Access denied: Security Store Credentials

I created a target application in secure store services to be used by BCS. I have two regular domain accounts
apptest1 and apptest2. They both have same permission levels for the site collection, site and lists. None of these accounts are included in the target application and all authorized users have permission to the external content
type. Apptest1 was able to open my custom form with dropdowns that populated from BCS. However,
apptest2 got the following error when the form is open:
Microsoft.SharePoint.WebPartPages.NeedSsoCredentialsException:
http://qasp-wfe01:80/_layouts/SecureStoreSetCredentials.aspx?TargetAppId=resourcelookup
I would appreciate if someone can tell me what other permission(s) apptest2 may miss. Many thanks.

Hi eg10013,
According to your error message, it says that the apptest2 do not have credential for the Secure Store Target Application.
Have you set the credential for apptest2 in the Secure Store Target Application?
If not, please  go to Central Administration ->Application Management -> Manage service applications-> Secure Store Service, select your target application and click Set Credentials in the ribbon.Then set credentials for the apptest2.
Here is a good blog  you can refer to:
How To: Create, Configure, Consume SharePoint 2010 Secure
Store in Business Connectivity Services
Best Regards,
Eric
Eric Tao
TechNet Community Support

Similar Messages

  • Access denied security policy file

    All i a simple client which is trying to talk to a remote EJB. When i try and startup the client i get the following error.
    java.security.AccessControlException: access denied (java.util.PropertyPermission java.security.policy write)
         at java.security.AccessControlContext.checkPermission(AccessControlContext.java:264)
         at java.security.AccessController.checkPermission(AccessController.java:427)
         at java.lang.SecurityManager.checkPermission(SecurityManager.java:532)
         at java.lang.System.setProperty(System.java:699)
         at com.db.abmonitor.client.Client.example(Client.java:51)And i am calling it like
    System.setProperty("java.security.policy", "client.policy");
           if (System.getSecurityManager() == null)
           System.setSecurityManager(new RMISecurityManager());  And i have defined a client.policy file in the src directory of the project under eclipse, with the following entries
    grant {
         permission java.security.AllPermission;
    };Anyone got any ideas ?

    Ah RMI headaches...
    here is what i blogged for my own self when i was starting with the RMI security stuff:
    Since i havent figured out how to do SecurityManager stuff properly, i can override 2 checkPermission methods in SecurityManager with empty method bodies, thats a quick and dirty fix.
    - Alternativly, you can set your policy file located in /lib/security/java.policy to: http://java.sun.com/docs/books/tutorial/rmi/example-1dot2/java.policy
    - or pass the property to the policy location: -Djava.security.policy=./policy.all
    maybe that will help...
    i think that maybe your policy file isnt being found where it should be

  • HELP - Cannot Restore Shadow Copies - Access Denied - Security Restrictions?

    Server 2008 environment. Attempting to restore from shadow copy. Attempts to do so while logged in as enterprise administrator returns error: 
    You do not have permission to access \\localhost\D$\@GMT-2014-01-31-18.01.17\Share\Retail\Volunteer Hours\2011. Contact your network administrator to request access.
    Attempt to change owner to current enterprise administrator returns:
    Unable to set new owner on 2011.
    The media is write protected.
    Any ideas how to get these files back from shadow copies? Can't tell who the original owner was as security tabs display owner as "Unable to display current owner." Need these files back and can't figure out how to set permissions to do so!
    Any ideas or help out there?
    Russ Foszcz
    Russ Foszcz

