Access control based on module/ program

Hello All,
In standard edition is there a way to we control user access based on the module / program.
like if the user is accessing the database throught sql*plus then he should have only read access.
Thanks
sankar

Hi sankar
amazing how often this is asked, however Oracle database authenticates the username, not the end-user client,
but you can use the following reference to at best thwart access from client programs that you do not like:
note 281229.1 How to Restrict Access to the Database With Specific Tools (e.g. TOAD) or Applications
It is important to realize any info sent from the client like program name, module and client_id (unless set by the database)
cannot be trusted, so this is at best a method to discourage the use of what you think are 'illegal' clients,
greetings,
Harm ten Napel
Edited by: hnapel on Feb 12, 2013 8:29 AM

Similar Messages

Access control for different user groups in APEX 4.0

Hi guys,
in Apex 4.0, is there any way to use the access control page to configure access control for different user groups?
The access control page currently only has an access control list by users with 3 privileges namely, Administrator, Edit & View where Administrator has the highest access level & View the lowest. Therefore 1 user cannot have more than 1 different privilege, however if the user belongs to 2 or more different groups then we can control what access he can have in a more fine grained manner. We also want to have more than the 3 privileges given.
Can we assign different groups to different users and let them have different privileges to be configured by page, region, process or item level?
Now Apex will create 2 tables, Apex_Access_Control & Apex_Access_Setup to store the application access control mode & access control list. It will also create 3 authorization schemes "access control - administrator", "access control - edit" & "access control - view" based on the 2 tables.
Does this mean we have to change the table structures & edit the authorization schemes to suit our usage? We are reluctant to do this because if we upgrade to a newer version of Apex then we would have to merge our pl/sql coding with Apex's updated code.
How can we auto-configure more than the 3 authorization schemes in the access control page? Is there any way to achieve a finer grain of access control based on the current access control administration page given by Apex without writing it ourselves?
We are afraid that we may have missed something on Apex access control & do not want to reinvent the wheel.

Hi Errol,
to build your own application authorization scheme around the security model supplied by Apex for administration of the Apex environment would be a bad idea.
This was never intended for authorization scheme management in custom built Apex applications, it was solely intended to control access in the Apex environment overall. The API for it is not published, and making changes to it, such as adding more roles, would run the risk of breaking the overall Apex security model. It would not be supported by Oracle and Oracle would not guarantee the upwards compatibility of any changes you make in future versions of Apex.
In short, you should follow Tyson's advice and build your own structure. As he indicated, there are plenty of examples around and provided your requirements are not too complicated, it will be relatively simple.
Regards
Andre

Problem Maintenance Optimizer - SAP GRS Access Control 5.3

Hi,
I have a problem in calculating the SPS to the SAP GRC Access Control 5.3.
I recorded the system automatically from SLD. I defined the logical component and I created the solution.
Now, when I try to calculate the Maintenance Optimizer error is generated:
No Addon Product Version allowed for transaction: SAP GRC ACCESS CONTROL 5.3 (01200615320900001673)
Program:CL_MOPZ_EVALUATE_INSTANCES====CP,Include:CL_MOPZ_EVALUATE_INSTANCES====CM00R,Method:CHECK_INPUT,Line: 67
Can you help me?
Best regards,
Diego.

Hi,
Check this note.
1464712
This should solve your problem.
Feel free to revert back.
-=-Ragu

GRC Access Control 5.3 (Links to components)

Hi all,
My laptop has just packed up. This to the end of the project.
Would anyone be so kind and send me the links to access and navigate through the Access control 5.3 modules and technical netweaver platform.
This will be a huge help, I don't realy have time to go through all the manuals and SAP notes and scout for all of these at this point in time.
Please HELP !
Regards, Melvin

to access CUP:
http://<hostname>:<portnumber>/AE
To access RAR:
http://<hostname>:<portnumber>/webdynpro/dispatcher/sap.com/grc~ccappcomp/ComplianceCalibrator
to access SPM
http://<hostname>:<port>/webdynpro/dispatcher/sap.com/grc~ffappcomp/Firefighter
to access ERM:
http://<hostname>:<portnumber>/RE
Launch pad link:
http://<server name>:5<instance>00/webdynpro/dispatcher/sap.com/grc~acappcomp/AC
NW start page:
http://<hostname>:<portnumber>/index.html

