text:
The number of anti-mining activists is dwindling near the BHP Billiton mine in outback South Australia as most make their way home.
Topics: activism-and-lobbying, mining-environmental-issues, olympic-dam-5725, roxby-downs-5725, sa
Posted| Updated
Topics: activism-and-lobbying, roxby-downs-5725, olympic-dam-5725, sa, australia
Posted| Updated
Police have made several arrests as a big group of anti-mining protesters gathered near Olympic Dam in outback South Australia.
Topics: activism-and-lobbying, mining-environmental-issues, mining-industry, uranium-mining, olympic-dam-5725, roxby-downs-5725, sa, australia
Topics: activism-and-lobbying, law-crime-and-justice, police, olympic-dam-5725, roxby-downs-5725, sa, australia
Posted| Updated
Topics: activism-and-lobbying, mining-environmental-issues, olympic-dam-5725, roxby-downs-5725, sa, australia
Topics: activism-and-lobbying, olympic-dam-5725, roxby-downs-5725, sa, australia
Topics: activism-and-lobbying, mining-environmental-issues, olympic-dam-5725, roxby-downs-5725, sa, australia
Posted| Updated
Police made 13 arrests as anti-uranium protesters on the fourth day of protests against plans to expand the Olympic Dam mine in SA.
Topics: activism-and-lobbying, uranium-mining, olympic-dam-5725, roxby-downs-5725, sa, australia
Anti-nuclear protests continue at South Australia's Olympic Dam mine after yesterday's march was stopped by police.
Topics: activism-and-lobbying, uranium-mining, government-and-politics, olympic-dam-5725
Posted| Updated
Police are to close roads leading to the Olympic Dam mine in the outback because protesters say they will try to blockade the site.
Topics: activism-and-lobbying, law-crime-and-justice, roxby-downs-5725, olympic-dam-5725, port-augusta-5700, sa, port-pirie-5540
Posted| Updated
An Aboriginal elder takes a legal fight against the planned Olympic Dam mine expansion to the full court of the Federal Court.
Topics: land-rights, indigenous-aboriginal-and-torres-strait-islander, aboriginal, community-and-society, indigenous-policy, courts-and-trials, law-crime-and-justice, olympic-dam-5725, roxby-downs-5725, port-pirie-5540, port-augusta-5700, sa, adelaide-5000, australia
An Aboriginal elder will today continue his fight in the Federal Court to stop BHP Billiton's proposed expansion of the Olympic Dam mine in far north South Australia.
Topics: mining-industry, indigenous-aboriginal-and-torres-strait-islander, courts-and-trials, olympic-dam-5725, port-augusta-5700
Posted| Updated
The Centre for Economic Studies is warning against pinning SA's future prosperity on a mining boom.
Topics: economic-trends, mining-industry, uranium-mining, industry, business-economics-and-finance, university-and-further-education, states-and-territories, government-and-politics, federal---state-issues, mining-rural, research-organisations, sa, adelaide-5000, olympic-dam-5725, port-augusta-5700, adelaide-university-5005, port-pirie-5540, roxby-downs-5725
BHP Billiton is buying five exploration licences in outback South Australia from Perth-based company Tasman Resources.
Topics: company-news, mining-industry, industry, business-economics-and-finance, mining-rural, sa, olympic-dam-5725, woomera-5720, australia
The Australian Conservation Foundation has rejected outright that nuclear power would be a better alternative for parts of South Australia's outback.
Topics: nuclear-energy, solar-energy, wind-energy, nuclear-issues, environmental-management, olympic-dam-5725, port-augusta-5700, port-lincoln-5606, port-pirie-5540, roxby-downs-5725
A nuclear power advocate thinks it is inevitable Australia will embrace nuclear energy, but the SA Premier rejects that.
Topics: nuclear-energy, alternative-energy, environment, university-and-further-education, community-and-society, industry, nuclear-issues, federal---state-issues, states-and-territories, energy, sa, adelaide-university-5005, adelaide-5000, olympic-dam-5725, roxby-downs-5725, australia
Posted| Updated
Analysts say the future of BHP Billiton's proposed $30 billion Olympic Dam mine expansion in South Australia seems increasingly uncertain.
Topics: business-economics-and-finance, mining-industry, company-news, australia, olympic-dam-5725, roxby-downs-5725, adelaide-5000, sa
Posted| Updated
The time frame appears to have pushed out to the last possible moment for a board decision on any expansion of the big Olympic Dam mine.
Topics: mining-industry, uranium-mining, industry, company-news, business-economics-and-finance, states-and-territories, mining-rural, government-and-politics, sa, olympic-dam-5725, roxby-downs-5725, adelaide-5000, australia
Posted| Updated
SA Premier Jay Weatherill told 891 ABC he remained confident about the future of the Olympic Dam mine expansion. Read the story.
Topics: states-and-territories, federal---state-issues, uranium-mining, mining-industry, industry, company-news, business-economics-and-finance, mining-rural, olympic-dam-5725, roxby-downs-5725, port-pirie-5540, port-augusta-5700, adelaide-5000, sa
Posted| Updated
The SA Premier said he still expected the Olympic Dam mine expansion to proceed, despite BHP Billiton planning to shelve some spending plans.
Topics: states-and-territories, federal---state-issues, government-and-politics, company-news, uranium-mining, mining-industry, industry, business-economics-and-finance, sa, olympic-dam-5725, roxby-downs-5725, port-pirie-5540, port-augusta-5700, adelaide-5000, australia
Posted| Updated
Ahead of the federal budget, SA Premier Jay Weatherill has put in writing his view on the importance of the diesel rebate to mining.
Topics: federal---state-issues, budget, activism-and-lobbying, government-and-politics, states-and-territories, mining-rural, rural, mining-industry, uranium-mining, industry, sa, olympic-dam-5725, roxby-downs-5725, port-pirie-5540, port-lincoln-5606, port-augusta-5700, australia
An Aboriginal elder wants a judicial review in the South Australian Supreme Court of the State Government's decision to approve the Olympic Dam mine expansion in the state's outback.
Topics: courts-and-trials, law-crime-and-justice, states-and-territories, government-and-politics, aboriginal, indigenous-aboriginal-and-torres-strait-islander, community-and-society, mining-industry, mining-rural, sa, olympic-dam-5725, roxby-downs-5725, port-pirie-5540, port-lincoln-5606, port-augusta-5700, adelaide-5000
Posted| Updated
The Federal Court dismisses a bid by an Aboriginal elder to overturn a proposed expansion of the big Olympic Dam mine.
Topics: courts-and-trials, mining-environmental-issues, environment, mining-industry, uranium-mining, mining-rural, aboriginal, indigenous-aboriginal-and-torres-strait-islander, land-rights, olympic-dam-5725, port-augusta-5700, port-pirie-5540, sa, australia
At outback Roxby Downs, some women have given up careers to allow for their husbands' work at the Olympic Dam mine.
Topics: women, community-and-society, mining-industry, rural-women, rural, mining-rural, human-interest, roxby-downs-5725, olympic-dam-5725, sa, adelaide-5000, port-augusta-5700, port-lincoln-5606, chile, port-pirie-5540, south-africa, australia
Posted| Updated
A private report says the Olympic Dam mine expansion holds the key to transforming SA's economic landscape.
Topics: economic-trends, mining-industry, uranium-mining, business-economics-and-finance, industry, states-and-territories, government-and-politics, mining-rural, olympic-dam-5725, roxby-downs-5725, port-pirie-5540, port-lincoln-5606, port-augusta-5700, adelaide-5000, sa


text: Diego Costa Gets Tripped Up In The Box To Win PenaltyGreg Howard6/13/14 3:47pmFiled to: 2014 WOrld cupsoccerspainthe netherlandsdiego costaScreamer38EditPromoteShare to KinjaToggle Conversation toolsGo to permalink Spain are playing the Netherlands, and took the lead midway through the first half when David Silva slipped a ball to striker Diego Costa on the left side of the box. He cut the ball back to his right, and an onrushing Daryl Janmaat slid, missed the ball, and clipped Costa's foot. Penalty. Advertisement Xabi Alonso finished the kick from the spot, and Spain went up, 1-0. The Netherlands, however, equalized just before half, and at intermission, the score is 1-1.Reply38 repliesLeave a reply

subset: commoncrawl


text:
Tips on Buying Stainless Cookware Sets
Tips on Buying Stainless Cookware Sets from Overstock.com. When you know what to look for, you'll be able to choose the best stainless cookware set for your kitchen.
Good quality. Purchased for use in RV....
ITEM#: 14050415This cookware set from Farberware features an aluminum construction with an easy-to-clean nonstick surface. This 12-piece set is dishwasher safe and is oven safe up to 350-degrees Fahrenheit.
|Aluminum, Metal
|Set Includes
|12 Piece
|See Details
|Country of Origin
Good quality. Purchased for use in RV.Read More
Gooddurability, nice feel to the handles, cleans easily.Read More
excellent and good with that price too, they look more expensive than the real priceRead More
I had been wanting this set for a little while now, so I was absolutely thrilled to be able to purchase it from Overstock! The price so much better than in a brick and mortar store and add in a special coupon and the deal was absolutely unbeatable! I am so happy with Overstock and how easy it is to get what you want, whenever you want! Thanks, Overstock!Read More
Awesome. The gift was actually for my mom. But my nephew lives with her and with in a day he cooked an omelette took a picture and sent it to me. Now he wants to be the next Iron Chef.Read More
Tips on Buying Stainless Cookware Sets from Overstock.com. When you know what to look for, you'll be able to choose the best stainless cookware set for your kitchen.
Best Reasons to Buy Cookware Sets from Overstock.com. Wondering if you should buy individual pots and pans or go with a cookware set? Here are reasons why you might choose a set.
Nonstick cookware is an asset in the kitchen for many reasons. Follow our handy tips to give your nonstick pots and pans the care they deserve.
Whether you prefer stainless steel over nonstick-coated cookware, or simply want to make your pans a little more versatile, we'll show you how to effectively season your cookware in 5 easy steps.
Best Pots and Pans from Overstock.com. Think about the recipes that you and your family enjoy, and make sure you have the right pot or pan for those meals.
How to Buy Cookware from Overstock.com. These tips will help you evaluate your needs, so you can buy the pots and pans that you'll get the most use out of.
Cookware Buying Guide from Overstock.com. When it comes to cookware, it's all about the metal, and here's what you need to know about the different types.
Best Cookware for Electric Stoves from Overstock.com. It's important to know which cookware material will work best with your type of electric cooktop.
Stainless Steel Cookware Care from Overstock.com. Caring for your stainless steel cookware is worth the effort to protect your pots and pans.
How to Season Cast-Iron Cookware from Overstock.com. Regular seasoning creates a natural non-stick surface and protects the cookware from rusting. Here's how to do it.
Evoke a sense of warmth and comfort combined with decorative elements in this jesGORDON farmhouse kitchen.
Our standard shipping method is ground shipping. We also offer expedited shipping for most items. Your final
shipping cost and estimated delivery timeframe will be available at checkout.
Standard shipping details
Expedited shipping details
This item is not returnable unless the problem you experience is the result of our error.
More Details
For your protection, all orders are screened for security purposes. If your order is selected for review, our Loss Prevention Team may contact you by phone or email. There may be a two business day delay to process your order.
** Most Oversize orders are delivered within 1-4 weeks. Some orders may take 6 weeks to be delivered.
Farberware Dishwasher Safe Nonstick 12-Piece Cookware Set **with $10 Mail-In Rebate**
Today: $68.99