    Hi Russ Foszcz, 
    The files you attempted to restore from shadow copy are stored on a local disk or an external disk? If it is an external disk, please refer to the article below to troubleshoot "Media is Write Protected" error:
    You may see "Media is Write Protected" Error or VDS error 80070013 after bringing SAN disk online via Diskpart in Windows Server 2008
    http://support.microsoft.com/kb/971436
    If it is a local disk, please try the steps below:
    1 Open CMD
    2 Input diskpart and press Enter
    3 Select volume=E (Volume E: for example)
    4 Input attributes volume to check if the volume is specified read-only attribute
    5 If the volume is read-only, input attributes volume clear read-only to clears the read-only attribute
    For more detailed information, please refer to the article below:
    DiskPart Command-Line Options
    http://technet.microsoft.com/en-us/library/cc766465(v=ws.10).aspx
    After that, use Takeown command to assigne ownership to the enterprise administrator:
    Unable to display current owner - Windows Server 2008
    http://social.technet.microsoft.com/Forums/windowsserver/en-US/5ec6d169-d057-463a-a5c2-95a983ea8fcd/unable-to-display-current-owner-windows-server-2008?forum=winserverfiles
    Takeown
    http://technet.microsoft.com/en-us/library/cc753024.aspx
    Regards, 
    Mandy
    If you have any feedback on our support, please click
    here .
    We
    are trying to better understand customer views on social support experience, so your participation in this
    interview project would be greatly appreciated if you have time.
    Thanks for helping make community forums a great place.

  • Safari access denied authentication failed behind proxy

    Hi hello
    I have proxy in my company, and my safari don't work, firefox is ok, he ask me my username and password for the proxy
    And Safari don't work, he write me
    " Access denied ( authentification_failed )
    Your credentials could not be authenticated : "credentials are missing". You will not be permitted access until your credentials can be verified.
    This is typically caused by an incorrect username and/or password but could also be caused by network problems. "
    Wait your help
    Thanks

    Safari, Proxy Authentication, and...: Apple Support Communities
    Invalid Certificate on every secured...: Apple Support Communities

  • Bought a MacBook Pro for granddaughter for college and she cannot access the app store to purchase apps needed for class. Always gets security questions that she did not set up and therefore she is denied access. But it does show her redeemable balance.

    I bought a 13" MacBook Pro for our college bound granddaughter. She cannot access the app store as she
    gets security questions to answer that she never set up, and of course it won't let her purchase anything. She has
    a redeemable balance, but can't get past the security questions and can't seem to find another way to circumvent this.
    What can she do?

    If she has trouble with the first advisor, she can always ask to speak to a senior advisor. However, AppleCare isn't really needed in cases like this, as the iTunes Store is quite familiar with accounts of this nature, and it's more of their speciality. Your daughter may want to contact them next time, but it's only email support at the moment (soon to change).
    iTunes Store Support
    http://www.apple.com/emea/support/itunes/contact.html

