Access Control with Custom Groups

I am rather new to APEX. I am trying to implement access control/authorization using custom groups (not the built-in View, Edit, and Administrator groups). I did search the discussion forums and the web in general but so far I have come up empty. I was hoping someone could point me into the right direction as to how to get started. Are there stored procedures that need to be customized/implemented? Where do I store the user groups? Can I use the built-in tables or should I create custom security group tables? Those are just some of the questions I am trying to figure out and any help would be much appreciated.
And BTW, due to client requirements, we are currently using version 3.2. Not sure if there are any significant changes between that version and the latest version.
Thank you all!
Mischa

Custom authentication is fairly easy to set up with your own tables, here is an example
http://djmein.blogspot.com.au/2007/07/custom-authentication-authorisation.html
This leads on to authorisation, again using your own tables. You need to look into using authorization schemes
http://docs.oracle.com/cd/E37097_01/doc/doc.42/e35125/sec_authorization.htm#BABEDFGB
This can simply be queries on your own group tables, which presumably would control membership by username.
You ask the question about using built-in tables, yet don't want to the built-in administrator groups?
Plenty of significant changes, but none that should affect you in regard to authentication/authorisation.
Scott

Similar Messages

WP8 Map control with custom tiles

I'm trying to display a map control in my app targeting Windows Phone 8 but I want to use custom tiles from open street map.
I'm using this line :
mapControl.TileSources.Add(new TileSource("http://a.tile.openstreetmap.org/{zoomLevel}/{x}/{y}.png"));
When I launch the app the custom tiles are properly displayed, but there's still the default map tiles underneath them.
I tried to hide them, but I counld'nt even find where they exist in the map control and what is displaying them exactly.
I would like to know how I can remove those default tiles when loading custom tiles.
I tried to hide them, but I counld'nt even find where they exist in the map control and what is displaying them exactly.

Hi MakanWG,
You have solved your question in here:
http://stackoverflow.com/questions/27948331/wp8-map-control-with-custom-tiles .
Good!
Vote if help you

Is there an option to import with custom groups in PSE 9's organizer?

With the Organizer included with PSE7 (and earlier, as I recall), I always used the option Custom Groups (Advanced) in Create Subfolders. This allowed me to easily save imported photos into different folders and naming the files accordingly.
For example, on one media card I might have some family activities, some Kiwanis activities, and skiing activities. With Custom Groups, I could import them in small groups, with different base names, and so on.
How do I accomplish those same things in PSE9. It was such a useful feature, Please tell me they did not remove it.
Thanks!

As far as adding java script to the generated form you can add a pl/sql code having java script in it for eg below is a sample function
which has javaScript in it.
CREATE OR REPLACE FUNCTION sample_javaScript
RETURN varchar2 IS
l_string varchar2(1000);
l_char_en varchar2(1) := chr(38);
begin
l_string := '<script language="JavaScript1.1">'||chr(10)
||''||chr(10)
||'</script>'||chr(10);
return l_string;
end sample_javaScript;
Grant this to the schema of the form if they are in different schemas.
In the last sql section (Before Display of the form) you can simply call this function like this.
htp.p(schemaName.sample_javaScript);This will place java script at the form level.
You can similarly write what all javascripting you wish to do at the form level instead of
element level.For firing of Lovs also you can write code in the java script that will do the required action.

Resizing controls with custom skin

Hi,
Can someone tell me how to make a spark control with a custom skin made in Catalyst to behave like a standard unskinned control when resized in design view of Flash Builder or during runtime? In other words I want it to behave like it's 9-sliced. For example, I've made a simple and ugly rounded skin for TextInput in Catalyst like this:
<?xml version="1.0" encoding="utf-8"?>
<s:Skin xmlns:s="library://ns.adobe.com/flex/spark" xmlns:fx="http://ns.adobe.com/mxml/2009">
     <fx:Metadata>[HostComponent("spark.components.TextInput")]</fx:Metadata>
     <s:states>
          <s:State name="normal"/>
          <s:State name="disabled"/>
     </s:states>
     <s:Group x="0" y="0">
          <s:Rect height="31" radiusX="5" width="182" x="0.5" y="0.5">
               <s:stroke>
                    <s:SolidColorStroke caps="none" color="#000000" joints="miter" miterLimit="4" weight="1"/>
               </s:stroke>
               <s:fill>
                    <s:SolidColor color="#FF90CD"/>
               </s:fill>
          </s:Rect>
          <s:RichEditableText color="#2B4381" fontFamily="Arial" fontSize="12" tabStops="S0 S50 S100" x="11" y="11" width="161" heightInLines="1" id="textDisplay"/>
     </s:Group>
</s:Skin>
How to do that in this example?
I have searched everywhere on the net, and in a 1000 page book I have about Flash Builder and Flex and couldn't find even a single example. And I need this if I want to make something like resizable web form with a resize grip or resizable options panel.
Thanks in advance,
Petar