text:
Palazzo Guinigi
Find Hotel Rates
Recent Searches
Wego searches multiple travel sites so you can find and compare the best rates.
Palazzo Guinigi Hotel Reviews
Based on reviews from across the web.
Palazzo Guinigi Hotel Details
Check-in: 14:00
Check-out: 10:30
Offering a 100-m² garden with tables and chairs, LuckyHouse B&B has a quiet location in Pisa, 350 metres from Pisa Centrale Train Station. It has excellent bus links around the city. Rooms are simply furnished and most have a wrought iron bed. All bathrooms are shared, and free Wi-Fi is available throughout. LuckyHouse is a family-run B&B with plenty of common areas to relax in. There are 2 lounges on the ground floor, with free internet terminals, and one upstairs with a cosy fireplace. The nearest bus stop is just 50 metres away for buses to Pisa historic centre. Pisa Airport is only 650 metres away, reachable with a 10-minute walk. A free covered bike and motorbike parking area is available, as is bicycle hire. Please let the property know your expected arrival time in advance.
The property does not have a reception. Please always let the property know your expected arrival time in advance. You can use the Special Requests box when booking or contact the property.


text:
Water resistant and roomy, these flat custom tote bags have reinforced stitching to carry more.
On the desk or on the go - this handy little Custom Sticky Note Book will get people to take note of your message.
A polyester promotional cooler bag that holds your lunch or up to 6 cans of your favorite beverages while showcasing your logo.
More custom candy, more flavor, and even more impact for your message when you choose individually wrapped Mega Mints.
BPA-Free and made of 100% biodegradable plastic, this logo water bottle is both healthy for you and the environment.
The most popular glass custom mug in the promotional industry.
Add ice cold beverages to these custom tumblers and watch in amazement as your tumblers change colors!
Great for scheduling, this handy custom desk calendar is sure to get your logo noticed.
These custom mugs have great appeal and will bring to mind all the fun that's found while sitting around a campfire.
The classic red campfire custom mugs will bring you back to your childhood, whether you were camping with your family or at summer camp.
This Irish coffee custom coffee mug is the crystal clear choice of employee awards and gifts worldwide.
A custom tumbler that only looks like a disposable to-go cup but can be reused every day.
A Book Shape Logo USB Drive is a perfect way to transport information.
Use a cross shaped custom cookie cutters as a Church, Suanday School or religous promotion for your office, school or event.
High quality printed chocolate, gift boxed with your logo imprinted right on the bar.
Show your customers that you have their best interests at heart with these heart shaped lapel custom sticker rolls.
A Sprout Tyme Imprinted Bird House Kit contains everything you need to assemble your own bird house.
Use heart shaped custom cookie cutters to hand out for Valentines or to show you care.
ePromos can help your church attend to your community by recommending ways to use the products and services available through us. Welcome new neighbors and church visitors with items that feature your church location, contact information, as well as any special events your church may host throughout the year. Our products can also be flawlessly incorporated into events, fundraisers, holiday parties, and more.


text: Proving Ground Co-Host's Blood-Alcohol Over Legal LimitBrian Ashcraft6/24/11 8:30amFiled to: Blipproving groundryan dunnNewsJackassCrimeLegalTragedy189EditPromoteShare to KinjaToggle Conversation toolsGo to permalinkAs previously posted, Ryan Dunn, the 34-year-old co-host, died in a car crash this week when he lost control of his Porsche 911, killing him and his passenger. According to Reuters, Dunn's blood-alcohol level was twice the legal limit. [Reuters] Reply189 repliesLeave a reply


text:
Shanghai site fetches year high of 4.6b yuan
Mainland developer snaps up plot at auction, pointing to renewed interest in land as better sales and liquidity lift sector's credit ratings
Related topics
Mainland developers' appetite for development sites is growing, with a company yesterday paying the highest amount in Shanghai this year for a commercial and residential site.
The market for land on the mainland, particular in first-tier cities, has turned active in the past two months, with a record number of transactions.
Beijing Fu Run Tian Cheng won the site with a bid of 4.6 billion yuan (HK$5.83 billion) at an auction.
The amount is higher than the previous record for the year of 3.78 billion yuan paid by Shanghai Pudong Development (Group) for a residential site in Pudong district last month.
It is also 57 per cent more than the opening bid of 2.93 billion.
Jim Yip Kin-shing, the managing director of investment at DTZ China, said the bid exceeded his expectations.
"The site is not located in the city centre and was worth about 25,000 yuan per square metre," Yip said. "Only sites in city centre could fetch 30,000 yuan per square metre. But now, the site sold for 29,229 yuan per square metre. You can see the land price is rising."
Du Jinsong, a research analyst at Credit Suisse, said: "Developers are turning active in land acquisitions as it is easier to raise funds through offshore bond markets this year."
Another reason was that the property market had improved from last year. "Developers are optimistic about the market this year," Du said.
In 2010, the overheated land market drove the government to impose measures to cool the market.
Du said he did not believe the government would release more cooling measures this time as the economy was weaker than three years ago.
The 40,355 sq metre site can be developed into a retail, office and residential complex with a total gross floor area of 157,377 sq metres.
According to Song Huiyong, the head of the research department at Centaline (China) in Shanghai, the average price of nearby office projects is about 50,000 yuan per square metre. "The winning bidder is still able to generate reasonable profit based on current property prices," he said.
Meanwhile, mainland developers' credit ratings have improved significantly this year because of better sales and liquidity, according to Moody's Investors Service.
In a survey of 40 developers, the rating agency gave 31 companies "stable" outlooks, up from 20 at the end of last year.
"The sector has rebounded from the trough in the middle of last year when there was negative growth in property sales value," Moody's analyst Franco Leung Chun-pong said.
"But pent-up demand has boosted sales and we see developers offering more flats that target end users, and they are able to sell more flats.
"Plus, we do not see any tightening of onshore bank loans, so the liquidity of developers has improved."
Moody's expects the credit profiles of the rated developers to be largely stable in the next 12 months.
It also found that dim sum bond issuance dominated the property industry last month, but the amount raised by developers in the offshore bond market fell to US$1 billion in the first 20 days of May, from US$1.58 billion last month.
Most Popular
- 1
- 2
- 3
- 4
- 5
- 1
- 2
- 3
- 4
- 5


text:
We've rounded up 7 fabulously scary things to see in London this Halloween! Are you scared yet?!
All My Sons, Hobson's Choice, Porgy And Bess and Twelfth Night will complete the 2014 Season.
The Royal Shakespeare Company's production of Roald Dahl's Matilda The Musical has teamed up with renowned London store Liberty for half term and the festive season.
The English National Ballet's stunning production of Nutcracker returns to the London Coliseum
Andrew Tomlins checks out current Queen Of The Night, Beverley Knight starring in The Bodyguard at the Adelphi Theatre.
The Imperial Ice Stars have brought their breathtakingly stunning production of The Nutcracker On Ice to London's most prestigious venue, The London Palladium.
The stars of Barking In Essex, Sheila Hancock and Keeley Hawes talk swearing, schooling and stocking fillers…
Michael Ball, Professor Brian Cox, Greg Dyke, Robert Lindsay and Gary Lineker are the latest big names to play God (a pre-recorded cameo role) in the West End production of Spamalot at the Playhouse Theatre. Each star can be seen as God for one week only to raise money for charity.
Following the critically acclaimed sell-out run at the Donmar Warehouse, The Weir to Wyndham's Theatre for twelve weeks only.
Last week the West End production of One Man, Two Guvnors held a gala performance to celebrate becoming the longest running show at the Theatre Royal Haymarket in its almost two hundred-year history.
Here are five West End shows not to be missed this half term! What are your #5Shows?
Andrew Tomlins reviews Once at the Phoenix Theatre
Disney's award-winning musical THE LION KING has now entered its 15th year at London's Lyceum Theatre.
See the EXCLUSIVE ONSTAGE INTERVIEW with Shaun Escoffery (Mufasa) and George Asprey (Scar) who talk about the magic of The Lion King.
The wait is finally over. Next week Tim Rice's new musical From Here To Eternity officially opens at the West End's Shaftesbury Theatre.
Casting has been announced for the West End premiere of Urinetown at the St James Theatre.
Each month we are asking a theatre blogger to write an exclusive article for London Theatre Direct. First up is Olivia Edmonds who, as well as being a full-time English teacher, runs theatre blog 'Thoughts of a Blue Eyed Girl'
London Theatre Direct's Andrew Tomlins reviews new musical THE COMMITMENTS.
The producers of Charlie and the Chocolate Factory have announced that the production has extended its West End run at the Theatre Royal Drury Lane by six months until 1st November 2014.
Since premiering at the National Theatre in May 2011, Richard Bean's comedy One Man, Two Guvnors has taken the world by storm.
Full casting has been announced for the West End Transfer of the Royal Opera House's (ROH) production of The Wind in the Willows.
You only have four weeks left to see Carrie Cracknell's critically acclaimed production of A Doll's House at the Duke of York's Theatre!
Andrew Tomlins reviews The Lyons at The Menier Chocolate Factory
We round up 5 West End shows you simply cannot miss this month!
We hate spam as much as you do! We will send only relevant content


text:
Trending articles:
- My Tweets
Read these recent posts:
- Cultivating Extraordinary Youth
- Creating Blended Learning Models That Work
- Predictive Analytics
- Trends | Digital Learning Day 2017
- Getting the Picture
- Trends | 2017 NMC Horizon Report
- Cool Tool | Boxlight's ProColor Interactive Flat Panel Displays
- Learning for the Future
- Cool Tool | SchoolMint
- Sparking Curiosity
- Follow edtechdigest.com on WordPress.com
Tag Archives: Ed-Fi Initiative
Is Data-Driven Instruction Dehumanizing?
GUEST COLUMN | by Lori Fey Data is a hot topic in education. For some people it raises a lot of fear. Is data-driven instruction really good for students and educators? Is it dehumanizing? Does it demoralize teachers? Does it … Continue reading


