Access control for different user groups in APEX 4.0

Hi guys,
in Apex 4.0, is there any way to use the access control page to configure access control for different user groups?
The access control page currently only has an access control list by users with 3 privileges namely, Administrator, Edit & View where Administrator has the highest access level & View the lowest. Therefore 1 user cannot have more than 1 different privilege, however if the user belongs to 2 or more different groups then we can control what access he can have in a more fine grained manner. We also want to have more than the 3 privileges given.
Can we assign different groups to different users and let them have different privileges to be configured by page, region, process or item level?
Now Apex will create 2 tables, Apex_Access_Control & Apex_Access_Setup to store the application access control mode & access control list. It will also create 3 authorization schemes "access control - administrator", "access control - edit" & "access control - view" based on the 2 tables.
Does this mean we have to change the table structures & edit the authorization schemes to suit our usage? We are reluctant to do this because if we upgrade to a newer version of Apex then we would have to merge our pl/sql coding with Apex's updated code.
How can we auto-configure more than the 3 authorization schemes in the access control page? Is there any way to achieve a finer grain of access control based on the current access control administration page given by Apex without writing it ourselves?
We are afraid that we may have missed something on Apex access control & do not want to reinvent the wheel.

Hi Errol,
to build your own application authorization scheme around the security model supplied by Apex for administration of the Apex environment would be a bad idea.
This was never intended for authorization scheme management in custom built Apex applications, it was solely intended to control access in the Apex environment overall. The API for it is not published, and making changes to it, such as adding more roles, would run the risk of breaking the overall Apex security model. It would not be supported by Oracle and Oracle would not guarantee the upwards compatibility of any changes you make in future versions of Apex.
In short, you should follow Tyson's advice and build your own structure. As he indicated, there are plenty of examples around and provided your requirements are not too complicated, it will be relatively simple.
Regards
Andre

Similar Messages

  • How to set different default interactive reports for different user groups?

    I'm probably overlooking an obvious solution, but how do I set different default interactive report for different user groups?
    For the same interactive report, I want one set of users to see a default where the default filter is based on column X. However, another group of users doesn't have authorization to see that column so I need to set the default filter to something else for them.
    Thanks

    You can set a filter on a report in a URL - would that help? I think with apex 4.x you can also link to a saved default report or alternative report...

  • Mass creation of common folders for different user groups

    Hello Experts,
    We are using Portal 7.0 SP12 and we have 10 different user groups created in Portal.
    Based on this group structure, we need to create two common folders in each of the user's personnel documents in KM.
    Is there is any way to achieve this kind of requirement ?
    Can we do mass creation of these two common folders which will be assigned to all of the groups. This needs to be done in user's personnel documents and not in Public documents.
    Any help in this context would be highly appreciated. points assured.
    Thanks in advance,
    Anil Kumar.

    For every user a folder is created in userhome. One approach is to capture this folder creation event and create the folder structure you need. You need to develop a portal service which will listen to events from userhome repository.
    1. Capture folder creation event for user home
    2. Create the folder structure you want in this event handler
    Check this documentation on how to do this.
    https://media.sdn.sap.com/html/submitted_docs/nw_kmc/howto/rf/client_api/rf_client_api.html
    Regards,
    Prasanna Krishnamurthy

  • Using different configured views for different user group in crm2007

    Hello SAP Expert,
    Want to clarify if the BADI (Configuration Access Determination BADI ; BSP_DLC_ACCESS_ENHANCEMENT)  is used as design time or Run time. By looking the help of this BADI it says "This Business Add-In (BAdI) is used in the UI Configuration Tool (CRM-FRW-CON) component." Looks like this is at configuration time not at run time.
    The actual requirement is that for a set of users which work on a particular department, we want to have some extra information on 2 views and rest of the views they would be using same as entire organization. We are inclined towards using config role rather than zviews. If we were to use zviews then it would not be a difficult one.
    We were thinking of a mechanism to show the configured view based on user's Business Role at runtime. e.g. we have 2 roles A and B. Role A user have only 2 views specific to them and all other views they use same as Role B. We do not want to use ZView rather use Role Config Key to distinguish the views. What I was thinking that we should be able to create these 2 views with Config Role A and all  views (including these 2) with Config Role B. On Business Role A and Business Role B both, We will assign Config Role "B". but at runtime system should determine if the Business Role is A and Component is CMP1 then use the view V1 with Config Role A not the default view with config role B. (we can maintain that information in a Z table). This is not based on runtime profile but to use configured view at runtime.
    Any thoughts/ help really appreciated.
    Best regards,