I've got an answer but on other forum. Here is link if someone finds answer to this question useful: http://stackoverflow.com/questions/3299385/resizing-flex-spark-control-with-a-custom-skin

VDI Access Control with ISE

Hi Guys,
Can ISE do the Access Control for the VDI users with thinclients like PCs? Now we wanna to setup the 802.1x authentication for the VDI users, but i'm not sure if this can be done by ISE. Do we just need to configure the access switch ports to open 802.1x as usual and the switch then will relay the radius to ISE?

Rodrigo,
You are right if it is using the same IP+MAC, then I don't think the identity-based firewall feature of the ASA will work for you unless you can set the Citrix VDI to use DHCP to give a unique IP for each desktop.
This is how it worked with vmware::
1. Single VDI pool with a unique IP for each desktop assigned by DHCP on the same subnet.
2. User logs in to floating desktop and Windows login server is updated with username and IP
3. Cisco Directory Agent (CDA) gets the username/IP mapping from Windows login server.
4. Cisco ASA is configured to allow access based on Windows AD group X.
5. ASA gets username/IP mapping from CDA and checks AD directly for group assignment.
6. ASA enforces access policy on the IP that is currently used by the user of group X. Users of groups Y and Z would have different policies.
NOTE: Anyconnect is not used with identity-based firewall for Windows devices. If used for 802.1x (wired or wireless) or any other supplicant, it does allow Identity-based firewall to work with non-windows devices. If Cisco would only enhance RA VPN to work when using ISE authentication with windows domain detection or assignment, it would be a complete identity-based solution. RA VPN can work if authenticating directly with AD.

War file and access control with WebLogic

I am trying to put some access control on different files in my war-file, but just can't get it to work... It seems like all roles defined in weblogic.properties gives the user access to all files in the war. I just don't understand the connections between the security realm, the weblogicURL.policy file and the web.xml file... If I do not specify a weblogic.security.URLAclFile, no access control is done at all.
This is how my weblogic.properties file looks like:
weblogic.security.URLAclFile=e:\\weblogic\\weblogicURL.policy
weblogic.password.koko=kokokoko
weblogic.password.arnebelinda=arne1234
weblogic.security.group.ppuseradmins=arnebelinda
and my weblogicURL.policy:
deny Principal weblogic.security.acl.GroupImpl "everyone" {
Permission weblogic.security.acl.URLAcl "weblogic.url", "/admin/-";
and finally, my web.xml-file:
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.2//EN"
"http://java.sun.com/j2ee/dtds/web-app_2_2.dtd">
<web-app>
     <session-config>
          <session-timeout>30</session-timeout>
     </session-config>
     <welcome-file-list>
          <welcome-file>index.jsp</welcome-file>
     </welcome-file-list>
     <security-constraint>
          <web-resource-collection>
               <web-resource-name>admin</web-resource-name>
               <url-pattern>index.jsp</url-pattern>          </web-resource-collection>
          <auth-constraint>
               <role-name>ppuseradmins</role-name>
          </auth-constraint>
     </security-constraint>
     <login-config>
          <auth-method>BASIC</auth-method>
          <realm-name>WebLogic Server</realm-name>
     </login-config>
     <security-role>
          <role-name>ppuseradmins</role-name>
     </security-role>
</web-app>
it does not matter which user is part of the ppuseradmins group. The user koko is not a member, but is given access to my whole .war anyway (after submitting correct username/password). Omitting the <realm-name> does not seem to work either; the default realm is not used, instead null is used.
Does anybody have a clue? I would really appreciate it!
I am using WebLogic 5.1 sp 9
best regards,
PJ

In you pocily file entry, you have specified "/admin/-"
However, in the <security-constraint> element in web.xml, your <url-pattern> is not set to /admin
Could that be the problem ?