text:
Aubrey Beauclerk, 6th Duke of St Albans
From Wikipedia, the free encyclopedia
|This article does not cite any sources. (November 2007) (Learn how and when to remove this template message)
Aubrey Beauclerk, 6th Duke of St Albans (21 August 1765 – 12 August 1815) was the son of Aubrey Beauclerk, 5th Duke of St Albans. He was appointed a captain in the 34th (Cumberland) Regiment of Foot on 30 July 1783.
He married, firstly, Jane Moses (1768 – 18 August 1800), on 9 July 1788. They had one child:
- Lady Mary Beauclerk (30 March 1791 – 11 September 1845), married George Coventry, 8th Earl of Coventry and had issue.
He married, secondly, Lady Louisa Grace Manners (1777 – 19 February 1816), daughter of John Manners and Louisa Tollemache, 7th Countess of Dysart, on 15 August 1802 in London. They had one child:
- Aubrey Beauclerk, 7th Duke of St Albans (7 April 1815 – 19 February 1816)
|Parliament of Great Britain
|Preceded by
Samuel Thornton
Walter Spencer Stanhope
|Member of Parliament for Kingston-upon-Hull
with Samuel Thornton
|Succeeded by
Samuel Thornton
Sir Charles Turner
|Peerage of England
|Preceded by
Aubrey Beauclerk
|Duke of St Albans
|Succeeded by
Aubrey Beauclerk
|This biography of a duke or duchess in the peerage of England is a stub. You can help Wikipedia by expanding it.
|This article about a Member of the Parliament of Great Britain (1707–1800) representing an English constituency is a stub. You can help Wikipedia by expanding it.


text:
Blogs - Tags - authorization Blogs urn:lsid:ibm.com:blogs:entries 0 30 13 2015-05-15T16:43:55-04:00 IBM Connections - Blogs urn:lsid:ibm.com:blogs:entry-b87dad04-8ed4-4411-9ece-0e6291821af1 Authentication with OpenID Connect access tokens CalvinPowers 120000A09D active false CalvinPowers 120000A09D active false 81c130c7-4408-4e01-adf5-658ae0ef5f0c Comment Entries application/atom+xml;type=entry Likes true 2015-12-09T07:43:13-05:00 2015-12-09T07:46:36-05:00

Greetings,

Leo Farrell has just published a new article on developerWorks called "Configure an ISAM reverse proxy as a PEP to an OpenID connect provider."

IBM Security Access Manager (ISAM) added OpenID Connect (OIDC) as a federation protocol in Version 9.0. OIDC includes the ability to configure an OpenID Provider (OP), which can issue user identities (id_tokens), as well as access tokens used for authentication in the same way that OAuth Version 2.0 does. This article explains how to configure a reverse proxy as a policy enforcement point that is compatible with the OpenID Connect–issued access tokens.

This article will be of interest to anyone who wants to use this open standard with IBM Security Access Manager.
 Greetings, Leo Farrell has just published a new article on developerWorks called "Configure an ISAM reverse proxy as a PEP to an OpenID connect provider." IBM Security Access Manager... 0 0 2300 urn:lsid:ibm.com:blogs:entries-512b37f1-d6db-4785-89dc-f1dca2693303 Security on developerWorks 2017-02-21T03:11:43-05:00 urn:lsid:ibm.com:blogs:entry-65ff0112-d380-4a4f-880d-9a1d443a1615 How to troubleshoot a BPM user authorization problem - Part I Jia Tang 3100009WTC active false SteveWebb 0600009FE5 active false Comment Entries application/atom+xml;type=entry Likes true 2015-04-15T16:48:00-04:00 2015-04-15T16:50:07-04:00

 Many IBM Business Process Manager (BPM) clients have reported that end users did not get expected authorization privileges while operating human service activities in BPD – "You are not authorized to …"
 Hopefully this blog can help you resolve this kind of problem by yourself.

 You first need to check the BPD design, and ensure the human service activity is actually supposed to be routed to the user.

 If the task is assigned to a particular user, it's easy to determine whether the correct user is trying to claim/execute the task.

 If the task is assigned to a participant group/team (after V8.5.*), you need to check the participant group/team definition in Process Designer, and confirm whether the user is a member of the participant group/team, or if a member of a security group belongs to the participant group/team.

 If the task is assigned to a dynamic group or ad-hoc group - generated during runtime (via the assignment method: routing policy, custom, list of users; expression; team filter service etc.), you can hardly determine whether the user has permission to claim/execute the task during design time.

 Here are steps to check task assignment information in IBM BPM backend DB:

 Step 1. Check the task ownership in the LSW_TASK table. Query the LSW_TASK table with the target TASK_ID as where clause (TASK_ID can be found in Process Inspector).

 Step 2. If the task has been assigned to a specific user, the value of GROUP_ID will be -1, and there will be a serial of numbers in the USER_ID field. Then you can check if the USER_ID matches the user you want to run task with (Get USER_NAME or FULL_NAME via cross query LSW_USR_XREF table). If they do not match, by design the user can not view/claim/execute the task at all.

 Step 3. If the task has NOT been claimed by user yet, the value of USER_ID field will be -1, and there will be a valid GROUP_ID. The group could be ad-hoc group, participant group or team (new term after IBM BPM 8.5.*). You can get the group's GROUP_NAME, DISPLAY_NAME via cross query LSW_USR_GRP_XREF table. The GROUP_NAME is similar as below.

 I will use a simple example to demonstrate how to confirm if target user is member of the group to which the task is assigned.

 Task is assigned to team 'teamA' in Process Designer as below (in order to make it simple and clear, there is no team filter service to dynamically prevent certain users from being assigned to an activity)

 For user 'UserA', the user-group membership can be found within IBM BPM DB table LSW_USR_GRP_MEM_XREF.

 For user 'UserB', who is a member of internal security group 'GroupA', the user-group membership can be confirmed via cross query, see tables below.

 There may be much more complicated group-group memberships in real client scenarios, for example, security group 'GroupA' belongs to security group 'GroupB', and 'GroupB' is a member of team 'teamA', in that case, LSW_GRP_GRP_MEM_ EXPLODED _XREF could be used instead of LSW_GRP_GRP_MEM_ XREF, as that table contains nested membership information.

 Note: It is NOT suggested that you do any manual change on IBM BPM backend DB without IBM support's assistance. The above explanation is aimed to help you understand the user/group related backend DB tables, as well as the logic of IBM BPM task authorization.

 See "How to troubleshoot a BPM user authorization problem - Part II" for the other entry in this series.

 title image (modified) credit: (cc) Some rights reserved by Nemo

 Many IBM Business Process Manager (BPM) clients have reported that end users did not get expected authorization privileges while operating human service activities in BPD – "You are not authorized to …" Hopefully this blog can... 1 0 3744 urn:lsid:ibm.com:blogs:entries-87f2c5b1-89f4-4e8e-a371-d5f640e3e1e9 Application Integration Middleware Support Blog 2017-02-23T09:51:28-05:00 urn:lsid:ibm.com:blogs:entry-17b3bf5d-793a-4dc8-817f-b60b14db13f6 How to troubleshoot a BPM user authorization problem - Part II Jia Tang 3100009WTC active false SteveWebb 0600009FE5 active false Comment Entries application/atom+xml;type=entry Likes true 2015-04-15T16:35:00-04:00 2015-04-15T16:48:22-04:00

 In some circumstances, you believe that a user belongs to the participant group/team/ad-hoc group directly or indirectly, but the membership records in IBM Business Process Manager (BPM) DB tables do not indicate it. Assuming it's LDAP security provider configured within WebSphere Application Server (WAS) federated repository, which is the most typical client scenario:

 Step 1. Check user-group membership on your LDAP server. Ensure the user and security group exist in LDAP server, and the user belongs to the target security group. If there is any problem, work with your system admin to fix it first.

 Step 2. Check user-group membership on the IBM WAS (VMM) layer via WAS administrative console. If there is any problem, you need to check LDAP configuration, especially for the filter setting. IBM BPM synchronizes external user, group and membership information from IBM WAS VMM. So if the information in IBM WAS VMM does not exist, or is inaccurate, the behavior in BPM will be different from what you expect.

 Step3. Check user-group membership on IBM BPM layer via IBM BPM Process Admin.

 If the information in LDAP and WAS VMM are all correct, the most possible reason is missing synchronization. IBM Business Process Manager synchronizes external users, groups and membership based on the following triggers:

 When synchronize all users in IBM BPM Process Admin, user is updated, but group membership information is not.

 Upon startup of a cluster member or server, all available groups (without members) are synchronized, so that all external groups are available for IBM BPM modeling and execution.

 When a user logs in to IBM BPM web application, such as Process Portal, for the first time, that user is created in the IBM BPM DB.

 When a new or existing user logs in to IBM BPM web application, such as Process Portal, that user's full name and group memberships are updated. The groups the user belongs to are queried from the external user registry, and the IBM BPM DB content is updated to reflect the current state.

 When a REST call is triggered because a user that was newly registered in a federated repository (using an LDAP server) is not yet known to IBM Business Process Manager, synchronization of external users and groups with IBM BPM takes place. This synchronization is done only once.

 So if the external user, group or membership has not been synchronized, you may get authorization error. In order to resolving it, besides manually triggering it as described above, you can run the scripts below (for IBM BPM release before V8.5.5, you may need to apply some ifix to support the administrative scripts below):

 usersFullSync

 usersSync

 groupMembershipFullUpdate

 groupMembershipUpdate

 syncGroupMembershipForGroups.

 syncGroupMembershipForAllGroups

 Reference: See "Synchronizing users and groups" in the product documentation.

 Note:

 groupMembershipFullUpdate.bat|sh

 IBM BPM takes the users that exist in IBM BPM as basis for search and searches for their group memberships. As a result, all groups that have members that do not exist in IBM BPM do not get synchronized.

 syncGroupMembershipForAllGroups.bat|sh

 IBM BPM takes the groups that exist in the federated repositories as basis for their search and searches for the members of the groups. As a result, all users that never logged in to IBM BPM do not get synchronized.