    Hi Amithab,
    you can use badi CRM_BP_UIU_VIEW_CONFIG  of enhancement spot CRM_UIU_BP_ENHANCEMENT for your requirements. Please read the badi documentation because you need also a implementation of badi CRM_BP_UIU_CONFIG_CALLBACK (same spot). SAP considers badi CRM_BP_UIU_VIEW_CONFIG only for use at dynamically loading different configuartions of view details for business partners or contact persons at runtime. But you can use your badi implementation also for other views. You have to redefine method DO_CONFIG_DETERMINATION in your views. And call your badi from there. For this copy&paste the logic of DO_CONFIG_DETERMINATION of bp details to the views you have to load dynamically at runtime.
    We have used this approach for access controll and granting special access to views dependent on different employee functions.
    Best regards
    Michael

  • How to set different urls for logoff button for different user groups

    HI All,
    We have two different set of users in our company .when one user group clicks on the logoff button in masthead we want to redirect them to for example www.google.com and for the other group we want to redirect to www.gmail.com.
    How can we acheive this particular requirement
    Thanks
    Bala Duvvuri

    hi bala,
    For the  two user groups maintain two different desktops, two/same themes and frame work.change the headeriview jsp in masthead par file to Google and save it as masthead1 and another one with gmail as masthead2 then create iviews with that par file and assign them to different groups and make invisible the default masthead iview.then the users get the logoff based on group you can get some wikis on changing log off or redirecting log off, check these threads
    Portal logoff : Redirection or Close the Entire Window
    Portal Logoff redirection URL
    Regards
    Mahesh

  • Different Password Policy for Different User Groups in ACS 4.2

    Hi All,
    Can some one provide a solution for the below requirement?
    We do have ACS 4.2 appliance managing firewalls of different clients. The users are common i.e, helpdesk administrators. One of the client came up with setting different password policy for managing their devices i.e, the client wants to have min 15 characters as password length. We do have currently 8 characters as min password length. Can we change the password policy to min 15 characters only for managing the firewalls of this client whereas for all other client firewalls we feel better to have 8 characters as min password length?
    It seems that these password policies are global & affects all the users.
    This is something like, having two sets of password (for each user) policy depending on the client which he is going to manage.
    For my knowledge, i think that this is not possible. But, thought to cross-check with experts!
    -Jags.

    Hi jags,
    Yor're correct. Password policy on ACS will affect all internal user. We can't create different password policies for diferent clients/connections/set_of_users
    Password validation options apply only to user passwords that are stored in the ACS internal database. They do not apply to passwords in user records in external user databases; nor do they apply to enable or admin passwords for Cisco IOS network devices.
    HTH
    Regards,
    JK

  • How to Create ACCESS key for different users

    How to create or generate an ACCESS KEY which is required to make changes to the table V_FAGL_ACTIVEC (For New General ledger) for IDES 6.0. Is it created in table DEVACCESS, if so where or is it created in SU01 where user id's are maintained. Since I am working on IDES, I thought probably we can create it for each user in SU01, but dont know the steps to do it. Please help me. It is urgent.

    Hi
    ACCESS KEY - First of all its provided by SAP. You can get the key from http://service.sap.com -> SAP SUPPORT PORTAL -> Keys & Requests -> SCCR Keys -> Registration. Here u can register a DEVELOPER or an OBJECT, by this time SAP will give the ACCESS KEYS.
    **Note : To access http://service.sap.com u should have S number login or like that.
    Only after obtaining that ACCESS KEY, SAP will allow the DEVELOPER to create some objects or change or modify Delivered objects.
    Why ACCESS KEY - For creating or accessing any object some one should be responsible. Suppose, any issue arises with an object then can easily track the details who has created or modified.
    Reward with suitable points

  • URL access rights of a partner application for different user groups

    I have deployed an application in OC4j_Portal, enabled the SSO feature by doing the required entry in mod_osso file.
    Now I want a certain group of users to be able to access the URL of my application and not the others.
    Right now every valid user of the OID can access it.
    How should i restrict the access?