  • Applet Error:java.security.AccessControlException: access denied

    Hi,
    I just successful deploy an business component project to oralce 8.1.6 as an EJB Session bean, and
    the test of application module is successful. In the same workspace, I create an new project with
    an applet(which contains only an grid control)as a client of the business component. Everything works
    fine within the Applet viewer, however, when I trying to load the applet in IE5.5 I got the following
    error message in java console:
    Java(TM) Plug-in
    Using JRE version 1.2.1
    User home directory = D:\Documents and Settings\ERic
    Proxy Configuration: no proxy
    JAR cache enabled.
    Failed to query environment: 'access denied (java.util.PropertyPermission jbo.debugoutput read)'
    Diagnostics: Silencing all diagnostic output (use -Djbo.debugoutput=console to see it)
    Failed to query environment: 'access denied (java.util.PropertyPermission jbo.logging.show.timing read)'
    Failed to query environment: 'access denied (java.util.PropertyPermission jbo.logging.show.function read)'
    Failed to query environment: 'access denied (java.util.PropertyPermission jbo.logging.show.level read)'
    Failed to query environment: 'access denied (java.util.PropertyPermission jbo.logging.show.linecount read)'
    Failed to query environment: 'access denied (java.util.PropertyPermission jbo.logging.trace.threshold read)'
    Failed to query environment: 'access denied (java.util.PropertyPermission jbo.jdbc.driver.verbose read)'
    java.lang.ExceptionInInitializerError: java.security.AccessControlException: access denied (java.util.PropertyPermission org.omg.CORBA.ORBClass read)
    at java.security.AccessControlContext.checkPermission(Compiled Code)
    at oracle.aurora.jndi.orb_dep.Orb.<clinit>(Orb.java:24)
    at oracle.aurora.jndi.sess_iiop.sess_iiopURLContext.<clinit>(sess_iiopURLContext.java:9)
    at javax.naming.spi.NamingManager.getURLObject(NamingManager.java:588)
    at javax.naming.spi.NamingManager.getURLContext(NamingManager.java:537)
    at javax.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.java:274)
    at javax.naming.InitialContext.lookup(InitialContext.java:349)
    at oracle.jbo.client.remote.ejb.aurora.AuroraEJBAmHomeImpl.connectToService(AuroraEJBAmHomeImpl.java:179)
    at oracle.jbo.client.remote.ejb.aurora.AuroraEJBAmHomeImpl.createSession(AuroraEJBAmHomeImpl.java:152)
    at oracle.jbo.client.remote.ejb.aurora.AuroraEJBAmHomeImpl.initRemoteHome(AuroraEJBAmHomeImpl.java:123)
    at oracle.jbo.client.remote.ejb.aurora.AuroraEJBAmHomeImpl.<init>(AuroraEJBAmHomeImpl.java:59)
    at oracle.jbo.client.remote.ejb.aurora.AuroraEJBInitialContext.createJboHome(AuroraEJBInitialContext.java:47)
    at oracle.jbo.common.JboInitialContext.lookup(JboInitialContext.java:72)
    at javax.naming.InitialContext.lookup(InitialContext.java:349)
    at oracle.dacf.dataset.SessionInfo._createAppModule(SessionInfo.java:2330)
    at oracle.dacf.dataset.SessionInfo.connect(SessionInfo.java:1799)
    at oracle.dacf.dataset.SessionInfo.openProducerObject(SessionInfo.java:1848)
    at oracle.dacf.dataset.ProducerObject.open(ProducerObject.java:94)
    at oracle.dacf.dataset.SessionInfo.publishSession(SessionInfo.java:1305)
    at oracle.dacf.dataset.SessionInfo.publishSession(SessionInfo.java:1287)
    at broadcastapplet.myBroadCastApplet.init(myBroadCastApplet.java:70)
    at sun.applet.AppletPanel.run(Compiled Code)
    at java.lang.Thread.run(Thread.java:479)
    The Oracle 8.1.6 runs on Win2000, I put the JAR & related zip files in the same machine's IIS webserver.
    Is anyone can help?
    ERic

    Hi Shaji,
    Are you calling a webservice from within an Xacute Query for your applet?  On first glance, it looks like a web service call is being rejected due to security permissions.  If you have a webservice call (or HTTP post/get), can you test it separately with the same credentials as the webpage is using?
    Regards,
    Mike

  • EWS API - Impersonating to update a calendar item created by any other user than a service account, raise an error "Access is denied. Check credentials and try again."