 See "How to troubleshoot a BPM user authorization problem - Part I" for the other entry in this series.

 title image (modified) credit: (cc) Some rights reserved by Nemo

 In some circumstances, you believe that a user belongs to the participant group/team/ad-hoc group directly or indirectly, but the membership records in IBM Business Process Manager (BPM) DB tables do not indicate it. Assuming it's LDAP security... 1 0 3984 urn:lsid:ibm.com:blogs:entries-87f2c5b1-89f4-4e8e-a371-d5f640e3e1e9 Application Integration Middleware Support Blog 2017-02-23T09:51:28-05:00 urn:lsid:ibm.com:blogs:entry-8da6f713-53c9-431f-b040-f080d829436e Resolving E_ACCESS_DENIED authorization errors in Content Platform Engine hamgem 270000EX6M active false hamgem 270000EX6M active false Comment Entries application/atom+xml;type=entry Likes true 2014-02-13T20:02:33-05:00 2014-02-13T20:02:33-05:00 <title></title>
A very common issue that we see in support are authorization problems to Content Engine objects. Sometimes access rights issues are difficult to narrow down through looking at the Security entries for the object through the GUI. When all else fails you can use the Security tracing subsystem in the Content Engine. I would like to discuss how to troubleshoot a security authorization issues using the p8_server_trace.log file.

 A basic understanding of how authorization works is important. The basic components are: The "Caller Principal", the user who is calling the Content Platform Engine. The "User Access Token", a list of principals including the user and all the groups that the user is a member of. An algorithm that compares the "User Access Token" against various Access Control Lists, owner information and other object properties to determine the user's effective access to the CE object. When this access check fails, either an E_ACCESS_DENIED exception is thrown or no object is returned from the server, such as in the case of a query.

For more detailed information on Content Platform Engine authorization and access rights, please see the following Information Center help topic:

http://pic.dhe.ibm.com/infocenter/p8docs/v5r2m0/topic/com.ibm.p8.security.doc/p8psa033.htm

 1. When troubleshooting a complex security issue, the first thing you need to do is reproduce the issue and capture the p8_server_trace.log file. Use either FileNet Enterprise Manager or Administration Console for Content Platform Engine to turn on full Security, Error and EJB tracing. Reproduce the problem and capture the p8_server_trace.log file. In a cluster environment, be sure to capture the p8_server_trace.log from all servers. Please remember to turn off tracing once the issue has been reproduced.

 2. Analyzing the p8_server_trace.log file

Use the following steps to identify and troubleshoot authorization errors.

1. Find the error (ie. 'E_ACCESS_DENIED') in the log. Make sure that it really is an authorization error. Usually message will include an "insufficient access" error, but "read only" errors could also be because of an access rights issue.

2. Search up from the error message in the log and find the closest <securitytracedetail> in the same thread.

If the "short" form (which has <isaccessgranted>) then find the ID of the object being checked and search up for that ID to the closest appropriate "long" form.

If the "long" form (which has <accesstoken>, <securitydescriptor> and <appliedmarkings>) then that most likely has the information needed to identify the problem.

3. Look at the "long" form of the <securitytracedetail>, this will have the following information

The User Access Token - is the user in the expected groups?

The Security Description - this has the full Access Control List (ACL) and the owner. Check the Access Control Entries (ACE) to see which ones have "ispresentintoken="true"" and which ones have "ispresentintoken="false"".

The Active Markings - Are there any Markings denying required access rights.

 Here is an example of a user trying to delete a document and receiving an "insufficient access" error.

1. I searched the p8_server_trace.log from the bottom up and found the "E_ACCESS_DENIED" error that shows the user has insufficient access rights to delete the document object.

 2. Then I searched up from the error message for the first <securitytracedetail> in the same thread which happens to be the "short" form. Note the thread ID's (57DD3861) match between the log entries. The effective access to the object for this user does not include the DELETE access right.

 3. I searched up for the first "long" form <securitytracedetail> in the same thread. This shows the effective access again and the User Access Token.

 4. The <securitydescriptor> element of the <securitytracedetail> shows the effective access that comes from the Access Control List (ACL). Note that it does have the DELETE access right listed, so it cannot be the root of the problem. The owner of the object is also listed.

 5. The <appliedmarkings> element of the <securitytracedetail> shows the effect of markings on the access rights of the object. In this example, it shows the root cause of the E_ACCESS_DENIED error. There is a marking applied to this object which denies the DELETE access right to the user. To correct this issue you would either remove the marking or give this user the USE_MARKING access right on the marking set.

 6. These last elements provide some timing and statistical information that can be helpful in diagnosing performance problems.

 I hope this sheds some light on how to use the security tracing to resolve complex security issues when they arise. Thanks.

 A very common issue that we see in support are authorization problems to Content Engine objects. Sometimes access rights issues are difficult to narrow down through looking at the Security entries for the object through the GUI. When all else fails you can use... 2 0 4286 urn:lsid:ibm.com:blogs:entries-49281372-642c-4c59-b446-6d41eba15d52 CSE-FileNet Content Manager 2016-12-28T18:03:00-05:00 urn:lsid:ibm.com:blogs:entry-93fe73a5-5680-4d90-9971-7be0178bb2c7 IBM i2 Licensing – How it was then - and is now CHRISTIAN_MCQUILLAN 2700057J63 active false CHRISTIAN_MCQUILLAN 2700057J63 active false Comment Entries application/atom+xml;type=entry Likes true 2014-02-13T12:01:28-05:00 2014-02-13T12:01:28-05:00 <title></title>
Hello,

I am Christian and have been part of the IBM i2 Level 2 Support Team for almost 8 years, since I bailed out of the UK Royal Air Force, back in 2006.

One of the areas I focussed on when I arrived in Cambridge was the licensing of the i2 products. There have been different licensing methods available over the years, with the trusty dongle being the most recognisable means of ensuring customers do not exceed the number of licenses they have purchased.

However, since the acquisition of i2 by IBM a couple of years ago now, licensing has evolved, including being removed from within the i2 products at one stage - (Don't ask me why, as I don't know why!). Indeed, the term Licensing itself has been superseded by the name Authorisation.

Authorisation has now been reintroduced back into some of the i2 products for their current versions, such as Analyst's Notebook (including Premium) and iBase.

It is my aim over the coming months to provide more information about the different Authorisation options available and explain which versions of the software they can be applied to.

I will provide steps to troubleshoot Authorisation issues and also try and explain some for the features that the existing Authorisation methods can offer, such as commuting licenses when using the software methods of Authorisation, such as Software Licensing Mechanism (SLM) or Product Access Management (PAM).

I know you'll be eager to get started but there isn't time to begin a topic in this initial introduction; instead I just wanted to introduce myself and the intended theme of my Blog over the next few months. I will leave you with a link to the IBM i2 PAM FAQ page where there is already some useful information available about this Authorisation method.

http://www-01.ibm.com/support/docview.wss?uid=swg27037961

So, I hope you are suitably engaged and please do look out for the next update, where I'll be providing information on troubleshooting dongles. This is one area in which we still get lots of Support calls, and which doesn't have much existing, useful information, available on the IBM website.

If there are any areas within Authorisation that you would like me to expand on in future Blog updates, feel free to use the Comment box to let me know what they are, and I'll do my best to address them in the near future.

All the Best

Christian of Cambridge, England
 Hello, I am Christian and have been part of the IBM i2 Level 2 Support Team for almost 8 years, since I bailed out of the UK Royal Air Force, back in 2006. One of the areas I focussed on when I arrived in Cambridge was the licensing of the i2 products. There... 0 0 3141 urn:lsid:ibm.com:blogs:entries-c648e188-2749-4e53-a009-73d587a6c3e6 Safer Planet Support 2016-07-21T06:16:30-04:00 urn:lsid:ibm.com:blogs:entry-576afb12-6bfc-4336-b847-afdba27a39be Aruba Networks Completes Validation of ClearPass with IBM Security Access Manager for Web/Mobile mpduggan 100000FJCK active false RussWarren 100000SCSW active false 85cce0f0-581e-4b9e-9da8-b57c4a257949 Comment Entries application/atom+xml;type=entry Likes true 2014-02-11T12:25:46-05:00 2014-03-24T11:13:24-04:00
 The Ready for IBM Security Intelligence validation program is excited to announce the validation of Aruba Networks ClearPass with IBM Security Access Manager for Mobile (ISAM for Mobile). This joint solution bridges the gap between Network Access Control (NAC), Web Access Management (WAM) and Mobile Device Management (MDM). A user authenticates to ClearPass as their device accesses the network. The users identity and MDM device posture attributes flow to ISAM for Mobile, providing single sign-on to the WAM and allowing the MDM device posture attributes to be used in risk-based authorization decisions for Web resource accesses.

 Solution Link

 http://www.arubanetworks.com/solutions/bring-your-own-device/

 The Ready for IBM Security Intelligence validation program is excited to announce the validation of Aruba Networks ClearPass with IBM Security Access Manager for Mobile (ISAM for Mobile). This joint solution bridges the gap between Network Access Control... 0 0 2521 urn:lsid:ibm.com:blogs:entries-0630135b-c5aa-4eeb-8b18-bf4aaa54a1ca Ready for IBM Security Intelligence - News 2017-01-31T03:42:54-05:00 urn:lsid:ibm.com:blogs:entry-dbe53f3c-7f78-409b-b394-1df9e1dccedf Securing your APIs with IBM API Management Jackie Zhu 1100007DBS active false Jackie Zhu 1100007DBS active false e874ec4d-2a29-41a2-8fdd-16babe9d4d21 Comment Entries application/atom+xml;type=entry Likes true 2013-11-06T07:53:03-05:00 2013-12-23T03:15:19-05:00 <title></title>

Andrew Danielis a software engineer for IBM API Management, developing the user interface. He has been in the team for 3 years after completing a degree in Computer Science with Games Technology and has become an expert in APIs, Web Technologies and Java.

Today, more and more information is widely available over the internet for everybody to consume how they see fit, and a lot of this information is accessed via web APIs. We can find the current weather in any city, browse hundreds of photographs, and even check the schedule and status of nearly every flight happening at any moment. However, information retrieved from APIs isn't only generic, but it can be personal. Personal information such as our email address, postal address, date of birth, even our bank information can be available through API calls. With thieves constantly attempting to access our personal information in attempt to steal our identities, security is an important factor to consider when designing and creating an API, especially when sensitive data is concerned.

It is therefore crucial that we only allow the correct users access to the information that they are authorized to consume using secure methods, so this should be key in the design of an API and its resources.

Not every API needs to be secured. Some may not contain sensitive data, but a small subsection of your APIs are likely to need security.

Security can be implemented in the many stages of an API call from client to server:

The user using the application to access the information can be authenticated and authorized.

The application can authenticate itself.