    If this is a Portal application you could define the access in Portal. Otherwise you might need to change your code and check if the logged in user is a member of the group you want to grant the access.
    Otherwise a custom LoginManager might solve your problem (JAAS). Check out http://www.oracle.com/technology/products/jdev/howtos/10g/jaassec/index.htm
    cu
    Andreas

  • Business Catalyst access permissions for different users

    Hi there,
    We want to have specific people have access to specific areas of a website we are developing and are considering using BC.
    For example:
    - Distributors will have their own section to access resources such as training manuals, videos and service agreements.
    - Service techs - will have their own section to access resources such as service manuals, instal guides etc.
    How does Business Catalyst allow different people to access different areas? Is it by:
    - Password?
    - People in the database are tagged, so they use their profile to access their own area?
    - other?
    If it is possible, could we be pointed in the direction of how to set this up?
    Thanks in advance for any help.
    Cheers,
    Andrew

    Sounds to me like Secure Zones will do this for you...
    You can create as many secure zones as you like and asign (or use registration forms) anybody to any zone. Ofcourse each zone can have it's own content, theme, etc...
    Here's a good place to start:
    http://helpx.adobe.com/business-catalyst/partner/add-secure-area-your-site.html

  • Active Directory Authentication and permissions for user group in APEX 4.0

    Hello,
    I am new to oracle APEX and I have searched the forum for active directory authentication for a user group and I am really confused about all the different threads. Can anyone please provide me the steps to follow; in order to implement AD authentication for a user group in Oracle APEX 4.0.
    These are the threads which i was looking at to get an idea like how AD authentication works but its really confusing for me.
    Help with Authentication (APEX_LDAP.AUTHENTICATE)
    Re: LDAP Authentication Via Groups
    Thanks,
    Tony

    You need to give it more than 30 minutes before bumping your own post. This is not an official support channel, so you need to be patient and wait for people to read, think and respond.

  • Restricting  Access for SQ01 User Group

    Hi ,
    Please let me how to Restrict  Access for a   User Group  to only some of  the specific users?
    Thank you
    Edited by: Vibhor Arora on Apr 12, 2010 7:29 AM

    Hi,
    Can you please clarify what exactly you want to know, your request can be interpreted in a few different ways.
    If you are concerned that people have access to all user groups, then you need to remove access to S_QUERY activity 02 and I think activity 23.  They will lose access to all user groups that they are not assigned to via SQ03.

  • [SOLVED] Partition & Access for different users

    Hey guys, I’m kind of lost and need some help.
    Scenario:
    My computer is set up with two hard drives: one SSD, which holds Arch and the /home folder, and a regular HDD, which holds the /var folder and where all data should go on two separate partitions.
    Both partitions are mounted at /mnt/HDD2 and /mnt/HDD3.
    Naturally, they both belong to root. However, since I want to be able to save all my music, games and whatnot on these two partitions I need to be able to access them as a normal user. On a single user system that would be a no-brainer; I would simply change the ownership. However, I plan to have another user use my computer from time to time and thus need to have the partitions accessible not only for one but a second user as well. And that’s where I can’t get things to work.
    First I’ve changed the group for the partition (users) and added both users to the corresponding group (users) but could not write on the partition.
    Then I’ve run chmod a+rxw on the partition. Beside the fact that I think that this is quite an inelegant solution, newly created folders where still only accessible by the corresponding user.
    I’ve also set the SGID-Bit but no dice either.
    Now I’m totally lost. Obviously, I’m missing something but I don’t see what.
    tl;dr: I need access to a partition for different users on a single system so that they can easily save, write and share files between each other.
    Any help appreciated.
    Last edited by Janusz11 (2014-10-03 12:32:58)

    Problem solved.
    I ended up using umask. It's basically a single user system anyway with a second user only using it from time to time and both of us having their own group. So it should be relatively save using umask.
    I've changed the owner and group of the partition:
    chown user1:group /mnt/HDD
    ...and the permissions:
    chmod 2770 /mnt/HDD
    ...and added both users to the corresponding group of the partition:
    gpasswd -a user1 group
    gpasswd -a user2 group
    Finally I've changed umask to 007 for each individual user while leaving the system-wide umask untouched.