    Hi,
    I am new to using EWS managed APIs.
    Following is the issue:
    1. I am using a service account e.g. [email protected]. This user is a global administrator and also has ApplicationImpersonation role assigned. (Sign into Online Office 365 account -> Admin -> select "Exchange" tab- > select Permissions
    on the left panel -> create an impersonation role -> assign ApplicationImpersonation in Roles: and [email protected] in Members: -> Click on save)
    2. Create a calendar item by other user for e.g. [email protected], and invite an attendee - [email protected].
    3. In a c# program, I connect to EWS service using a service account - [email protected], fetch its calendar events. If organizer of an event is some other user - [email protected] then
    I use impersonation in the following way to update the calendar event/item properties- subject, body text etc.
            private static void Impersonate(string organizer)
                string impersonatedUserSMTPAddress = organizer;
                ImpersonatedUserId impersonatedUserId =
                    new ImpersonatedUserId(ConnectingIdType.SmtpAddress, impersonatedUserSMTPAddress);
                service.ImpersonatedUserId = impersonatedUserId;
    4. It was working fine till yesterday afternoon. Suddenly, it started throwing an exception "Access is denied. Check credentials and try again." Whenever I try to
    update that event.
           private static void FindAndUpdate(ExchangeService service)
                CalendarView cv = new CalendarView(DateTime.Now, DateTime.Now.AddDays(30));
                cv.MaxItemsReturned = 25;
                try
                    FindItemsResults<Item> masterResults = service.FindItems(WellKnownFolderName.Calendar, cv);
                    foreach (Appointment item in masterResults.Items)
                        if (item is Appointment)
                            Appointment masterItem = item as Appointment;
                            if (!masterRecurEventIDs.Contains(masterItem.ICalUid.ToString()))
                                masterItem.Load();
                                if (!masterItem.Subject.Contains(" (Updated content)"))
                                    //impersonate organizer to update and save for further use
                                    Impersonate(masterItem.Organizer.Address.ToString());
                                    // Update the subject and body
                                    masterItem.Subject = masterItem.Subject + " (Updated content)";
                                    string currentBodyType = masterItem.Body.BodyType.ToString();
                                    masterItem.Body = masterItem.Body.Text + "\nUpdated Body Info:
    xxxxxxxxxxxx";
                                    // This results in an UpdateItem operation call to EWS.
                                    masterItem.Update(ConflictResolutionMode.AutoResolve);
                                    // Send updated notification to organizer of an appointment
                                    CreateAndSendEmail(masterItem.Organizer.Address.ToString(), masterItem.Subject);
                                    masterRecurEventIDs.Add(masterItem.ICalUid.ToString());
                                else
                                    Console.WriteLine("Event is already updated. No need to update again.:\r\n");
                                    Console.WriteLine("Subject: " + masterItem.Subject);
                                    Console.WriteLine("Description: " + masterItem.Body.Text);
                catch (Exception ex)
                    Console.WriteLine("Error: " + ex.Message);
    5. What could be an issue here? Initially I thought may be its a throttling policy which is stopping same user after making certain API call limits for the day, but I am still seeing this issue today.
    Any help is appreciated.
    Thanks

    Your logic doesn't sound correct here eg
    2. Create a calendar item by other user for e.g. [email protected], and invite an attendee - [email protected]
    3. In a c# program, I connect to EWS service using a service account - [email protected], fetch its calendar events. If organizer of an event is some other user - [email protected] then
    I use impersonation in the following way to update the calendar event/item properties- subject, body text etc.
    When your connecting to [email protected] mailbox the only user that can make changes to items within
    abccalendar is abc (or ABC's delegates). If your impersonating the Organizer of the appointment pqr that wouldn't work unless the organizer had rights to abc's calendar. If you want to make updates to a calendar
    appointment like that you should connect to the Organizers mailbox first update the original, send updates and then accept the updates.
    When you impersonate your impersonating the security context of the Mailbox your impersonating so its the same a logging on as that user in OWA or Outlook.
    Cheers
    Glen

  • Shared folders (Windows file shares) show access denied and do not prompt for credentials

    Scenario:
    Like other admins, I log on and work as a 'standard user' (usera) with no admin rights anywhere in the domain, to perform admin tasks I have another account (userb) which I authenticate with as and when required. userb has been allocated/delegated permissions
    as required.
    Problem: 
    When trying to connect to shared folders on servers (2008 R2) using a UNC patch via Windows Explorer (Win 7 Ent.), I see an access denied error and do not get an option to supply alternative credentials.
    If I try to connect to the admin shares on the same server (\\server\C$ or \\server\e$) I get an access denied message AND get prompted for credentials. I supply my admin account and gain access as expected.
    If I check share and storage management when attempting to connect, I see that Windows is trying to connect me to each share as usera (which has no access). I understand why I get access denied at this point, but not why it can't just prompt me to supply an
    account that does have access. When trying the admin shares I also see the usera account, but I get a prompt to supply a user who does have access.
    Share permissions on the folders are for example 'Everyone' Full Control.  NTFS permissions are 'userb' has modify (read, execute, list, traverse etc) via a 'Server Admins' AD Universal security group.
    Note: If I do a NET USE from CMD and use the /USER switch, I can access the shares fine. But this is not great for accessing shared folders on the fly from various computers.
    How can I get the other shares on the server to prompt me, rather than just say access denied?
    Many thanks.