Configuring Access Control with OIM 11gR2

Hi,
I have to configure Access Control resource with OIM 11gR2. Kindly share relevant pointers.
Best Regards,
Varun

I think this link will be Helpful
22.5.1 Configuring Oracle Application Access Controls Governor
http://docs.oracle.com/cd/E27559_01/dev.1112/e27150/segduties.htm#OMDEV3394

SAP Business Objects Access control with BI4.1 and enterprise authetication

Hi Team,
We are on BI 4.1 with enterprise authentication. We are using IDM (oracle waveset 8) for access management. Currently we receive request from IDM and we manually configure user in BI4.1. We are now planning to automate this process, like as soon as user request place request through IDM , his access wil lget configure in BI 4.1
can we achieve this using SAP Business Objects Access controle or with any other method ? Need your guidance
Thanks,
Nivedita

Hi Andrea,
1. you configure the BOE Server with the SAP authentication for your SAP server
1b you configure trust between the portal server and the SAP system
2. you import the portal iView template as part of the SAP Kit into the portal server
3. you create a new system (or use an existing one) in the portal system landscape and configure the properties of the Crystal Enterprise properties
4. you create a new iView based on the portal iView template
ingo
I have some difficulties to create a new system, I don't know witch option i should choose.
     System (from template)
     +BI JDBC System
     BI ODBO-Compliant OLAP System
     BI SAP Query System
     BI XMLA-Compliant OLAP System
     EP 5.0 System
     HTTP System
     JDBC System
     KM Lotus System
     KM WebDAV System
     KM Windows System
     SAP system using connection string
     SAP system using dedicated application server
     SAP system with load balancing
     Web Service System using WSDL URL+
     System (from PAR)
     com.sap.km.cm.repository.manager
     com.sap.km.common.domino
     com.sap.netweaver.coll.appl.gw
     com.sap.netweaver.coll.appl.sync
     com.sap.portal.httpconnectivity.urlsystem
     com.sap.portal.ivs.sl.connector.helper
     com.sap.portal.runtime.application.soap
     com.sap.portal.systems.bi
     com.sap.portal.systems.datasource
     com.sap.portal.systems.EP5
     com.sap.portal.systems.jdbc
     com.sap.portal.systems.sap
     com.sap.portal.systems.webservices
     com.sap.portal.unification50.template
Thanks a lot
Selvam

Access control with JSP

We have been working with a design company to design our website HTML. However, a portion of these HTML files need to be password protected, all of these files are stored in one particular folder called "/tools". The problem here is that these files should only be accessible if the user has logged into the site, and the design firm has given all of these files an .html extension, which means that they will not be able to run embedded JSP code.
From what I understand, if I want to create access control in these .html files I will need to rename them all to .jsp and then update all the links to these files to use the .jsp extension. But the design firm is telling me that their other clients never needed to do this and were able to use JSP to control access to the folder itself. They said that it is possible using JSP to prevent access to a particular folder on the webserver, and that anybody without a valid login or session who tries to access the files in the folder can be redirected to the login page. All of this can be achieved without having to insert JSP code into the password-protected HTML files and renaming them with a .jsp extension. Is this true? We want to avoid doing this because there are a lot of HTML files and links that will need to be changed if we rename the files to .jsp.
I'm still a relative beginner with JSP and have never heard of any functionality which allows JSP to stop a browser from accessing a particular folder on the server. Am I missing something here? Is there really a better way of doing this without using JSP code?
I have thought about putting the folder in an offline location and then using a controller JSP/servlet to check the user's login status and then read & display the HTML file from the offline folder. But I am not sure if this is really an efficient way of doing this.
Any suggestions?
Thanks,
Phil

