operator signed j2me / set permissions

[alfestus]

Hi,

I have a J2ME application that is currently signed by Thawte. This app needs to have Read User Data, Edit User Data and Network Access set to Always Allowed. Whilst manually changing these settings is just about acceptable for advanced mobile users, it isn't great for the average customer.

Now I am trailing with a mobile operator to sign my application using the mobile operator protected signing ID. I have a few questions to ask:

1. Will the operator signing ID only work with devices that contain the operator root certificate?

2. Can I sign the application with both the Thawte and mobile operator ID's. Has anyone experienced this previously? What was the user experience like ie are you asked on start-up which ID to use?

3. Can the mobile operator send permission settings for J2ME, Read User Date, Edit User Data and Network Access to Always Allowed over the air, to avoid manual permission setup?

4. Can the mobile operator send their operator root certificate over the air?

5. Are there any methods to trigger app Permission settings on a device.

Any feedback on any of the points would be greatly appreciated.

Thanks,
Alfe

[hartti]

My 2 cents

1) yes. On other phones the installation will fail as the certificate cannot be found

2) creates problems. you can sign the MIDlet to only one domain.

3) Not exactly. the settings for that domain has been defined on the phone. Check for information about the operator specific setting for example here
http://wiki.forum.nokia.com/index.ph...m_the_standard

4) it has to be either on SIM or on phone.

5) to change the default settings automatically. No.

Note that not all operator have certificates.
Note also that getting your MIDlet signed by the operator usually requires close partnering with the operator

Hartti

[alfestus]

Thank you for the reply and advice.

[subbanarasa]

My 2 cents

1) yes. On other phones the installation will fail as the certificate cannot be found

2) creates problems. you can sign the MIDlet to only one domain.

3) Not exactly. the settings for that domain has been defined on the phone. Check for information about the operator specific setting for example here
http://wiki.forum.nokia.com/index.ph...m_the_standard

4) it has to be either on SIM or on phone.

5) to change the default settings automatically. No.

Note that not all operator have certificates.
Note also that getting your MIDlet signed by the operator usually requires close partnering with the operator

Hartti

Hi,

I have a J2ME application that is currently signed by Verisign. This app needs to have Read User Data, Edit User Data and Network Access set to Always Allowed.

If I sign my application using Nokia signing certificate(Manufacturer Domain). I have a few questions to ask:

1. Can any one give me the procedure to sign J2ME application using manufacturers domain(like Nokia).

2. Can Nokia send permission settings for J2ME, Read User Date, Edit User Data and Network Access to Always Allowed over the air, to avoid manual permission setup?

3. Can any one provide me the sample apllication which is signed by Nokia(Manufacturers Domain).

Any feedback on any of the points would be greatly appreciated.

Thanks,
Reddy

[hartti]

First of all, most likely the manufacturer signing is not an option for you. It requires Nokia branding or that the MIDlet is developed by Nokia.

2) No

3) I do not know of any example jar and jad being available on net.

Hartti

[subbanarasa]

Thank you for the reply.

If i sign my application using the mobile operator protected signing ID will solve the problem.

will application permissions set to Always Allowed?


Thanks and Regards
Reddy

[hartti]

In theory, yes.
In practice the answer is a little more complicated.

Getting your MIDlet signed with an operator usually requires partnering with the operator.
Also not all of the operators have code signing certificate on their handsets/SIMs
Additionally some operators are using their own security settings from the operator domains, see here for more info
http://wiki.forum.nokia.com/index.ph...m_the_standard

Hartti

[subbanarasa]

Thank you for the reply.


Hi,
I installed signed application. My requirement is, When the user set read/write permission to "Alway allow" then only the application will launch other wise the application will display one alert message to set the permission and close it.

I checked the permission from MIDlet class using the checkpermission method.
like:
checkPermission("javax.microedition.pim.ContactList.read");
checkPermission("javax.microedition.pim.ContactList.write");
checkPermission("javax.microedition.io.Connector.socket");

Its alwas giving -1 , I was tested on Nokia N95-8GB device.
But in Sony-Ericsson devices its working fine, what is the diff b/w this two?