Setting Access Control in Airport Utility

Hello everyone,
I'm hoping that someone can confirm that setting access control to Local in the Airport Utility, and specifying computer addresses, is an optional layer of security over and above a network and base station password. In other words, if I leave access control set to Not Enabled, will I still have password protection for my wireless network?
Regards,
Gregory

Thanks for reply, but I'm afraid I don't understand, and I apologize for my inexperience. What do you mean when you say that I should be more concerned that both access control and other security +should not+ be done? And by "... check on its either one or the other," did you mean check whether it's one or the other?
In any case, page 58 of the Designing Apple Networks manual doesn't say anything about local access control that the one-line description under the Access Control tab in the Airport Utility doesn't already say, namely, that access can be restricted to particular computers. Well, that's clearly a good thing as long as you don't have visitors or collaborators frequently dropping by who need access to your network. I think it's reasonable to assume that network and base station password protection operate independently of access control based on Apple IDs.

To run OHS at port 80 using solaris role based access control

Hi.
I already know & have done setuid root to ohs/bin/.apachectl to allow ohs to listen to port 80. Now on a new OFM 11.1.1.4 install, I want to use Solaris Role Based Access Control (RBAC) instead. Is it possible? RBAC does work as I can run a home built apache2 httpd at port 80 withOUT suid root.
On Solaris 10, I enabled oracle uid to run process below port 1024 using RBAC
/etc/user_attr:
oracle::::type=normal;defaultpriv=basic,net_privaddr
Change OHS httpd.conf Listen from port 8888 to port 80.
However, opmnctl startproc process-type=OHS
failed as below with nothing showing in the diag logs:
opmnctl startproc: starting opmn managed processes...
================================================================================
opmn id=truffle:6701
0 of 1 processes started.
ias-instance id=asinst_1
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
ias-component/process-type/process-set:
ohs1/OHS/OHS/
Error
--> Process (index=1,uid=187636255,pid=25563)
failed to start a managed process after the maximum retry limit
Thx,
Ken

Just to add my two cents here.
The commando used on Solaris to assign the right privilege to bind TCP ports < 1024 is:
# usermod -K defaultpriv=basic,*net_privaddr* <your_user_name>
Restart the opmnctl daemond.
After that OHS/Apache user can bind to lower TCP ports.
Regards.
Edited by: Tuelho on Oct 9, 2012 6:05 AM

Role Based Access Control in Java

Hi,
we are designing a software solution that makes use of the Role Based Access Control pattern to control access of functions, EJBs, Servlets to certain users based on their "role".
I have not been able to understand clearly how that pattern can be implemented in Java. In addition, I stumbled on the java.security.acl and I wondering how will the package work together with RBAC pattern (Or is the pattern already implemented in some package)?
Does any1 have any comments on this? Thnx
Dave

Hi David,
Permissions based on GUI components is a simple & neat idea. But is it rugged? Really secure? It might fall short of Grady Booch's idea of Responsibilities of objects. Also that your Roles and Access components are coupled well with Views!!!!!!!
My suggestion regarding the Management Beans is only to do with the dynamic modification which our discussion was giong forward.
If we go back to our fundamental objective of implementing a Role based access control,let me put some basic questions.
We have taken the roles data from a static XML file during the start up of the container. The Roles or Access are wanted to be changed dynamically during the running of the container. You would scrutinize the changes of Roles and access before permission during the case of dynamic modification.
Do you want this change to happen only for that particular session? Don't you want these changes to persist??? When the container is restarted, don't you want the changes to stay back?
If the answer to the above is YES(yes I want to persist changes), how about doing a write operation(update role/access) of the XML file and continue your operation? After all, you can get the request to a web or session bean and keep going.
If the answer to the above is NO(no, i don't want to persist), you can still get the change role request to a web or session bean and keep going.
Either way, there is going to be an intense scrutiny of the operator before giving her permissions!!!
One hurdle could be that how to get all neighbouring servers know about the changes in roles and access??? An MBean or App Server API could help you in this.
May I request all who see this direction to pour in more comments/ideas ? I would like to hear from David, duffymo, komone and jschell.
Rajesh