The communication between the server and the client can be encrypted.

Each of these three stages of security can be handled in IBM API Management in the following ways.

Authenticating the user

A typical scenario in IBM API Management is exposing personal data for a user. The user uses a third party application to consume, process and display the data in a meaningful way. But how does the server retrieve and display only information that is relevant for the user?

IBM API Management offers two ways to authenticate a user:

HTTP authentication

For each call to the resource server, IBM API Management, the application will need to pass the user's username and password in the Authorization header. This is a little risky, as even though the transmission will be encrypted with TSA or SSL, that information is still passing between servers each and every time an API is consumed.

OAuth 2.0

Implementation of OAuth can be seen all around the web, especially in social media websites. It is a way of allowing an application to access user's information on a resource server without seeing or knowing the user's credentials. When the user wishes to access their personal information in the application, they are redirected to the resource server where they login and then authorize the application to interact with their data. They are then redirected back to the application, which retrieves a session token to use in subsequent calls. This method is more convoluted, but more secure as user credentials are only passed directly to IBM API Management, and only once.

Authenticating the application

APIs in IBM API Management can only be called by applications that provide a valid App ID, and in some circumstances, an App Secret too. They are generated when creating an application in the developer portal, so be sure to take note of them and keep them safe for future use. To provide the App ID with an API call, append the url with this querystring:

?appId=f2k908dea-Jw154Gl0rD-feRgat7305

Encrypting the transmission

Every call to an API provided by IBM API Management is secured with HTTPS, which encrypts all packets of data using SSL or TLS, much like you'd expect when using social media websites. Encrypting the transmission means that without a special key, the data cannot be understood by any attacker who manages to capture the data.

Encrypting the data is only one part of the security. The application must be confident that the server it is communicating with is the intended server. This is done with certificates. A website certificate serves multiple purposes; most importantly it contains the key for encrypting and decrypting the transmission, but it also contains an identity which can be confirmed as trusted from a pre-established trusted sources.

Enabling all of these measures listed will ensure APIs have the full amount of security offered by IBM API Management. For details about how to apply each aspect of security to an API and its resources please read Chapter 5 "API Security" in the IBM RedBooks publication: Exposing and Managing Services with IBM API Management.

Additional references

For IBM API Management related blog posts, see:

Introduction to IBM API Management

Securing your APIs with IBM API Management

What's not to like about IBM API Management?

API Management scalability

5 Things to Know about IBM API Management

The World of APIs

Versioning and promoting APIs in IBM API Management

Mobile applications and the need for Application Programming Interfaces (APIs)

For IBM API Management Redbooks publication, see:

Exposing and Managing Enterprise Services with IBM API Management (the draft is available now!)

Likes before 03/04/2016 - 0

Views before 03/04/2016 - 4604
 Andrew Daniel is a software engineer for IBM API Management, developing the user interface. He has been in the team for 3 years after completing a degree in Computer Science with Games Technology and has become an expert in APIs, Web Technologies and Java.... 0 0 714 urn:lsid:ibm.com:blogs:entries-8c2489be-0852-4401-8ee5-6a4d143525c8 IBM Redbooks Software Blog 2017-01-25T08:48:37-05:00 urn:lsid:ibm.com:blogs:entry-2a2ab317-bdb4-4097-9c2d-bfa7210022ed ITM V6.3 - Using tivcmd commands to control access to resources displayed in monitoring dashboards ericfreeman 270003XHWF active false 0587adbc-8477-431f-8c68-9226adea11ed Comment Entries application/atom+xml;type=entry Likes true 2013-03-26T21:04:18-04:00 2013-03-26T21:04:18-04:00
You can run the tivcmd commands to create and work with authorization policies that control access to resources displayed in monitoring dashboards in the IBM Dashboard Application Services Hub. The tivcmd commands send requests to the Tivoli Authorization Policy Server application which maintains the master set of authorization policies. For more information on authorization policies and assigning policy administrators, see "Using role-based authorization policies" in the ITM Administrator's Guide.

To use the tivcmd commands, you must install the tivcmd Command Line Interface for Authorization Policy component on the system where you intend to run the commands. The Tivoli Authorization Policy Server component must be installed into the IBM Dashboard Application Services Hub. For more details, see the ITM Installation and Setup Guide.

The tivcmd command is installed into the <install_dir>/bin directory where <install_dir> is the directory where you installed the tivcmd Command Line Interface for Authorization Policy component. Within a Windows environment, the command name is tivcmd.exe. Within a UNIX or Linux environment, the command name is tivcmd.

Before you can use the tivcmd commands to create and work with authorization policies, a user with role administration permissions must use the tivcmd addtorole command to assign you to a role that has permissions to perform operations on roles. The first authorization policy administrator is specified when the Tivoli Authorization Policy Server is installed. That user is assigned to the predefined RoleAdministrator role and has permission to use all of the tivcmd commands. That user can assign other users permission to create and work with authorization policies by adding the users or their user group to the RoleAdminstrator role or to a custom role with similar permissions.

For examples of using the tivcmd commands to create roles, grant permissions to roles, and assign users to roles, see "Managing roles and permissions" in the ITM Command Reference.
 You can run the tivcmd commands to create and work with authorization policies that control access to resources displayed in monitoring dashboards in the IBM Dashboard Application Services Hub. The tivcmd commands send requests to the Tivoli Authorization... 0 0 3958 urn:lsid:ibm.com:blogs:entries-e5599740-4010-4112-a8dd-a105b9766633 Application Performance Management 2017-02-23T10:16:54-05:00 urn:lsid:ibm.com:blogs:entry-81191620-6308-41fa-aa1d-83df64221ddd What's Hot in the WebSphere MQ World? (Part 2) Gregory(Greg)Bowman 1000007M77 active false Comment Entries application/atom+xml;type=entry Likes true 2012-12-06T12:36:06-05:00 2012-12-06T12:39:13-05:00

Earlier in the year I wrote an article talking about the hot topics in WebSphere MQ (WMQ). I thought now would be a good time to take another look and see what has changed. I found a lot of the things that were hot then are still hot now. So in this article, I am not going to talk much about the items included in the last article. Instead, I will list 5 new items that I did not include in my list the last time. In case you missed the first article you should go back and take a look at that because many of those items are still hot topics today: What's Hot in the WebSphere MQ World?

Now let's take a look at what else has been hot in the past few months.

5. IC72897 : MQGMO_CONVERT switching functionality for Java Message Service applications
This technote covers the changes that resulted from apar IC72897 and it is packed full of lots and lots of information. Even though the apar has been out since early 2011, and the technote describing all the changes has been out since December of 2011, the information in this technote remains a very popular topic because it provides an excellent discussion of the WMQ Classes for JMS in Version 7.

4. MQS_REPORT_NOAUTH environment variable can be used to better diagnose return code 2035 (MQRC_NOT_AUTHORIZED)
and
2035 MQRC_NOT_AUTHORIZED in WMQ
and
WMQ 7.1 / 7.5 queue manager - RC 2035 MQRC_NOT_AUTHORIZED when using client connection as an MQ Administrator
Security or authority errors are some of the more common issues that WMQ users will encounter and that makes technotes like these popular items in any list of commonly referenced WMQ documents.

3.Common WebSphere MQ messages and most likely causes
and
MQRC and MQCC Understanding MQ reason codes and completion codes 2030, 2033, 2035, 2080, 2085, 2092, 2110, 2189
I combined these 2 items because they are similar in the regard that both list some of the more common error messages and error codes and explain why they are most likely to occur. Both of these items are frequently in the most accessed list of technotes for WMQ.

2. Announcement: End of Support (EOS) for WebSphere MQ V6
One major event that happened in the WMQ world since my last article was the end of support for WMQ V6.0 on September 30, 2012. There were several items in the last 'What's Hot' article that dealt with migration. Those also were all very popular technotes in the past few months.

1. Downloading the WMQ clients:

MQC7: WebSphere MQ V7.0 Clients

MQC71: WebSphere MQ V7.1 Clients

MQC75: WebSphere MQ V7.5 Clients

Another major event in the WMQ world that occurred since my last 'What's Hot' article was the release of WebSphere MQ V7.5 in June 2012. This has sparked quite a bit of interest in the WMQ community and a lot of people are downloading the new versions of the WMQ Client SupportPacs. When WMQ V7.5 was released, we also updated the other V7 clients to include the WMQ Extended Transactional Client. If you were not aware of that, I have another article, "WebSphere MQ XTC: Did someone say FREE?" where you can learn all about that.

BONUS:
As a bonus, I thought I would mention that there have been a few security related flashes and alerts issued in the past few months that were relevant to the WMQ community. Each of these flashes and alerts can be found on the WebSphere MQ Support Home Page or you can subscribe to be notified whenever a new alert or flash is issued by going to the MyNotifications page and selecting the events you would like to know about. (note you will be required to sign in with your IBM ID or prompted to create an IBM ID for free if you do not have one).

If you have any other topics you would like to have us discuss, please let me know or if you just want to leave feedback in general, "Remember, We Still Love Your Feedback!"

 Earlier in the year I wrote an article talking about the hot topics in WebSphere MQ (WMQ). I thought now would be a good time to take another look and see what has changed. I found a lot of the things that were hot then are still hot now. So in this article,... 3 0 12379 urn:lsid:ibm.com:blogs:entries-87f2c5b1-89f4-4e8e-a371-d5f640e3e1e9 Application Integration Middleware Support Blog 2017-02-23T09:51:28-05:00 urn:lsid:ibm.com:blogs:entry-f2004f8e-631f-4e36-9664-00f728c1692d Top 5 authorization security considerations in Business Process Management MartinKeen 1200007VU3 active false Comment Entries Likes true 2012-10-10T09:48:56-04:00 2012-10-10T09:49:43-04:00

All users are not created equally. Authorization is the process of ensuring that a user (or other computer system) has permission to perform a given act. IBM Business Process Manager defines a very fine-grained authorization model. Getting this model right – ensuring that only the right people have access to certain resources – is key to securing your Business Process Management environment. Using excerpts from J Keith Wood and Jens Engelke's new IBM Redbooks publication IBM Business Process Manager Security: Concepts and Guidance, here's the top 5 authorization security concerns we are seeing in Business Process Management today.

1. Overuse of administrator privileges

In the Process Center for IBM Business Process Manager, you can grant Admin access simply by selecting users with a check box. There are a lot of implicit permissions granted when you enable this check box. Enable this option only for a few trusted users. Enabling this option grants the user or group the permission to read, edit, create snapshots, and deploy snapshots of any process application. These users can also grant /ProcessCenter Admin rights to any IBM Business Process Manager user and to any process application. Let's be clear - the enabled check box next to a user's name grants them super-user status. Enable this option sparingly.