You can set up a servlet filter in the web.xml. That lets you intercept every single request to certain areas of the app, and modify/redirect it if necessary.
Example: This sets up a filter that runs on all requests to the "/tools" directory:
In web.xml:
   <filter>
     <filter-name>testFilter</filter-name>
     <filter-class>com.TestFilter</filter-class>
   </filter>
   <filter-mapping>
     <filter-name>testFilter</filter-name>
     <url-pattern>/tools/*</url-pattern>
   </filter-mapping>And an example java class of a filter. This one just logs the request URI.
package com;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
public class TestFilter implements Filter{
     public void init(FilterConfig arg0) throws ServletException {}
     public void destroy() {}
     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
          if (request instanceof HttpServletRequest){
               HttpServletRequest req = (HttpServletRequest)request;
               System.out.println("Servicing request for " + req.getRequestURI());
               chain.doFilter(request, response);
}

Cross-enterprise integration of SAP GRC Access Control with PeopleSoft

Friends,
Does anybody has/have/had the owner to implement Cross-enterprise integration of SAP GRC Access Controls 5.2 with PeopleSoft ?
If yes, what are the key points and approach one should keep in mind while going for this kind of cross-enterprise implementation.
Is there any reference material, blog, wiki or such informative resource regarding cross enterprise GRC implementation available on the web?
I tried to search, but could not get good results.
Any help would be highly appreciated.
Best Regards,
Amol Bharti

Amol-
From my experience:
CC 5.2 with Peoplesoft: as long as you have the RTA's installed in the Peoplesoft system and create the connectors in CC, you are good to go.
AE 5.2 with Peoplesoft: cannot provision to Peoplesoft, however you can connect with Peoplesoft HR for Password Self-Service. You have the capability to provision to SAP HR.
FF 5.2 with Peoplesoft: N/A
RE 5.2 with Peoplesoft: N/A
I am not sure if there are any standalone docs out there for AC integration with Peoplesoft. And the 5.2 manuals have sparse information on integration. However, the AC 5.3 manuals have more detailed info on the integration piece with various other non-SAP systems.
Sorry, I couldn't share more info, as that is all I know for now...
Ankur
GRC Consultant

Sales Analysis with Customer Group Name

Hi,
Just want to know whether anyone knows how to add the Customer Group Name in SAP Standard Sales Analysis Report?
I have tried to add in Sales Analysis layout designer, but the value reflected is not correct. E.g. when my customer group criteria is Retail group, but the report layout printed out is Corporate group.
In layout designer, my source type = database, table = card groups, column = group name. Thanks.
Regards,
MH

I have checked that Sales Analysis Report by Customer - Monthly and by Invoices - by Individual Display should be ok to bring the right group name based on your selection if you put the new field in the right place. (source type = database, table = card groups, column = group name)
Where do you create this field? What is your B1 version and PL?
Thanks,
Gordon

Access control for Custom Objects

Hi,
I am working with two custom objects: Custom Object 1 and Custom Object 5. There is a team on Custom Object 1.
The user has access to both and has create access for Custom Object 5.
The user is not the owner of a record in Custom Object 1, but is on the team for the record with full access.
When in the related section for the custom object 5 you click on edit I get the following error: "You have read-only access to this record. Click Cancel button or Back link to continue. Access Denied.(SBL-DAT-00284)"
When you click on the link to the related record and then on edit it works fine, the user can edit and save the changed record.
I do not understand why this does not work in the related section.
Thanks for your reply!
Arnold

Hi Errol,
to build your own application authorization scheme around the security model supplied by Apex for administration of the Apex environment would be a bad idea.
This was never intended for authorization scheme management in custom built Apex applications, it was solely intended to control access in the Apex environment overall. The API for it is not published, and making changes to it, such as adding more roles, would run the risk of breaking the overall Apex security model. It would not be supported by Oracle and Oracle would not guarantee the upwards compatibility of any changes you make in future versions of Apex.
In short, you should follow Tyson's advice and build your own structure. As he indicated, there are plenty of examples around and provided your requirements are not too complicated, it will be relatively simple.
Regards
Andre