ADF UIX Role Based Access Control Implementation

Hi,
Can anybody suggest a detailed example or tutorials of how to implement a role based access control for my ADF UIX application.
The application users can be dymanically added to specific roles (admin, Secretary, Guest). Based on the roles, they should be allowed to access only certain links or ADF entity/view operations. Can this be implemented in a centralized way.
Can this be done using JAZN or JAAS. If so, Please provide me references to simple tutorial on how to do this.
Thanks a lot.
Sathya

Brenden,
I think you are following a valid approach. The default security in J2EE and JAAS (JAZN) is to configure roles and users in either static files (jazn-data.xml) or the Oracle Internet Directory and then use either jazn admin APIs or the OID APIs to programmatically access users, groups and Permissions (your role_functions are Permissions in a JAAS context).
If you modelled your security infrastructure in OID than the database, an administrator would be able to use the Delegated Administration Service (DAS), as web based console in Oracle Application Server. To configure security this way, you would have two options:
1. Use J2EE declarative security and configure all you .do access points in web.xml and constrain it by a role name (which is a user group name in OID). The benefit of this approach is that you can get Struts actions working dirctly with it because Struts actions have a roles attribute.
The disadvantage is that you can't dynamically create new roles because they have to be mapped in web.xml
2. Use JAAS and check Permissions on individual URLs. This allows you to perform finer grained and flexible access control, but also requires changes to Struts. Unlike the approach of subclassing the DataActionForward class, I would subclass the Struts RequestProcessor and change the processRoles method to evaluate JAAS permissions.
The disadvantage of this approach is that it requires coding that should be done carefully not to lock you in to your own implementation of Struts so that you couldn't easily upgrade to newer versions.
1 - 2 have the benefit of that the policies can be used by all applications in an enterprise that use Oracle Application Server and e.g. SSO.
Your approach - as said - is valid and I think many customers will look for the database first when looking at implementing security (so would I).
Two links that you might be interested in to read are:
http://sourceforge.net/projects/jguard/ --> an open source JAAS based security framework that stores the user, roles and permissions in database tables similar to your approach
http://www.oracle.com/technology/products/jdev/collateral/papers/10g/adfstrutsj2eesec.pdf --> a whitepaper I've written about J2EE security for Web applications written with Struts and JavaServer pages. You may not be able to use all of it, but its a good source of information.
Frank

Table control in module program

hi,
i don't know about table control in module program.so please send the faq's ?

hi
ganapathi
Table Controls in ABAP Programs
To handle table controls in ABAP programs, you must declare a control in the declaration part of the program for each table control using the following statement:
CONTROLS .
if you only want to determine the row of the table control. SY´-SUBRC allows you to check if the cursor is placed in a row of a table control.
this is all information about table control still if u have any quiries my mailid is [email protected]
plzz reward if usefull
dont forget to reward

How to save Custom control records through module pool program ?

Hi guru ,
1. How to save Custom control records through module pool program ?
I wrote multiple lines of record in custom control
Who to save that records ?
thanking you.
Regards,
Subash.