2. Failure to map participant groups

When a new swimlane is introduced to a IBM Business Process Manager process definition, the default participant group defaults to All Users. It is too easy to just leave the default of All Users in place, or to use already-existing LDAP groups and call it a job well-done. This is an important point: if All Users is allowed to stay, then you are effectively, completely turning off authorization for all tasks in this swimlane. Use a rigorous review process to ensure that each and every swimlane or participant group is mapped to an IBM Business Process Manager private group that includes only those users who should have authority to execute the steps within the swimlane.

3. Overpopulation of groups

 Be careful of defining private groups that will be close-but-not-quite exactly what the process definition requires. Use fine-grained groups for each functional role that your process application can conceive.

4. Overuse of tw_authors, tw_admins

The process of ensuring that an author or developer has adequate authorization to create and deploy applications is rather a daunting task. As a result, we see many organizations simply adding their authors and developers into the default groups of tw_authors or tw_admins. Membership in these all-encompassing groups grants these accounts super user status -- and visibility to all process applications that are installed in your environment. This approach is almost universally undesirable. Access to /ProcessCenter and Process Designer should be granted in small, highly related chunks. Create project team groups that closely reflect the roles that these authors or developers play in the processes being modeled.

5. Faith in firewalls

Do not underestimate the amount of information that can be gathered by a curious, motivated, or perhaps mischievous user. If a user can sniff the network traffic, then they can analyze it. If they can analyze it, they can spoof it. It is a short path from unencrypted network traffic to unauthorized access. Specifically, given IBM Business Process Manager's ability to perform instance-based authorization based upon run-time criteria, it is certainly conceivable that someone might be able to sniff an in-flight process and alter its authorization criteria. Encrypt all communication links between IBM Business Process Manager and LDAP servers, databases, web or proxy servers, and any web services hosts. Also encrypt communication between Process Center and Process Server, Process Designer, and Integration Designer. Finally, encrypt communication between Process Servers and users. It's simply not enough to rely on these communications occurring behind your firewall.

For much more, consult the IBM Redbooks publication called IBM Business Process Manager Security: Concepts and Guidance.

Martin Keen is an IBM Redbooks Project Leader. He leads publications on many areas of IBM software, including WebSphere, Messaging, and Business Process Management. Follow Martin on Twitter at @MartinRTP. All users are not created equally. Authorization is the process of ensuring that a user (or other computer system) has permission to perform a given act. IBM Business Process Manager defines a very fine-grained authorization model. Getting this model right –... 2 2 7132 urn:lsid:ibm.com:blogs:entries-3babb1b1-d47b-4059-b8ba-d298bb7932e8 IBM Business Process Management Products Support Blog 2016-07-20T13:18:42-04:00 urn:lsid:ibm.com:blogs:entry-eb9aafa1-4494-4e8f-90bb-7d7d05f88ee6 Cracking the Code: 21 CFR Part 11 Authentication and Authorization firstname.lastname@example.com 0600010CRS active false Comment Entries application/atom+xml;type=entry Likes true 2012-06-26T09:00:00-04:00 2012-06-26T09:00:00-04:00
By Daniel Riganati

Recently, I was asked what are the 21 CFR Part 11 compliance implications with the following scenario:

The user (an Approver) used his id/password to login and continued his session and arrived at the "APPROVE NOW" screen. The software does not challenge the user (again) at the time of this critical event (e.g., APPROVAL) for his password again.

21 CFR Part 11: Authentication and Authorization

First, a little background on what the US Code of Federal Regulations has to say about electronic signatures. 21 CFR Part 11 uses "authority checks" to address two different aspects of information security - authentication and authorization.

Authentication concerns identifying the user:

11.10(d) Limiting system access to authorized individuals

Authentication also involves a procedural control, i.e., a controlled, documented, process for granting access to a new user and deleting a user account, before the userid and password are issued to the user.

Authorization concerns the level of access a particular authenticated user should have to secured resources controlled by the system:

11.10(g) Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand.

(The clause in red concerns authentication and the clause in blue concerns authorization. I can understand the confusion caused by using "authorized" to describe authentication and combining both concepts into a single clause.)

Authorization also involves:

 Definitions of user privileges - different levels of access based on user responsibilities (if appropriate) that are documented and controlled (e.g., user access levels are approved by management prior to granting access to the user).

Procedures - a controlled, documented, process for granting privleges to a new user, changing privileges for an existing user, and removing privileges.

Software controls - the application verifies that an individual has the appropriate privileges to perform specific functions within the application before allowing them to do so (e.g., access the operation or computer system input or output device, alter a record, or perform the operation at hand). Specifically with regard to electronic signatures, the application verifies that an individual has the authority to electronically sign a record before allowing them to do so.

Cracking the Code

Now, with some background in 21 CFR Part 11, let's apply it to the scenario described above:

The user (an Approver) used his id/password to login [<=authentication] and continued his session and arrived at the "APPROVE NOW" screen. The software does not challenge the user (again) at the time of this critical event (e.g., APPROVAL) [<=authorization] for his password again.

Assuming the user has been properly authenticated with a userid/password login, the question now becomes does the person clicking "APPROVE" have the privilege to electronically sign the record. The risk is that between the time of authenticating the user and electronically signing the record, there is no way for the software to know if it's really the same user.

For example, an authorized user is authenticated (logs on) and then walks away from the device without locking it. A second person then uses the device to approve records (before a screen saver time out). Software that doesn't require some verification for an approval would have no way to know if the user is authorized. The only way the software would "know" at the time of the approval is to challenge the user to provide a shared secret, re-entry of the password.

For this reason, every electronic signature requires not only the meaning of the signature (such as review, approval, responsibility, or authorship) associated with the signature, but also the entry of the shared secret (password):

11.200(a)(1)(i) When an individual executes a series of signing during a single, continuous period of controlled system access, the first signing shall be executed using all electronic signature components [<=initial authorization, not authentication]; subsequent signings shall be executed using at least one electronic signature component that is only executable by, and designed to be used only by, the individual [<=subsequent authorizations].

AND there should be a policy in place regarding NOT sharing passwords:

11.200(a)(3) Be administered and executed to ensure that attempted use of an individual's electronic signature by anyone other than its genuine owner requires collaboration of two or more individuals.

Conclusion

The use of a userid and password to login to software is an issue of authentication and is performed once to identify the user and permit access to the software. This authentication does NOT address the requirement for authorization to electronically sign and approve electronic records, which must be done for each record. In short, since the software in question doesn't require the entry of a password for the electronic signature when approving electronic records, it doesn't comply with the requirements of 21 CFR Part 11.
 By Daniel Riganati Recently, I was asked what are the 21 CFR Part 11 compliance implications with the following scenario: The user (an Approver) used his id/password to login and continued his session and arrived at the "APPROVE NOW" screen. The... 0 0 4646 urn:lsid:ibm.com:blogs:entries-f0db8bee-d63c-46a3-bd70-1d50e15ad229 Obidan 2015-02-09T20:18:40-05:00 urn:lsid:ibm.com:blogs:entry-7fa31eb8-e42a-4f36-9059-9c900b8582be What are Kernel Authorization Tables and why do I care? AnthonyEnglish 270000RKFN active false Comment Entries application/atom+xml;type=entry Likes true 2010-10-20T07:35:31-04:00 2010-10-20T07:55:26-04:00 Enhanced RBAC at your service

From AIX 6.1 when you install AIX filesets you'll often see mysterious messages advising updates to the Kernel Authorization Table (and some other tables), as in the example below:

installp: APPLYING software for:
 bos.diag.rte 22.214.171.124

. . . . . << Copyright notice for bos.diag >> . . . . . . .
 Licensed Materials - Property of IBM

 5765G6200
 Copyright International Business Machines Corp. 1985, 2010.
 Copyright AT&T 1984, 1985, 1986, 1987, 1988, 1989.
 Copyright INTERACTIVE Systems Corporation 1983, 1988.

 All rights reserved.
 US Government Users Restricted Rights - Use, duplication or disclosure
 restricted by GSA ADP Schedule Contract with IBM Corp.
. . . . . << End of copyright notice for bos.diag >>. . . .

Successfully updated the Kernel Authorization Table.
Successfully updated the Kernel Role Table.
Successfully updated the Kernel Command Table.
Successfully updated the Kernel Device Table.
Successfully updated the Kernel Object Domain Table.
Successfully updated the Kernel Domains Table.
Successfully updated the Kernel Authorization Table.
Successfully updated the Kernel Role Table.
Successfully updated the Kernel Command Table.
Successfully updated the Kernel Device Table.
Successfully updated the Kernel Object Domain Table.
Successfully updated the Kernel Domains Table.
Filesets processed: 51 of 59 (Total time: 3 mins 51 secs).

 So, do you sudo?

These messages are all to do with Enhanced RBAC (Role Based Access Control). Briefly, Enhanced RBAC allows you to give certain privileges to selected users, or groups of users, without granting them the root password or using sudo.

As the IBM RBAC documentation explains:

The enhanced RBAC mode provides a configurable set of authorizations, roles, privileged commands, devices and files through the following RBAC databases listed below.

It then goes to list the databases which Enhanced RBAC uses:

Authorization database

Role database

Privileged command database

Privileged device database

Privileged file database

In AIX 6.1 and 7.1, Enhanced RBAC is enabled by default.

ASCII is less pesky

Because the AIX people are nice (just like you), configuring complicated functions can often be done by editing ASCII files or via SMIT, and then a daemon or executable is run to read the files in from human-readable format to human unreadable format..

These are the principal ASCII files used by Enhanced RBAC:

 /etc/security/authorizations	 User-defined authorization database

   /etc/security/privcmds	 Privileged command database

   /etc/security/privfiles	 Privileged file database

   /etc/security/privdevs	 Privileged device database

   /etc/security/roles	 Role database

So here's where your mysterious messages come in. After editing any of these files you need to set the entries in the Kernel Security Tables by running setkst. This is the command which gets invoked when you install most AIX software these days (since AIX 6.1).

Man, what is RBAC doing there?

You may have already seen references to RBAC in the man pages for AIX commands. For certain commands, the documentation will have a note indicating that the command can do "privileged operations". That doesn't mean you have to post the root password up on your intranet. You could grant limited access to a group of users for what would have required root or sudo access in the past.

Here's the RBAC note for the chdev command:

Attention RBAC users and Trusted AIX users: This command can perform privileged operations. Only privileged users can run privileged operations. For more information about authorizations and privileges, see Privileged Command Database in Security. For a list of privileges and the authorizations associated with this command, see the lssecattr command or the getcmdattr subcommand.