    Try to disable guest user from the server
    If you found this post helpful, please give it a "Helpful" vote. If it answered your question, remember to mark it as an "Answer". This posting is provided "AS IS" with no warranties and confers no rights! Always test ANY
    suggestion in a test environment before implementing!

  • Access denied to a security provider on a signed applet

    Hi,
    I'm having permissions problems to work with a security provider.
    The security provider is already installed at java.security. In fact, at Netbeans when debbuging the app it's working perfectly.
    If I'm working the provider in an signed applet, then there are errors.
    Even, I have created a .jar file and I have saved in the /ext directory, wich by default in the java.policy file has got all security permissions.
    grant codeBase "file:${{java.ext.dirs}}/*" {
    permission java.security.AllPermission;
    Even with these granted permissions, I'm getting problems to work with the security provider that I have installed. Also, with these permissions I should be able to install the security provider.
    log:
    <record>
    <date>2012-03-13T12:13:39</date>
    <millis>1331637219126</millis>
    <sequence>17</sequence>
    <logger>appletpdf.appletPdf</logger>
    <level>SEVERE</level>
    <class>appletpdf.appletPdf</class>
    <method>applTest</method>
    <thread>11</thread>
    <message>excepcion: {0} </message>
    <exception>
    <message>java.security.AccessControlException: access denied (java.security.SecurityPermission authProvider.SunPKCS11-Provider-name)</message>
    <frame>
    <class>java.security.AccessControlContext</class>
    <method>checkPermission</method>
    <line>393</line>
    </frame>
    <frame>
    <class>java.security.AccessController</class>
    <method>checkPermission</method>
    <line>553</line>
    </frame>
    <frame>
    <class>java.lang.SecurityManager</class>
    <method>checkPermission</method>
    <line>549</line>
    </frame>
    <frame>
    <class>net.sourceforge.jnlp.runtime.JNLPSecurityManager</class>
    <method>checkPermission</method>
    <line>250</line>
    </frame>
    <frame>
    <class>sun.security.pkcs11.SunPKCS11</class>
    <method>login</method>
    <line>1036</line>
    </frame>
    <frame>
    <class>sun.security.pkcs11.P11KeyStore</class>
    <method>login</method>
    <line>874</line>
    </frame>
    <frame>
    <class>sun.security.pkcs11.P11KeyStore</class>
    <method>engineLoad</method>
    <line>764</line>
    </frame>
    <frame>
    <class>java.security.KeyStore</class>
    <method>load</method>
    <line>1201</line>
    </frame>
    <frame>
    <class>apppdf.appPdf</class>
    <method>tPKCS11</method>
    <line>174</line>
    </frame>
    <frame>
    <class>appletpdf.appletPdf</class>
    <method>applTest</method>
    <line>137</line>
    </frame>
    <frame>
    <class>appletpdf.appletPdf</class>
    <method>initapplDPdf</method>
    <line>116</line>
    </frame>
    <frame>
    <class>sun.reflect.NativeMethodAccessorImpl</class>
    <method>invoke0</method>
    </frame>
    <frame>
    <class>sun.reflect.NativeMethodAccessorImpl</class>
    <method>invoke</method>
    <line>57</line>
    </frame>
    <frame>
    <class>sun.reflect.DelegatingMethodAccessorImpl</class>
    <method>invoke</method>
    <line>43</line>
    </frame>
    <frame>
    <class>java.lang.reflect.Method</class>
    <method>invoke</method>
    <line>616</line>
    </frame>
    <frame>
    <class>sun.applet.PluginAppletSecurityContext$4</class>
    <method>run</method>
    <line>699</line>
    </frame>
    <frame>
    <class>java.security.AccessController</class>
    <method>doPrivileged</method>
    </frame>
    <frame>
    <class>sun.applet.PluginAppletSecurityContext</class>
    <method>handleMessage</method>
    <line>696</line>
    </frame>
    <frame>
    <class>sun.applet.AppletSecurityContextManager</class>
    <method>handleMessage</method>
    <line>69</line>
    </frame>
    <frame>
    <class>sun.applet.PluginStreamHandler</class>
    <method>handleMessage</method>
    <line>273</line>
    </frame>
    <frame>
    <class>sun.applet.PluginMessageHandlerWorker</class>
    <method>run</method>
    <line>82</line>
    </frame>
    </exception>
    </record>
    Fails in the line where the KeyStore is loading:(Pin is correct)
    KeyStore myKeyStore=null;
    Provider p = Security.getProvider("SunPKCS11-Provider-Name");
    myKeyStore = KeyStore.getInstance("PKCS11",p);
    char[] pinData = pin.toCharArray();
    myKeyStore.load(null, pinData);
    Any help would be apreciated.
    Thank you.
    Bye