Hi,
can refer following code -
IN PAI , CODE is as follows-
*&      Form editor_output
FORM editor_output .
NARRATION1 is name of custom controller
IF v_editor IS INITIAL.
Create obejct for custom container
    CREATE OBJECT v_custom_container
      EXPORTING
        container_name              = 'NARRATION1'
      EXCEPTIONS
        cntl_error                  = 1
        cntl_system_error           = 2
        create_error                = 3
        lifetime_error              = 4
        lifetime_dynpro_dynpro_link = 5
        OTHERS                      = 6.
    IF sy-subrc <> 0.
      MESSAGE ID sy-msgid TYPE 'I' NUMBER sy-msgno
                 WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
    ENDIF.
Create obejct for the TextEditor control
    CREATE OBJECT v_editor
      EXPORTING
        wordwrap_mode              = cl_gui_textedit=>wordwrap_at_fixed_position
        wordwrap_position          = line_length
        wordwrap_to_linebreak_mode = cl_gui_textedit=>true
        parent                     = v_custom_container
      EXCEPTIONS
        error_cntl_create          = 1
        error_cntl_init            = 2
        error_cntl_link            = 3
        error_dp_create            = 4
        gui_type_not_supported     = 5
        OTHERS                     = 6.
    IF sy-subrc <> 0.
      MESSAGE ID sy-msgid TYPE 'I' NUMBER sy-msgno
                 WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
    ENDIF.
ENDIF.
ENDFORM.                    " editor_output
getting textdata in internal table as follows
*&      Form create_text
FORM create_text .
REFRESH : it_texttable,
            it_text.
IF v_doc_number IS NOT INITIAL.
    IF v_editor IS NOT INITIAL.
      CALL METHOD v_editor->get_text_as_r3table
        IMPORTING
          table                  = it_texttable
        EXCEPTIONS
          error_dp               = 1
          error_cntl_call_method = 2
          error_dp_create        = 3
          potential_data_loss    = 4
          OTHERS                 = 5.
      IF sy-subrc <> 0.
        MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
                   WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
      ENDIF.
Now, our final text data is in internal table it_texttable.
pls, Reward if found helpful.

Any best practice to apply role based access control?

Hi,
I am starting to apply the access permissions for new users as being set by admin. I am choosing Role Based Access Control for this task.
Can you please share the best practices or any built-in feature in JSF to achieve my goal?
Regards,
Faysi

Hi,
The macro pattern is my work. I've received a lot of help from forums as this one and from the Java developers community in general and I am very happy to help others and share my work.
Regarding the architect responsibility of defining the pages according to the roles that have access to them : there is the enterprise.software infrastructure.facade
java package.
Here I implemented the Facade GoF software design pattern in the GroupsAndRolesAccessFacade java class. Thus, this is the only class the developer uses in order to define groups and roles of users and to define their access as per page.
This is according to Java EE 6 tutorial, section VII Security, page 471.
A group, role or user is created with an Identity Management application or by a custom application.
Pages of the application and their sections are defined or modified together with the group, role or user who has access to them.
For this u can use the createActiveGroup and createActiveRole methods of the GroupsAndRolesAccessFacade class.
I've been in situations where end users very strict about the functionality of the application.
If you try to abstract web development, u can think of writing to database, reading from database and modifying the database as actions.
Each of these actions should have suggester, approver and implementor.
Thus u can't call the createActiveGroup method for example, without calling first the requestActiveGroupCreationHelper and then the approveOrDeclineActiveGroupCreationHelper method.
After the pages a group has access to have been defined with the createActiveGroup method, a developer can find out the pages and their sections a group has access to by calling the getMinimumInformationAboutGroup method.
Further more, if the application is very strict, that is if every action which envolves writing to the database must be recorded, this concept of suggester, approver and implementor is available throught the recordActiveGroupAction method.
For example, there is a web shop, its managers can change the prices of the products, but the boss will want to know who had the dared to lower prices.
This action of lowering prices, is an action of modifying the information in the database and u can save in the database who suggested it, who approved it and who implemented it.
Now that I write about the functionality of the macro pattern, I realise that some methods should have more proper names and I haven't had time to write documentation in the API, but this will be a complete when I add the web pages for the architect to use for defining access control and for the end users to view who and what is doing with their application.