  • Using different templates for different user access types.

    Hi all,
    I have an issue where we have a Page Group with lots of pages/sub-pages.
    There are three different User Groups, Internal, Customer and Supplier.
    I need to display the same content but with different templates (look and feel), one for the Internal, one for the customer and one for the supplier.
    Can this be done using Oracle Portal 10.1.14? If so, how?
    Many thanks.

    Hi,
    Yes you can do what you want to do in 10.1.4.
    You can call a procedure in your HTML Layout Template which will write some CSS. This procedure will be executed with the USERID parameter.
    Your procedure will check if the current user is a customer or a supplier and your CSS will reflect the differences (with different colors or whatever...)
    Good luck,
    Max.

  • How can I have different access control for the guest network (different than the main network)?

    I am trying to control my main wireless network with access control via mac id with no password. I wanted a separate guest network with password access and no access control. However, the only way that the guest network works is if I specify unlimited access as the default. Is what I am trying to do possible.

    I am trying to control my main wireless network with access control via mac id with no password.
    Definitely not a recommended method for security. MAC addresses are easily cloned by anyone who wants to do so with free tools available on the Internet. An unwanted guest will be on your network in less than a minute if they want to be.
    Strongly recommend that you use WPA2 Personal security with a non-dictionary password to protect your network.
    I wanted a separate guest network with password access and no access control. However, the only way that the guest network works is if I specify unlimited access as the default. Is what I am trying to do possible.
    Unfortunately, Apple does not allow separate Access Control for the "main" and "guest" networks. It's all or nothing, I am afraid.
    Likely, the  "best" way to set up Access Control is change the default rule to No Access, Then you will need to enter in the details for every device that you want to allow to connect for both the "main" and "guest" networks with the time limits for each device.

  • Sharing files for different users on same computer without duplicating

    Newbie here, I got my 1st mac (in ten years) last week and have been really enjoying it. I set up 3 user's accounts and wanted to share files such as iphoto and itune for all users. So I put my pictures in the shared folder, however, when I opened iphoto in each user's account, I had to import all the photos for every user, which resulted in duplicated files on each user's folders. I have tens of thousands of photos and don't want redundant files eat up my hard drive space. For this reason I'm holding off sharing my itune files.
    I'm wondering if there's a way to allow access for different users without making duplicates.
    20 in. imac   Mac OS X (10.4.8)  

    ewrspotter
    Preferably only admin can edit/import
    Well this makes things very easy and is the way that iPhoto is intended to share. In your Admin account, go to iPhoto -> Preferences -> Sharing and enable Sharing. Note that you can share an entire library or just individual albums. Leave iPhoto running and use Fast-User Switching to move to the other Account(s). In Launch iPhoto and go to Preferences -> Sharing and enable 'Look for Shared Photos'. The main library will turn up in the Source (or left-hand) pane of the other iPhoto.
    Remember that for this to work, the Admin account must be logged in and iPhoto must be running there.
    I don't really care as long as there's no redundant files.
    Define 'redundant'. You do realise that iPhoto is a database, with built-in image viewer, lightweight editor and version control. Version control means that if you modify a photo then iPhoto makes a copy, including the changes, and keeps the Original. This way you can always Revert to Original from the Photos menu. Many people switching to iPhoto are confused by this at first. If you don't want version control I strongly suggest using a different app. There a many, many image viewers for the Mac.
    As to your point comment about One-Touch DVD. I'm not familiar with that piece of Software, but every DVD (and CD) that you burn is assembled on the HD first, then burned. That assembly is a cache file and should be trashed on completion.
    As to disk space: you need to keep about 10 gigs of space on the Start-Up disk for Virtual memory, Temp files and other OS uses. If you do get an external at some point in the future it is possible to run both iPhoto and iTunes from it to free up space on the internal. Just check the help or post back to the relevant forum before moving them. It's not difficult, but there is a procedure that needs to be followed.
    Regards
    TD

Maybe you are looking for