    Thank you for your information, Frank, as it clarifies part of my confusion. However, there are a couple more loose ends I'd love to address before I mark your responses as answers.
    Do backup and restore privileges apply at all over a network mount created via "net use"?
    The network mount requires a username and password for the destination machine. Assuming the destination machine is a Windows box with a simple CIFS share, how does this user affect our permissions and access? Do we end up effectively impersonating this
    user, or is the access check still done with our sync process's run-as user?
    We require that both our configured run-as user for our sync process *and* the credentials passed to the network mount be administrator users of the local system and destination system, respectively, meaning they're in of the "BUILTIN\Administrators,
    S-1-5-32-544" group.
    On re-syncs, the destination file will exist and since we don't have the ability to read the ACL in all cases (we're running as one user, the file is owned by another user, and we aren't specified in the ACL in any way), we aren't able to determine if the
    file has changed. Is it possible to determine the owner of this file in this case? Preferably, we'd obtain the entire SDDL.
    My proposed plan is to interpret access denied as a difference requiring re-sync, resulting in us taking ownership of the file, granting ourselves access, determining if there are data differences, and then re-syncing the metadata as appropriate.

  • Access denied to a folder; running as Administrator with backup, restore, takeown, and security privileges

    I am running as an Administrator with SE_BACKUP_NAME, SE_RESTORE_NAME, SE_TAKE_OWNERSHIP_NAME, and SE_SECURITY_NAME enabled on my application. My group information is listed below. The item's path and ACL are
    C:\tests\test_acl_null\src\1d: O:BGG:SYD:P
    where the owner is Built-in Guests, group is Local System, the DACL prevents inheritance, and the DACL itself is empty.
    I would expect that since I have the four above privileges enabled successfully, I would have access to the item regardless of its security descriptor. Why is this not the case?
    whoami /all
    USER INFORMATION
    User Name SID
    ==================== =============================================
    winbuild\engineering S-1-5-21-<machine-id>-1001
    GROUP INFORMATION
    Group Name Type SID Attributes
    ===================================== ================ ============ ===============================================================
    Everyone Well-known group S-1-1-0 Mandatory group, Enabled by default, Enabled group
    BUILTIN\Administrators Alias S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner
    BUILTIN\Remote Desktop Users Alias S-1-5-32-555 Mandatory group, Enabled by default, Enabled group
    BUILTIN\Users Alias S-1-5-32-545 Mandatory group, Enabled by default, Enabled group
    NT AUTHORITY\REMOTE INTERACTIVE LOGON Well-known group S-1-5-14 Mandatory group, Enabled by default, Enabled group
    NT AUTHORITY\INTERACTIVE Well-known group S-1-5-4 Mandatory group, Enabled by default, Enabled group
    NT AUTHORITY\Authenticated Users Well-known group S-1-5-11 Mandatory group, Enabled by default, Enabled group
    NT AUTHORITY\This Organization Well-known group S-1-5-15 Mandatory group, Enabled by default, Enabled group
    LOCAL Well-known group S-1-2-0 Mandatory group, Enabled by default, Enabled group
    NT AUTHORITY\NTLM Authentication Well-known group S-1-5-64-10 Mandatory group, Enabled by default, Enabled group
    Mandatory Label\High Mandatory Level Label S-1-16-12288 Mandatory group, Enabled by default, Enabled group