Time-based access controls

Hello all,
Is there a time-based access control that can be configured for a 4.2 WCS+WiSM setup either in the WCS or controller? Or am I limited to the ACLs for my Wireless VLAN on the switch. Ultimately, I would like to be able to configure certain APs to accept/deny connections at specific times of the day. Any suggestions would be appreciated. Thank you in advance for your time and help.
Charles

Currently, IP and IPX extended access lists are the only functions that can use time ranges. The time range allows the network administrator to define when the permit or deny statements in the access list are in effect. Prior to this feature, access list statements were always in effect once they were applied. Both named or numbered access lists can reference a time range.
For the further description following URL for the Time-Based Access Lists will help you.
http://www.cisco.com/en/US/docs/ios/12_0t/12_0t1/feature/guide/timerang.html#wp10236
I hope it may help you.

How can I set the time in Time-based Access control ??

I live in Denmark, where we use the 24 hour system.
So I want to set the time-based access control to from 7.00 in the morning to 2.00 at night, but every time the Timecapsule says wrong time format, I can use the night time 23.59, but thats not late enough.

Set two controls.. 7 to 23.59 and 00.01 to 00.20
This is common as the control cannot handle times longer than 1day.

Issue while enabling Access Control for a Coherence server node

Hi
Im trying to enable access control for a Coherence server node, using the default Keystore login method shipped with Coherence. When i start the server i get the error "java.security.AccessControlException: Unsufficient rights to perform the operation". Please see below for the sequence of steps I've followed to enable access control. I just need to be enable Authentication (not authorization) at this stage
1. I have added the following entry in the Coherence Operational override file
<security-config>
          <enabled system-property="tangosol.coherence.security">true</enabled>
          <login-module-name>Coherence</login-module-name>
          <access-controller>
               <class-name>com.tangosol.net.security.DefaultController</class-name>
               <init-params>
                    <init-param id="1">
                         <param-type>java.io.File</param-type>
                         <param-value>keystore.jks</param-value>
                    </init-param>
                    <init-param id="2">
                         <param-type>java.io.File</param-type>
                         <param-value>permissions.xml</param-value>
                    </init-param>
               </init-params>
          </access-controller>
          <callback-handler>
               <class-name>com.sun.security.auth.callback.TextCallbackHandler</class-name>
          </callback-handler>
     </security-config>
2. The following is the entry in the Permissions.xml
<?xml version='1.0'?>
<permissions>
<grant>
<principal>
<class>javax.security.auth.x500.X500Principal</class>
<name>CN=admin,OU=Coherence,O=Oracle,C=US</name>
</principal>
<permission>
<target>*</target>
<action>all</action>
</permission>
</grant>
</permissions>
3. The following is the content of the Login configuration file "Coherence_Login.conf"
Coherence {
com.tangosol.security.KeystoreLogin required
keyStorePath="keystore.jks";
4. The following is the command line tag for starting the server
java -server -showversion -Djava.security.auth.login.config=Coherence_Login.conf -Xms%memory% -Xmx%memory% -Dtangosol.coherence.cacheconfig=PROXY-cache-config.xml -Dtangosol.coherence.override=FOL-coherence-override.xml -Dcom.sun.management.jmxremote.port=6789 -Dcom.sun.management.jmxremote.authenticate=false -Dtangosol.coherence.security=true -cp "%coherence_home%\lib\coherence.jar" com.tangosol.net.DefaultCacheServer %1
Following is the output on the Console when running the command. It asks for a username and password for the JKS store (If i provide the wrong password, it gives a different error, which shows that it is able to authenticate aganst the Keystore). After i put in the password, it throws the error as shown below "java.security.AccessControlException: Unsufficient rights to perform the operation"
D:\Coherence\FOL_CacheServer>fol-cache-server
java version "1.6.0_20"
Java(TM) SE Runtime Environment (build 1.6.0_20-b02)
Java HotSpot(TM) 64-Bit Server VM (build 16.3-b01, mixed mode)
Username:admin
Password:
Exception in thread "main" java.security.AccessControlException: Unsufficient ri
ghts to perform the operation
at com.tangosol.net.security.DefaultController.checkPermission(DefaultCo
ntroller.java:153)
at com.tangosol.coherence.component.net.security.Standard.checkPermissio
n(Standard.CDB:32)
at com.tangosol.coherence.component.net.Security.checkPermission(Securit
y.CDB:11)
at com.tangosol.coherence.component.util.SafeCluster.ensureService(SafeC
luster.CDB:6)
at com.tangosol.coherence.component.net.management.Connector.startServic
e(Connector.CDB:20)
at com.tangosol.coherence.component.net.management.gateway.Remote.regist
erLocalModel(Remote.CDB:10)
at com.tangosol.coherence.component.net.management.gateway.Local.registe
rLocalModel(Local.CDB:10)
at com.tangosol.coherence.component.net.management.Gateway.register(Gate
way.CDB:6)
at com.tangosol.coherence.component.util.SafeCluster.ensureRunningCluste
r(SafeCluster.CDB:46)
at com.tangosol.coherence.component.util.SafeCluster.start(SafeCluster.C
DB:2)
at com.tangosol.net.CacheFactory.ensureCluster(CacheFactory.java:998)
at com.tangosol.net.DefaultConfigurableCacheFactory.ensureServiceInterna
l(DefaultConfigurableCacheFactory.java:923)
at com.tangosol.net.DefaultConfigurableCacheFactory.ensureService(Defaul
tConfigurableCacheFactory.java:892)
at com.tangosol.net.DefaultCacheServer.startServices(DefaultCacheServer.
java:81)
at com.tangosol.net.DefaultCacheServer.intialStartServices(DefaultCacheS
erver.java:250)
at com.tangosol.net.DefaultCacheServer.startAndMonitor(DefaultCacheServe
r.java:55)
at com.tangosol.net.DefaultCacheServer.main(DefaultCacheServer.java:197)