Error while accessing application with custom components

Hi experts,
I have an application (HAP_MAIN_DOCUMENT) of component FPM_OIF_COMPONENT which uses a Webdynpro component with the same name (HAP_MAIN_DOCUMENT). This Webdynpro component (HAP_MAIN_DOCUMENT) uses 2 other components (HAP_DOCUMENT_BODY and HAP_DOCUMENT_HEADER).
For my client requirement, i need to create the custom components by copying from standard components as the UI layout changes are quiet huge and not manageable with the enhancements. To accomodate this i have changed the standard configurations by replacing the standard web dynpro components with the custom ones copied. Apart fomr this there are no changes to the standard.
While trying to access the application, i am getting the error as Null object reference. the details of the error is as below. Please advice.
Portal Error
Error when processing your request
What has happened?
The URL http://ddrsap12.dubal.domain:8001/sap/bc/webdynpro/sap/HAP_MAIN_DOCUMENT/ was not called due to an error.
Note
The following error text was processed in the system DSD : Access via 'NULL' object reference not possible.
The error occurred on the application server ddrsap12_DSD_01 and in the work process 0 .
The termination type was: RABAX_STATE
The ABAP call stack was:
Method: WDDOINIT of program /1BCWDY/LUR96POELQNL3TIUWPYS==CP
Method: IF_WDR_VIEW_DELEGATE~WD_DO_INIT of program /1BCWDY/LUR96POELQNL3TIUWPYS==CP
Method: DO_INIT of program CL_WDR_DELEGATING_VIEW========CP
Method: INIT_CONTROLLER of program CL_WDR_CONTROLLER=============CP
Method: INIT_CONTROLLER of program CL_WDR_VIEW===================CP
Method: INIT of program CL_WDR_CONTROLLER=============CP
Method: GET_VIEW of program CL_WDR_VIEW_MANAGER===========CP
Method: BIND_ROOT of program CL_WDR_VIEW_MANAGER===========CP
Method: INIT of program CL_WDR_VIEW_MANAGER===========CP
Method: INIT_CONTROLLER of program CL_WDR_INTERFACE_VIEW=========CP
ST22 Dump Analysis
Short text
    Access via 'NULL' object reference not possible.
What happened?
    Error in the ABAP Application Program
    The current ABAP program "/1BCWDY/LUR96POELQNL3TIUWPYS==CP" had to be
     terminated because it has
    come across a statement that unfortunately cannot be executed.
Information on where terminated
    Termination occurred in the ABAP program "/1BCWDY/LUR96POELQNL3TIUWPYS==CP" -
     in "WDDOINIT".
    The main program was "SAPMHTTP ".
    In the source code you have the termination point in line 4640
    of the (Include) program "/1BCWDY/B_LUXVEOR5WUW66V6QRRNU".
    Termination occurred in a Web Dynpro application
      Web Dynpro Component          ZWD_HAP_DOCUMENT_HEADER
      Web Dynpro Controller         VW_HEADER_MAIN
    The termination is caused because exception "CX_SY_REF_IS_INITIAL" occurred in
    procedure "WDDOINIT" "(METHOD)", but it was neither handled locally nor
     declared
    in the RAISING clause of its signature.
    The procedure is in program "/1BCWDY/LUR96POELQNL3TIUWPYS==CP "; its source
     code begins in line
    4619 of the (Include program "/1BCWDY/B_LUXVEOR5WUW66V6QRRNU ".
Active Calls/Events
No.   Ty.          Program                             Include                             Line
      Name
   33 METHOD       /1BCWDY/LUR96POELQNL3TIUWPYS==CP    /1BCWDY/B_LUXVEOR5WUW66V6QRRNU       4640
      CL_VW_HEADER_MAIN_CTR=>WDDOINIT
      Web Dynpro Component          ZWD_HAP_DOCUMENT_HEADER
      Web Dynpro Controller         VW_HEADER_MAIN
   32 METHOD       /1BCWDY/LUR96POELQNL3TIUWPYS==CP    /1BCWDY/B_LUXVEOR5WUW66V6QRRNU         70
      CLF_VW_HEADER_MAIN_CTR=>IF_WDR_VIEW_DELEGATE~WD_DO_INIT
      Web Dynpro Component          ZWD_HAP_DOCUMENT_HEADER
      Web Dynpro Controller         VW_HEADER_MAIN
   31 METHOD       CL_WDR_DELEGATING_VIEW========CP    CL_WDR_DELEGATING_VIEW========CM003     3
      CL_WDR_DELEGATING_VIEW=>DO_INIT
   30 METHOD       CL_WDR_CONTROLLER=============CP    CL_WDR_CONTROLLER=============CM00Q     3
      CL_WDR_CONTROLLER=>INIT_CONTROLLER
   29 METHOD       CL_WDR_VIEW===================CP    CL_WDR_VIEW===================CM00K     5
      CL_WDR_VIEW=>INIT_CONTROLLER
   28 METHOD       CL_WDR_CONTROLLER=============CP    CL_WDR_CONTROLLER=============CM002     7
      CL_WDR_CONTROLLER=>INIT
   27 METHOD       CL_WDR_VIEW_MANAGER===========CP    CL_WDR_VIEW_MANAGER===========CM008    70
      CL_WDR_VIEW_MANAGER=>GET_VIEW
   26 METHOD       CL_WDR_VIEW_MANAGER===========CP    CL_WDR_VIEW_MANAGER===========CM005    23
      CL_WDR_VIEW_MANAGER=>BIND_ROOT
   25 METHOD       CL_WDR_VIEW_MANAGER===========CP    CL_WDR_VIEW_MANAGER===========CM00B    17
      CL_WDR_VIEW_MANAGER=>INIT
   24 METHOD       CL_WDR_INTERFACE_VIEW=========CP    CL_WDR_INTERFACE_VIEW=========CM004    11
      CL_WDR_INTERFACE_VIEW=>INIT_CONTROLLER
   23 METHOD       CL_WDR_CONTROLLER=============CP    CL_WDR_CONTROLLER=============CM002     7
      CL_WDR_CONTROLLER=>INIT
   22 METHOD       CL_WDR_VIEW_MANAGER===========CP    CL_WDR_VIEW_MANAGER===========CM008    70
      CL_WDR_VIEW_MANAGER=>GET_VIEW
Thanks in advance,
Regards,
Ravi.

