How to secure your EBS platform

Did you know that Oracle provides you documentation on how to successfully configure the Oracle EBS for security?  It's true!  My Oracle Support note 403537.1 details the items for R12, while note 189367.1 goes over what you need to do on the older R11 version of EBS.

Since this is Security Week, I'll go out with a bang and tell you that while you're thinking security you should visit notes 564125.1 and 443353.1 as well to find out how to setup password security and how to change the GUEST password respectively.  Now let me ask a question.  Did you enjoy Security Week or did it fail to deliver for you?  Let me know in the comments!

Don't mix and match your GUEST passwords

Continuing Security Week here, My Oracle Support note 602425.1 tells you what happens when you change the password for the GUEST account to all lowercase or mixed characters in R12.  This type of situation reminds me of a time where we went to a single sign-on application but didn't test any permutations of accepted user passwords so there was a range of symbols which went untested before release.  When we made the switch to the new solution, it was in conjunction with a localization patch as well so it made it hard to understand what was causing a very small group of users not to be able to successfully log into the EBS system.  It wasn't until we did additional research like enabling logs and asking specific questions about what was in their passwords (without actually getting the passwords of course) that we realized the population having the problem all had special characters in their passwords and that the translation of the passwords from one system to another wasn't setup to allow the special characters until we could release a hot fix to the system.

Security Week - GUEST during password change

This started out perfectly innocently as I needed to go into a test environment and reset a user account password so that they could get into the application and test something out.  Imagine my surprise when I encountered this scenario!

USERA logs into the application, in a second window USERB logs into the application but is prompted for a password change; going back to the first window and logging out USERA provides you with a returning User ID of GUEST for some strange reason and not USERA.  This means to me that before USERB gets authenticated, the Oracle EBS utilizes the GUEST user account and gets an authenticated session with that user ID.

This pretty much blew my mind, and lead me to do some more investigation of security issues related to user security for EBS so this week I give you "Security Week" after finding quite a few interesting nuggets from My Oracle Support.

Even better to prove my original hypothesis, going back to the window for USERB and trying to complete the password change attempt results in this message being displayed:

Error : You do not have a current session, please log in before visiting this URL.