- Run “hostname” to get your server's new hostname from DNS server.
- Run “cd /u01/app/oracle/product/11.2.0/xe/network/admin”
- Replace “localhost.localdomain” in file listener.ora with your new hostname.
- Replace “localhost.localdomain” in file tnsnames.ora with your new hostname.
- tnsping yurNewHostName and see XE instance is running.
Saturday, April 20, 2013
How to reconfigure Oracle Express listeners after changing hostname
After the computer has hostname changed, the Oracle Express 11 may not work as its configuration still point to old hostname. Hostname may be changed when the machine's network work status is changed. For example, I used NAT mode for my virtual machine. After I change its NIC to have Bridge mode, the hostname may be changed. Here is my steps to reconfigure Oracle Express listeners to bind on new hostname.
Saturday, March 30, 2013
OAuth 1.0 and OAuth 2.0, three-legged authenticaton and two-legged authentication
It is easy for a Web developer to understand why we need OAuth1.0. It is a three legs scenario: 1) Web browser user, 2) third party service provider that want to access user's info from 3) OAuth provider that hosts user's valuable info.
So, for the reason of security, web browser user should not just gives third party web site his/her user name and password to get info on behalf of himself/herself. You know, not every web site could be trusted. It is not only because of immoral web sites may use your personal info in wrong way but also because of their capability of securing your privacy. Therefore, URL redirecting comes into OAuth framework. Also, web browser use may not want to allow the web site to access all info hosted in OAuth service provider's site. Therefore, the OAuther plays as authorization framework too. Furthermore, for the reason of light encryption and signature, HMAC was employed. But, OAuth2.0 drop the signatures and asks the authorrization request to be send over SSL/STL, in which securet key is delivered and directly validated. So, in OAuth2.0, there is no requirements for the order of parameters. However, the benefit is not cost free as the server and client have to spend more resource to handle SSL communication.
To be used in native app, like movbile app, OAuth2.0 standardize the extension about two legs authorization, which I think there is security problem. You may think a server or user's own server could be trusted to have user's cridential info. But, it will be highly risk to implement two leg flow in a mobile app, which may be used on large amount device and different people. Here is an article about OAuth2.0 and the road to hell. But, in case of users want to make their own application to get info through OAuth service provider. It doesnot matter to use password flow. And put this flow under the name of OAuth (OAuth 2.0 actually).
Below is three different flows from Salesforce as examples. It is important for developer to understand which flow they need to start with according to their use case. It is interesting to see they declare that their flow is for authenticating purpose. What is the difference between authenticationa nd authorization if all resources are expose once authentication is past.
OAuth 2.0 User-Agent Flow
OAuth 2.0 Web server
OAuth 2.0 Username-Password Flow
So, for the reason of security, web browser user should not just gives third party web site his/her user name and password to get info on behalf of himself/herself. You know, not every web site could be trusted. It is not only because of immoral web sites may use your personal info in wrong way but also because of their capability of securing your privacy. Therefore, URL redirecting comes into OAuth framework. Also, web browser use may not want to allow the web site to access all info hosted in OAuth service provider's site. Therefore, the OAuther plays as authorization framework too. Furthermore, for the reason of light encryption and signature, HMAC was employed. But, OAuth2.0 drop the signatures and asks the authorrization request to be send over SSL/STL, in which securet key is delivered and directly validated. So, in OAuth2.0, there is no requirements for the order of parameters. However, the benefit is not cost free as the server and client have to spend more resource to handle SSL communication.
To be used in native app, like movbile app, OAuth2.0 standardize the extension about two legs authorization, which I think there is security problem. You may think a server or user's own server could be trusted to have user's cridential info. But, it will be highly risk to implement two leg flow in a mobile app, which may be used on large amount device and different people. Here is an article about OAuth2.0 and the road to hell. But, in case of users want to make their own application to get info through OAuth service provider. It doesnot matter to use password flow. And put this flow under the name of OAuth (OAuth 2.0 actually).
Below is three different flows from Salesforce as examples. It is important for developer to understand which flow they need to start with according to their use case. It is interesting to see they declare that their flow is for authenticating purpose. What is the difference between authenticationa nd authorization if all resources are expose once authentication is past.
OAuth 2.0 User-Agent Flow
OAuth 2.0 Web server
OAuth 2.0 Username-Password Flow
http://stackoverflow.com/questions/7561631/oauth-2-0-benefits-and-use-cases-why
http://hueniverse.com/2012/07/oauth-2-0-and-the-road-to-hell/
http://www.wolfe.id.au/2012/10/20/what-is-hmac-and-why-is-it-useful/
Subscribe to:
Posts (Atom)