Did you create the weblogic domain with the Oracle Webcenter Spaces option selected? This should install the relevant libraries into the domain that you will need to deploy your application. My experience is based off WC 11.1.1.0. If you haven't, you can extend your domain by re-running the Domain Config Wizard again (WLS_HOME/common/bin/config.sh)
Cappa

Creating SOD matrix with the help of Access control default ruleset

I am creating the SOD matrix for the existing roles of CRM and HR modules. As I am the security consultant therefore does not have the functional knowledge about the conflicts for CRM and HR transactions. My question is can I use the function/actions/risks conflicts provided with the Access control 5.3 default ruleset. We are not using Access control for these systems, so I want to know whether I can take the help of AC 5.3 default risks to create the SOD matrix based on it.
For e.g, like H001 default HR risk, I would make sure not to assign PA30(maintain HR data) with the PA03/PA04(maintain personal control record) as this will result in the providing conflict "Modify payroll master data and then process payroll".
Once I have the SOD list based upon AC 5.3, I can consult the Business approver/auditor to verify and modify as per the business requirement.
Maybe I am thinking the wrong way, please provide your inputs so I can work on it. Any help appreciated.
Thanks,
Sanjay Desai

The most important thing to keep in mind is that you need to build a rule set that reflects the customers real business risk!
What you build there will influence the way the customer will be able to continue work, assign access and perform control activities. The input HAS to come from the business!
You can use the SAP standard risk definitions as a starting point for discussions, and the HR functions are an excellent building block to identify the transactions and necessary authorization objects that allow users to perform the actions.
But the real challenge is to identify the risks as perceived/accepted by the business!
Frank.

Access control based on module/ program

Similar Messages

Maybe you are looking for