Can u tell me any other way we can check the permissions in Nokia devices.


Please help in this query.

Thanks and Regards
Reddy

[hartti]

You are the second person in few days to mention about the permission queries not working properly on N95. Looks like that we need to check those out (I do not likely have time right now myself, but I'll set the things rolling). Due to the holiday season getting clarity on this might take a while.

In the other thread it was found that Opera uses a "dummy" dialog to ask the users to change the settings to always allowed. Then they rely users really doing it but they are not really checking the settings. WOuld this approach work for you?

Hartti

[r2j7]

Hello Reddy,

I did some testing with an N95 8GB (and other S60 and Series 40 devices), but couldn't reproduce the -1 issue:

my VeriSign signed app with the same permissions produces 1,1,1 (=i.e., not -1,-1,-1) when using "Always allowed".

Could you tell us step by step how you reproduce this issue?

(In addition: what's the phone sw when you enter *#0000# on the Active Idle display?)

Regards,
r2j7

[subbanarasa]

Thank you for the reply.

I am providing steps to reproduce the issue

1. I have written a small MIDlet with the following details



import javax.microedition.lcdui.Display;
import javax.microedition.lcdui.Form;
import javax.microedition.midlet.MIDlet;
import javax.microedition.midlet.MIDletStateChangeException;


public class Permission extends MIDlet{

protected void destroyApp(boolean arg0) throws MIDletStateChangeException {
// TODO Auto-generated method stub

}

protected void pauseApp() {
// TODO Auto-generated method stub

}

protected void startApp() throws MIDletStateChangeException {
// TODO Auto-generated method stub
Form form = new Form("Permissions");
form.append("Contacts Read:"+checkPermission("javax.microedition.pim.ContactList.read")+"\n");
form.append("Contacts Write:"+checkPermission("javax.microedition.pim.ContactList.write")+"\n");
form.append("Socket Conn:"+checkPermission("javax.microedition.io.Connector.socket"));
Display.getDisplay(this).setCurrent(form);
}

}



2. After that i have signed with verisign certificate then i installed it in N95-8GB device.
3. I was launched the application its displaying like this

Contacts Read: -1
Contacts Write: -1
Socket Conn: -1

4. Then i went Menu->Applications->App.manager-> <Permission>
I changed the permissions like this
Network access - Always allowed
Read user data - Always allowed
Edit user date - Always allowed

5. Again i was launched the application its displaying same

Contacts Read: -1
Contacts Write: -1
Socket Conn: -1


I tested in Nokia 6630 and Nokia N95-8GB but in both devices same output.

could you give me some solution..

Below i am giving firmware version of N95 for your reference.

V15.0.015
11-12-07
RM-320
Nokia N95(88.01)


Thanks and Regards
Reddy

[r2j7]

Hello Reddy,

have you also included the permissions in the JAD?:

javax.microedition.pim.ContactList.read
javax.microedition.pim.ContactList.write
javax.microedition.io.Connector.socket

That is, before signing your JAD should look something like this (including the bolded permissions):

MIDlet-1: Permission, , Permission
MIDlet-Jar-Size: 1313
MIDlet-Jar-URL: Permission.jar
MIDlet-Name: Permission
MIDlet-Permissions: javax.microedition.pim.ContactList.read, javax.microedition.pim.ContactList.write, javax.microedition.io.Connector.socket
MIDlet-Vendor: Vendor
MIDlet-Version: 1.0
MicroEdition-Configuration: CLDC-1.1
MicroEdition-Profile: MIDP-2.0

Regards,
r2j7

[subbanarasa]

Hi r2j7,

Yes ...