If you want to know more about Enhanced RBAC, have a look at RBAC in simple steps. You could also watch Nigel Griffiths' Wiki movie 14 AIX 6 RBAC. Of course, the AIX 6 Advanced Security Features Redbook is a wealth of information with practical examples.

Why do I care?

Even if you don't use RBAC, you never know when someone's going to watch you doing whatever AIX admins do and ask "what does that Kernel Authorization message mean?" Well, now you know, and you're a better person for it.
 Enhanced RBAC at your service From AIX 6.1 when you install AIX filesets you'll often see mysterious messages advising updates to the Kernel Authorization Table (and some other tables), as in the example below: &amp;amp;amp;amp;amp;amp;amp;amp;amp;lt... 0 0 6903 urn:lsid:ibm.com:blogs:entries-4cbecf48-b668-4e5d-8e34-036e725c7202 AIX Down Under 2017-02-11T01:40:51-05:00 urn:lsid:ibm.com:blogs:entry-16700ff4-c0a0-45e7-bb81-87c6fbb57464 IBM Announces TKLM 2.0 Supports KMIP 1.0 Standard TonyPearson 120000HQFF active false Comment Entries Likes true 2010-08-24T17:43:20-04:00 2010-08-24T17:43:20-04:00
 Well, it's Tuesday again, and you know what that means! IBM Announcements!

 Today, IBM announced its latest IBM Tivoli Key Lifecycle Manager (TKLM) 2.0 version. Here's a quick recap:

Centralized Key Management

Centralized and simplified encryption key management through Tivoli Key Lifecycle Manager's lifecycle of creation, storage, rotation, and protection of encryption keys and key serving through industry standards. TKLM is available to manage the encryption keys for LTO-4, LTO-5, TS1120 and TS1130 tape drives enabled for encryption, as well as DS8000 and DS5000 disk systems using Full Disk Encryption (FDE) disk drives.

Partitioning of Access Control for Multitenancy

 Access control and partitioning of the key serving functions, including end-to-end authentication of encryption clients and security of exchange of encryption keys, such that groups of devices have different sets of encryption keys with different administrators. This enables [multitenancy] or multilayer security of a shared infrastructure using encryption as an enforcement mechanism for access control. As Information Technology shifts from on-premises to the cloud, multitenancy will become growingly more important.

Support for KMIP 1.0 Standard

 Support for the new key management standard, Key Management Interoperability Protocol (KMIP), released through the Organization for the Advancement of Structured Information Standards [OASIS]. This new standard enables encryption key management for a wide variety of devices and endpoints. See the [22-page KMIP whitepaper] for more information.

As much as I like to poke fun at Oracle, with hundreds of their Sun/StorageTek clients switching over to IBM tape solutions every quarter, I have to give them kudos for working cooperatively with IBM to come up with this KMIP standard that we can both support.

Support for non-IBM devices from Emulex, Brocade and LSI

 Support for IBM self-encrypting storage offerings as well as suppliers of IT components which support KMIP, including a number of supported non-IBM devices announced by business partners such as Emulex, Brocade, and LSI. KMIP support permits you to deploy Tivoli Key Lifecycle Manager without having to worry about being locked into a proprietary key management solution. If you are a client with multiple "Encryption Key Management" software packages, now is a good time to consolidate onto IBM TKLM.

Role-based Authorization

 Role-based access control for administrators that allows multiple administrators with different roles and permissions to be defined, helping increase the security of sensitive key management operations and better separation of duties. For example, that new-hire college kid might get a read-only authorization level, so that he can generate reports, and pack the right tapes into cardboard boxes. Meanwhile, for that storage admin who has been running the tape operations for the past ten years, she might get full access. The advantage of role-based authorization is that for large organizations, you can assign people to their appropriate roles, and you can designate primary and secondary roles in case one has to provide backup while the other is out of town, for example.

 For more details, see the IBM [Announcement Letter].

 This week, I'll be in Dallas, Texas. If you are an avid reader located in or near the Dallas area, and want to connect, you know how to reach me.

technorati tags: IBM, TKLM, KMIP, OASIS, encryption, FDE, Multitenancy, EKM, LTO, LTO-4, LTO-5, TS1120, TS1130, DS8000, DS5000, role-based, authorization, Emulex, Brocade, LSI
 Well, it's Tuesday again, and you know what that means! IBM Announcements! Today, IBM announced its latest IBM Tivoli Key Lifecycle Manager (TKLM) 2.0 version. Here's a quick recap: Centralized Key Management Centralized and simplified encryption key... 0 0 10626 urn:lsid:ibm.com:blogs:entries-eff9becc-b1a3-4cb8-bfb2-619b2a0bfc2e Inside System Storage -- by Tony Pearson 2017-02-13T15:41:40-05:00


text:
River Phoenix
Sign In to Fanpop
Running on Empty Caps. . Wallpaper and background images in the River Phoenix club tagged: river phoenix pictures images running on empty caps screencaps martha plimpton.
Submitted by DarkSarcasm over a year ago
Keyword: river phoenix, pictures, images, running on empty, caps, screencaps, martha plimpton


text:
PRESIDENTS DAY SALE! | 10% Off Orders $100+
Free Shipping on EVERYTHING!
Use Code: PRES Exclusions Apply
Save an Extra 10% Off Select Hammocks
Code: HANGOUT >
Save an Extra 15% Off Sunbrella Curtains
Code: SUNBRELLA >
Save an Extra 10% Off Select Furniture
Code: RELAX >
Save an Extra 15% Off Pillows
Code: PILLOWS >
The Five Seasons South Padre is an outdoor all-weather rug manufactured by Couristan. It is machine made of the highest quality polypropylene on the market, creating a rugged, yet narrow pile that dries quickly in rainy conditions. The Five Seasons Collection takes its cue from the natural environment and can be used to create a tranquil retreats for the home. The collection's structured, flatwoven construction allows its versatile style to complement both outdoor and indoor settings. Power-loomed of 100% heat-set Courtron polypropylene, each of the dynamic patterns offer a highly durable pile that affords superior comfort and fuss-free maintenance.
For over 80 years, the Couristan brand has been revered as an icon of style and quality for its exquisite area rugs, wall-to-wall carpeting and custom floor covering fashions. Couristan features five unique outdoor collections with a large assortment of patterns, colors, sizes and shapes.
Payment Methods We Proudly Accept:
© Copyright 2017, Designed for Outdoors. All rights reserved.


text:
Great central location (if you wanna stay in that part of town), small but clean rooms, individual showers/bathrooms would be even better, but cant have everything, right? Price-value very good for Manhattan. I would definitely stay again here.
- Also Known As:
- Larchmont Hotel Manhattan
- Hotel Larchmont
- Larchmont New York City
- Larchmont Hotel New York City


text:
Sorry, no definitions found.
Sorry, no etymologies found.
Sorry, no example sentences found.
Log in or sign up to add your own related words.
Log in or sign up to get involved in the conversation. It's quick and easy.
sionnach commented on the word bwpwap
internet acronym, meaning "back when Pluto was a planet"
October 9, 2009
Wordnik is fiscally sponsored by Planetwork NGO, Inc,a California 501(c) (3) non-profit educational organization, EIN #94-3366969.


text:
PHILIP HARDMAN was a tax expert. He also possessed that most elusive and awesome of talents - the ability to combine a supreme technical mastery of his subject with the facility to demystify it for the man in the street. One of the greatest authorities in his field, he will also be remembered as one of life's natural communicators.
He was a familar figure to BBC audiences. As the resident tax expert, he was part of David Dimbleby's television panel of annual Budget commentators, while Radio 4 listeners regularly tuned in to Money Box to hear him dispense down-to-earth advice on how to sort out their personal tax problems.
To hammer his points home, Hardman created a whole world of mythical people - complete with age, habits and life histories - whose turn it was to be blessed by the Chancellor. He was well aware of the power of fun in helping to dispel fears.
As Senior Tax Partner at Grant Thornton, where I am Managing Partner, and as holder of several senior posts at the Institute of Chartered Accountants in England and Wales (ICAEW), Hardman was for a quarter of a century at the forefront of debate on the UK taxation system. He was a regular and highly respected adviser to government and in 1992 was appointed to the DTI Deregulation Advisory Panel by the then City Minister John Redwood. A tireless campaigner for simplification of the tax system, he was able to combine a delight in complexity with a desire to make things easier for the layman.
He once told me how he first became interested in numbers. As a child in Bolton, he used to watch his father entering family expenditure details in a ledger. The figures and the patterns they made on the paper had a powerful, almost magical, effect on him. Apparently, a similar experience happened to the composer Benjamin Britten, and it was this fascination with dots on a stave which ultimately helped Britten to write music.
After attneding Bolton Grammar School and taking articles locally, Hardman joined Cooper Brothers (now Coopers and Lybrand). He joined Grant Thornton in 1961, based first in Leicester and then in London. In 1978 he became Chairman of the UK Taxation Committee at the ICAEW, and in 1991 was a founder member of its Faculty of Taxation. Last year Hardman's standing was recognised by Nottingham University, which appointed him Special Professor in the School of Management and Finance.
As a lecturer he was in great demand, and would delight audiences by introducing music-hall irreverence to the proceedings, on occasions even stage-managing fake telephone calls of complaint from the Chancellor. Broadcasting was to him simply another medium in which he could convey his knowledge and enthusiasm. However he realised early on that he had to play by the rules of the game. Apparently, when auditioned by BBC Television he was appalled to learn that the person before him had spent two horrifying minutes of silence consulting a calculator when asked for a snap assessment - a mistake he would never have made.
Hardman undertook valuable pioneering work for several disaster funds such as the Hillsborough crowd disaster and the Bradford FC fire. In his spare time, when not travelling the UK lecturing, he wrote and regularly updated what he regarded as his key achievement - the now standard reference work Hardman on Tax in Business (1985).
Philip Hardman was a perfectionist who simply could not understand why shoddiness should exist and expected the highest standards from those who worked for him, but in social situations he was witty and playful. Bluff, lovable and mischievous, he commanded extraordinary loyalty. He set the highest of standards for the next generation of tax consultants and that is a legacy with which he would have been proud. He was a loving husband to his wife Rosemary and to his three daughters, Sue, Caroline and Rachael.
(Photograph omitted)
- More about:
- Consultancy
- David Dimbleby
- Hillsborough
- Tax


