Trusted domain midlet doens't have permissions as Nokia granted

[dusanbaranec]

Hi,

Testing device: Nokia 6681
Testing midlet: www.smsplanet.org/SMSPlanet.jad
Signed: Yes, by Geotrust UTI certificate
Testing house: www.relq.com

As trusted 3rd party, it shoul have the following permissions (see http://ncsp.forum.nokia.com/download/?asset_id=11746, author: Janne Levula, forum Nokia, MIDP 2.0 Security Domains, page 19):

application autoinvocation: session, oneshot, blanket, no
net access: session, oneshot, blanket, no

Reality on 6681:
application autoinvocation: session, oneshot, no
net access: session, oneshot, no

blanket=Allways allowed
session=Ask first tim
oneshot=Ask every time
no=Not allowed

Explanation taken from the same document (Janne Levula, MIDP 2.0 Security Domains) page 8.

Could someone help? Thanks in advance...

Kind regards
_____________________________
Dusan Baranec - project supervisor
dusan.baranec@smsplanet.org
www.smsplanet.org

[Jason Glass]

dusanbaranec,

darn all these inconsistencies! I find it irritating also! It could be the carriers doing!

[dusanbaranec]

Interesting is, that SonyEricsson K600i have no problem with granting access to our signed midlet - both autostart and auto connect to HTTP are allowed.

Dusan-

[Jason Glass]

i installed on 6630 from tmobile

heres what i have, i listed highest permission for each

network always allowed
messaging ask every time
auto invok always allowed
connecivity always allowed
multimedia always allowed
read always allowed
edit always allowed

and your signing level, is same as java verisign code signing level, i think.

and you still have this issue, if you select blanket for network
then blanket for auto invoke, it changes network back to ask first time

and vice versa, the machines are out to get us...

[dusanbaranec]

This is weird, I have this (Orange is my carrier):

network YOU=Always allowed | ME=Ask first time
messaging YOU=Ask every time | ME=Ask every time
auto invok YOU=Allways allowed | ME=Ask first time
connecivity YOU=Always allowed | ME=Ask first time
multimedia YOU=Allways allowed | ME=Ask first time
read YOU=Allways allowed | ME=Allways allowed
edit YOU=Allways allowed | ME=Allways allowed

Could we change our phones? )

Do you understand to this? Can it be carrier dependent? Anyway as I said, SE K600i has no problems with autostart and auto-network-access. There is an option "Never ask again" and that's it...

[Jason Glass]

and you have that on 6630? It probably is the carrier screwin with domain permissions then.

but not, i did say those were just the highest grantable permissions, not neccessarily the permissions selected by default on install.

dont want to mislead you

someone needs to start a massive online repository with this data, and each devices carrier/branding differences

all serious developers could take a little time to add to repository, cus in end, it would save so much development time!

[hartti]

Some carriers are using a little different set of default access rights and available settings for protected APIs & trust domains (than what is specified in MIDP spec).
Cingular for example has their settings available on their developer web site. Orange might have such a document too, I have not visited their developer site yet.

Hartti

[dusanbaranec]

"i did say those were just the highest grantable permissions"...sure I understand this, I wrote my highest permissions too and as you may see its lower than yours. I have 6681.

[dusanbaranec]

Thanks Hartti, it means that imagination that Java application behaves the same way on each MIDP 2 device is sci-fi. I lead SW company for 10 years and our target plarforms are MACs and WIN. Now I see that Java implementation is very far from similar Windows or Mac professional applications used in real business life...

Dusan Baranec
dusan.baranec@smsplanet.org
www.smsplanet.org

[dusanbaranec]

Guys problem is solved, according to an answer from Satu Tasala, Project manager, Aplication Testing Services, this is "the Java implementation in Nokia 6680/81 differs from e.g. Nokia 6630 and N91. Always allowed is not available for network access or auto-start even if application is in Trusted 3rd party domain."

I would like to thank to Satu for his effort, it solved many of our problems.

Kind regards
_____________________________
Dusan Baranec - project supervisor
dusan.baranec@smsplanet.org
www.smsplanet.org
Time zone: GMT +1

[Jason Glass]

glad you found the cause of your problem, unfortunately still does not help with the problem though!

We could post other problematic devices here as well, when we happen upon them!

[RastaS2K]

Hi,

I have two firmware versions of 6630 and the permissions are different. I don't have App auto-start "always allowed" for v5.03.08 but i do for v 3.45.113. Not sure why. Could it be that the later version enforces the operator permissions or maybe Nokia changed the trusted domain for signed midlets during versions

Regards,
Rasta

[Jason Glass]

Wow, thats nice that you have those two devices with different version firmware, usefull for testing.

Could it be that the later version enforces the operator permissions or maybe Nokia changed the trusted domain for signed midlets during versions

Not sure, if both devices were unbranded to a carrier, it would seem like Nokias doing, but if one device was branded, and the other not, or both devices branded from two different carriers, then I would suspect the carriers doing.

[RastaS2K]

Thanks Jason,

Can someone from Nokia confirm this please?

Thanks,
Rasta

[dfun]

Hello,
same exact problem here. Both on a 6600 and on a 6630, we get applications installed as trusted third party, but no blanket option available for Network Access.
This is ridiculous, what do we have standards for if then Nokia and the operators change them as they like?
As a result, I think we might have to tell our customer not to buy Nokias but rather buy other brands who do grant this permission to signed midlets...
Unbelievable!