Hi ,
How are you able to configure Custom Web dynpro application to Appraisal document instead of HAP_MAIN_DOCUMENT. could you please share the steps. We have created custom application a copy of HAP_MAIN_DOCUMENT and the other two webdynpro components are also copied.
We dont know how to link this to Appraisal template. BADI HRHAP00_BSP_TMPL is used to change application names for BSP application. How to change application name for Web dynpro ABAP. Please share the stpes which will help us
Thanks and Regards,
Kothand

Replacing Standard-Groups like SAP_J2EE_ADMIN with customized groups

Hello everybody!
I'd like to give a group of users access to our XI-Java-stack with permissions that are a bit more differenciated than the standard SAP-groups. For example, I want users to be able to view all messages, but not all of their payloads (we use different namespaces for different departments, so this might be an approach to differentiate).
I have a bit of experience with the UME of Enterprise Portal and I've been able to assign Permissions (i.e. Roles) to users using the groups based on mapped ABAP-Roles. In XI I couldn't find any possibility to do something like this up to now. In the XI-User-Administrator I can view Roles and Groups, but all I get is a note that they are write-protected and can't be edited. I also haven't found a possibility to assign UME-Actions to my ABAP-mapped groups.
Who can help me? Thanks in advance!

Looks like there is no possible solution for this. I asked the teacher at my ADM200 course about this and he also didn't know anything

Ovi mail web access interaction with Yahoo groups

Ovi mail is powered by Yahoo mail, and I have one Yahoo account solely for use with ovi mail. I have another Yahoo account for accessing (a lot of) Yahoo groups. I can't have a web interface up for both on the same computer at the same time because they interact and want to use the same account. If I start Yahoo groups first, then start Ovi mail and log in, the Yahoo Groups window changes to the Ovi mail Yahoo account. Nokia, ask Yahoo to fix this, please! Cheers and TIA!

Hi Alex,
Please check the AdminCount value in Attribute Editor tab for this ArchiveMail account. Confirm if it is set to 1 which indicates that this user is a protested account which is protected by AdminSDHolder.
If that it the case, please clear the value for this attribute and check whether the issue persist.
Regards,
Winnie Liang
TechNet Community Support

Access Control with Custom Groups

Similar Messages

Maybe you are looking for