text:
Super Chevy Show Series has a Direct Path to Racer Contingency
March 10, 2011 by Super Chevy Show
Filed under Latest News
KANSAS CITY, Mo. (March 8, 2011)- When it comes down to it, the Super Chevy Show series presented by GM Performance Division has the potential to spark mutually beneficial relationships between sponsors and drag racers. Because the series is owned by a group of drag racing tracks that hold events ranging from weekly bracket races to national events, the Super Chevy Shows are always packed with hundreds of racers.
Car counts at such events average more than 300 cars, with Maple Grove Raceway tipping the scales at over 650 racer entries in 2010. These large numbers of participating cars have grasped the attention of many major companies, causing them to become involved in the Super Chevy Show series contingency program.
The program provides an opportunity for product manufacturers to post product contingency awards in its top two bracket racing classes


text:
Cornelio Velasquez, long one
of the leading riders on The New York Racing Association, Inc. (NYRA) circuit,
reached a personal milestone Sunday afternoon at Aqueduct Racetrack when he won
race 5 aboard Up in Smoke ($7.30)
for his 3,000th North
American victory.
feel good," said Velasquez, who also won more than 1,000 races in his native
Panama before moving his tack
to the United
States. "I'm very happy to have had a big
career and that the trainers have given me a lot of chances. It's like family
here at Aqueduct; there's a lot of competition, but I like New York. It's the best."
Following the landmark win, Velasquez, 43, was tied for seventh in the
jockey standings at Aqueduct's fall meet with eight winners. Overall, he was
third in New York with 169 winners in 2011,
including the Grade 2 Go for Wand with Lovely Lil on Friday at Aqueduct
Racetrack, the Grade 3 Westchester at Belmont on
Caixa Eletronica, and the Grade 1 Sword Dancer Invitational with Winchester and the Grade 3
Victory Ride aboard Hot Summer, both at Saratoga Race Course.
Earlier this month, Velasquez won the Grade 2 Breeders' Cup Marathon on
November 5 with Afleet Again.
Velasquez, who rode his first winner in Panama in 1985,
has finished among the top 10 jockeys on the NYRA circuit every year since 2004.
In 2007, he won the coveted Saratoga riding title with 44
2010, Velasquez finished fifth in the year-end standings with 110 winners from
757 mounts at Aqueduct Racetrack, Belmont, and
Photo: NYRA - Adam Coglianese
Chester and Mary Broman's Haul Anchor won his seco...
Undefeated Three Rules breezed five furlongs in a ...
Defying Gravity overcame a slow pace to capture he...
Shade Tree Thoroughbreds' Three Rules extended his...
McCraken, the unbeaten colt who sits atop Thorough...
"The big horse works tomorrow."So spoke Bob Baffer...
M M G Stables' multiple Grade 3 winner El Areeb si...
It was not hard to see who the powers that be beli...
The racing world waits with bated breath for the d...
Copyright © 2010 -
Immerse!, LLC
Join 53,689
other passionate horse racing fans!


text:
Looking for a Used Baja in your area?
CarGurus has 221 nationwide Baja listings starting at $3,995.
2003 Subaru Baja Overview
The Outback takes off its top and reveals the new 2003 Subaru Baja, a blend of functional pickup and sporty sedan aimed at an active youthful driver. With nods to the old Subaru Brat and memories of dune buggies, the two-tone Baja looks a lot like the Outback in the front and around the wheels and lower body. Like the Outback, it is AWD and features the 2.5-liter, 165-hp H4 boxer engine. Depending on whether you get the 5-speed manual or 4-speed automatic, you get either a continuous AWD or an Active electronic AWD.
There is both Sport and LTD trims. While the Sport is pretty basic, the more popular LTD comes standard with leather seats, a sunroof, power features, and a power driver's seat. The 2003 Baja, however, focuses on cargo versatility, knowing its drivers will be carrying everything from bikes to snowboards to surfboards. There are two bucket seats in the rear. The Switchback system allows for up to 6.5 feet of cargo space when the seats cushions are folded up and forward and the seatbacks folded flat. The cargo bed itself measures 41.5 inches, but with the extender out and tailgate down, expands to 60 inches. It comes with a standard bedliner and grab bars. A roof rack with crossbars is also standard, with attachments for skis and bikes. An optional cargo cover is recommended.
The 2003 Baja is tailor-made for those looking for a personal car that suits their active lifestyle, but comes with the safety, reliability, and car-like handling characteristic of Subaru. The favorite feature is the cargo/passenger versatility and flexibility, but owners also like the AWD capability, decent 20/25 gas mileage, and how fun and sporty the Baja is to drive. They do feel it's underpowered and wish there was an optional 3-person bench in the back. Wind noise can be annoying.
What's your take on the 2003 Subaru Baja?
2003 Subaru Baja Top Comparisons
Users ranked 2003 Subaru Baja against other cars which they drove/owned. Each ranking was based on 9 categories. Here is the summary of top rankings.
Cars compared to 2003 Subaru BajaPeople researching a 2003 Subaru Baja contacted a dealer about
Looking for a Used Baja in your area?
CarGurus has 221 nationwide Baja listings starting at $3,995.
Subaru Baja Questions
(error Code P1102) Where Is Pressure Sources Solenoid Valve?
Suddenly now and intermittently the A/T oil hot light is flashing. Car is not drivable. Is the valve inside the transmission?
Swapping Engines
I have an 02 Forester, manual trans. and an 03 Baja, manual trans. Both show a "6" in the VIN for motor type. I was wondering if the Forester engine will fit into the Baja? Perfect fit, or are thi...
Is It Risky To Buy A 2003 Subaru Baja With Over 200,000 Miles For $4,000. G...
Does Your "deal Value" Takes Into Account Any Detail Beside The Asking Pric...
There are many vehicle offered for sale with seemingly great prices, which you grade as "great deal." However, some of these vehicle are having rebuilt title (salvage) and those are never great deals....
After Changin O2 Sensors Why Is The Engine Light Co.ing Bach On With Code F...
- Avg. Price: $8,230
- Sport
- Avg. Price: $8,207
Subaru Baja Experts
Jeff Smith
Reputation 90
Reputation 80
Reputation 40


text:
The Horse Forum (http://www.horseforum.com/forumindex.php)
- Horse Tack and Equipment (/horse-tack-equipment/)
- - Buying a Saddle (http://www.horseforum.com/horse-tack-equipment/buying-saddle-151445/)
Buying a Saddle
I'm looking at different Western Saddles (its my first time buying) but there's so much stuff out there! :D Any important info I need to know before buying one, basically general things? ex.Brand Name, size. Any help would be appreciated! Thanks.
If it looks to good to be true it usually is. What is your budget? If it's under or close to $500 new stay away. There are alot of junk saddles out there.
Good brands: Simco, Circle Y, Courts, tucker, many more but I'm tired and can't think. Make sure to watch saddle fiting videos so you know how to measure your horse and you can buy the right saddle.
|All times are GMT -4. The time now is 09:26 AM.
Powered by vBulletin® Version 3.8.8
Copyright ©2000 - 2017, vBulletin Solutions, Inc.
vBulletin Security provided by vBSecurity v2.2.2 (Pro) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.
User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2017 DragonByte Technologies Ltd.


text:
|Message view
|« Date » · « Thread »
|« Date » · « Thread »
|Bart van der Schans <b.vandersch...@onehippo.com>
|Re: [jr3] Use JCache JSR-107 for (all) caches
|Thu, 18 Feb 2010 08:57:11 GMT
On Thu, Feb 18, 2010 at 4:26 AM, Justin Edelson <firstname.lastname@example.com> wrote: > On 2/17/10 5:29 PM, Bart van der Schans wrote: >> Hi, >> >> Right now there are several "homegrown" caches in Jackrabbit. Some >> configurable, some based on soft/weak references. Using JCache it >> would make it possible to leverage existing caching implementations. >> This could help in making the caches better configurable and tunable >> and have features like overflow to disk, which could help with large >> transactions, persist caches to disk during restart for cache warming >> and clustered caches. For example it could be interesting to share >> bundle/item state caches between cluster nodes. >> >> Regards, >> Bart > One thing to add to this list - monitorability of caches. AFAIK, there's > no instrumentation available for Jackrabbit caches. That would also be one of the benefits. A lot of the JCache implementations support JMX management and monitoring. For an example see: http://ehcache.org/modules/monitor.html http://ehcache.org/documentation/jmx.html > In fact, JMX instrumentation in general may warrant its own thread. We should start a separate thread for that. I would also love to have all kind of JCR statistics from Jackrabbit through JMX like node read and write counts, active sessions, total number of nodes/props/revisions, etc. Bart
|View raw message


text:
Yahoo:Newsroom for Communities
and debate and discuss with a passionate community. Don't forget to sign in using your Yahoo account
Free • 190K
All Android applications categories
All Android games categories
and debate and discuss with a passionate community. Don't forget to sign in using your Yahoo account
Free • 190K
dictionary. * Conversation mode to communicate with people from other countries. * Text to Speech tool
Free • 976
Vingle. Very Community. Vingle is the community where you can meet someone like you. The proud
Free • 63.3K
data. HIGHEST ENCRYPTION STRENGTH Threema end-to-end encrypts all your communication, including
Achieve and celebrate your health goals with the world's most positive community! PumpUp is a safe
Free • 46.1K
Amino's network of communities lets you explore, discover, and obsess over the things you
Free • 262.6K
Ringya is the first viable communication solution for groups such as parents, work teams, clubs
Free • 1.3K
+, or email · Save in HD to your phone while streaming Stream is a worldwide community of users sharing life
Free • 5.7K
">light communication tool and flashlight tool. It is helpful for climber. Have many effect and Morse code
Free • 2K
CommunityMatrimony - an exclusive community oriented matrimony service, has been involved
Free • 6.7K
Discover community poems and poetry and write your own with the social network for Poets! Vote
Free • 848
Hockey Community is about making hockey more accessible around the world. - Discover and join
Free • 193
Apps available in other platforms:
Last review
Spelleasy - A Spelling game: "Do You Know How To Spell Chocolate?"
by Ana Gracia
THE VERDICT Welcome to Spelleasy - A Spelling Game, a wonderful educational game for kids that will help children improve their spelling skills thanks to the starter packages. If you decide to purchase additional packages, there are some more t…
Explore our channels


text:
Are you passionate about your business, but are having difficulties increasing profits, retaining customers, or managing your staff?
Are you customers-focused, but are still having a hard time turning prospects into long-term customers?
Are you constantly looking for ways to improve your business, but are unable to find one that works?
Are you ready to make a difference, but are limited by the available resources you have?
We can help. Apply to be part of the Magnetized Business Network and join our ride with other like minded business owners TODAY!