before signing the JAD looks like this

MIDlet-Name: Permission
MIDlet-Version: 0.0.1
MIDlet-Vendor: comp name.
MIDlet-Jar-URL: Permission.jar
MIDlet-Jar-Size: 1101
MIDlet-Description: Permission
MIDlet-Icon: /Haha.gif
MIDlet-1: Permission,/Haha.gif,Permission
MIDlet-Permissions: javax.microedition.pim.ContactList.read,javax.microedition.pim.ContactList.write,javax.microedition.io.Connector.socket


After signing looks like this

MIDlet-Name: Permission
MIDlet-Version: 0.0.1
MIDlet-Vendor: comp name.
MIDlet-Jar-URL: Permission.jar
MIDlet-Jar-Size: 1101
MIDlet-Description: Permission
MIDlet-Icon: /Haha.gif
MIDlet-1: Permission,/Haha.gif,Permission
MIDlet-Permissions: javax.microedition.pim.ContactList.read,javax.microedition.pim.ContactList.write,javax.microedition.io.Connector.socket
MIDlet-Jar-RSA-SHA1: #############
MIDlet-Certificate-1-1:##############
MIDlet-Certificate-1-2: #############
MIDlet-Certificate-1-3: ###############




Thanks and Regards
Reddy

[r2j7]

Hello Reddy,

thank you for your inputs on this issue. I've some feedback and results for you to test:

It seems that in S60 there's need to import the necessary APIs for permission(s) and, also to have the related methods in use before the checkPermission() method acknowledges the permission(s) with 1. I did test your code with Series 40 devices, and with those your code did run just fine (=returned 1 after setting 'Always allowed' for VeriSign signed app as you've defined in your post #11).

For S60, I reproduced this issue for the permissions javax.microedition.pim.ContactList.read and javax.microedition.pim.ContactList.write as follows (additions to your original code are bolded):

import javax.microedition.lcdui.Display;
import javax.microedition.lcdui.Form;
import javax.microedition.midlet.MIDlet;
import javax.microedition.midlet.MIDletStateChangeException;
import javax.microedition.pim.*;


public class Permission extends MIDlet{

PIM pim;
PIMList pl;

protected void destroyApp(boolean arg0) throws MIDletStateChangeException {
// TODO Auto-generated method stub

}

protected void pauseApp() {
// TODO Auto-generated method stub

}

protected void startApp() throws MIDletStateChangeException {
try {
// TODO Auto-generated method stub
pim = PIM.getInstance();
String[] lists = pim.listPIMLists(pim.CONTACT_LIST);
pl = pim.openPIMList(pim.CONTACT_LIST, pim.READ_WRITE);
Form form = new Form("Permissions");
form.append("Contacts Read:" + checkPermission("javax.microedition.pim.ContactList.read") + "\n");
form.append("Contacts Write:" + checkPermission("javax.microedition.pim.ContactList.write") + "\n");
form.append("Socket Conn:" + checkPermission("javax.microedition.io.Connector.socket"));
Display.getDisplay(this).setCurrent(form);
} catch (PIMException ex) {
ex.printStackTrace();
}
}

}

The code above is similar to yours but includes the PIM API import plus related variables and methods, pim.listPIMLists(pim.CONTACT_LIST) and pl = pim.openPIMList(pim.CONTACT_LIST, pim.READ_WRITE).

For testing, take the above code and run it as it is. For second test, remove the line pl = pim.openPIMList(pim.CONTACT_LIST, pim.READ_WRITE); and see if the difference is there. Finally, remove the line String[] lists = pim.listPIMLists(pim.CONTACT_LIST); => all permissions are -1.

I'll do some more testing to verify this. In addition, I'll make a Known Issue which will be published in Forum Nokia Wiki in near future on this matter.

Regards,
r2j7

[jappit]

Hi chaitanya_arija,

as more times answered on these boards, It is not possible to automatically/programmatically change the permissions settings. Only final users can manually change them, as explained on these pages:

* How to change the Java API access settings on Series 40 phones
* How to change the Java API access settings on S60 phones

Pit