example assumes it is part of the root directory of the web application.

bypass.jsp 
<jsp:directive.page language="java" import="java.util.*" />
<jsp:scriptlet>

     /**
      * check to see if someone is trying to run another IBIF_ex.
      * We are doing this because we cannot prevent a parameter from
      * being sent to the forwarded servlet call.  We want to prevent
      * a user from passing their own value of IBIF_ex.
      */
     String userId;
     String passWord;
     
	if (request.getParameter("IBIF_ex") == null) {
	     /* put good userid and password here */
		userId = "good-userid";
	     passWord = "good-password";
	} else {
	     /* put bad userid and password here */
		userId = "bad-userid";
	     passWord = "bad-password";
	}
	
</jsp:scriptlet>
<jsp:forward page="/WFServlet" >
     <jsp:param name="IBIF_ex"   value="carinst" />
     <jsp:param name="IBIC_user" value="<%= userId %>" />
     <jsp:param name="IBIC_pass" value="<%= passWord %>" />
     <jsp:param name="WF_AUTOSIGNON" value="NO" />
</jsp:forward>


Url examples:
 
 /ibi_apps/bypass.jsp
 /ibi_apps/bypass.jsp?COUNTRY=ENGLAND


"There is no limit to what you can achieve ... if you don’t care who gets the credit." Roger Abbott
 
Posts: 1102 | Location: Toronto, Ontario | Registered: May 26, 2004Report This Post
DKWAN
Silver Member
posted Hide Post
Thanks. Since I have not much jsp, java experience, I'llpass the code to another group to review.
thanks agian



Prod: WebFOCUS 7.1.1 CGI - Self Service - Report Caster,Win2000/IIS
Output: HTML, Excel 2000 and PDF
 
Posts: 36 | Location: LOS ANGELES | Registered: February 01, 2006Report This Post
  Powered by Social Strata  

Read-Only Read-Only Topic

Focal Point    Focal Point Forums  Hop To Forum Categories  WebFOCUS/FOCUS Forum on Focal Point     Bypass security check for self-service page

Copyright © 1996-2020 Information Builders