    Thank you for your information, Frank, as it clarifies part of my confusion. However, there are a couple more loose ends I'd love to address before I mark your responses as answers.
    Do backup and restore privileges apply at all over a network mount created via "net use"?
    The network mount requires a username and password for the destination machine. Assuming the destination machine is a Windows box with a simple CIFS share, how does this user affect our permissions and access? Do we end up effectively impersonating this
    user, or is the access check still done with our sync process's run-as user?
    We require that both our configured run-as user for our sync process *and* the credentials passed to the network mount be administrator users of the local system and destination system, respectively, meaning they're in of the "BUILTIN\Administrators,
    S-1-5-32-544" group.
    On re-syncs, the destination file will exist and since we don't have the ability to read the ACL in all cases (we're running as one user, the file is owned by another user, and we aren't specified in the ACL in any way), we aren't able to determine if the
    file has changed. Is it possible to determine the owner of this file in this case? Preferably, we'd obtain the entire SDDL.
    My proposed plan is to interpret access denied as a difference requiring re-sync, resulting in us taking ownership of the file, granting ourselves access, determining if there are data differences, and then re-syncing the metadata as appropriate.

  • Using SQL Server credentials with Secure Store Target Application for Data Connection in Dashboard Designer

    [Using SharePoint 2013 Enterprise SP1]
    I would like to use SQL Server credentials in a Secure Store Target Application, and
    this page makes it look like it's possible but when I attempt to use the new Target Application ID as authentication for a Data Connection in Dashboard Designer, I get a generic "Unable to access data source" with no error logged in SQL Server
    logs.
    I am able to use a Target Application with AD credentials to access the SQL db without a problem. Suggestions?

    Hi,
    1. Make sure that the credential is set to
    Secure Store Target Application. Navigate to the Central Administration. Click on the
    Application Management. Click on the Manage Service Applications. Click on the
    Secure Store Service Application. Select the application ID and from the ECB menu click on the
    Set Credentials. Enter the Credential Owner, Windows User Name and the
    Windows Password.
    2. Make sure that in the Dashboard Designer “Use a stored account” is selected in the “Authentication” and the proper application ID is mentioned.
    Please refer to the link below for more information:
    http://www.c-sharpcorner.com/Blogs/14527/unable-to-access-data-source-the-secure-store-target-applic.aspx
    Regards,
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
    [email protected] .
    Rebecca Tu
    TechNet Community Support

  • Fusion Apps web service call fails with error access denied (oracle.wsm.security.WSFunctionPermission)

    Hello Guru,
    I am trying to call a supplier service from SOA/OSB.
    But while calling the service it is failing with the below error message
    access denied (oracle.wsm.security.WSFunctionPermission http://xmlns.oracle.com/apps/prc/poz/suppliers/supplierService/SupplierService#getSupplierVO invoke)
    As per OER cookbook i have attached the "oracle/wss_username_token_client_policy" to the Fusion  apps web service.
    I am trying to pass security credentials to the service by using all the methods... through composite ..through bpel through wsse header but in all cases i am getting similar error.
    Please let me know if some one has called the fusion apps web service to create a supplier of solution to my problem  as mentioned above.

    Hi Sai,
        Thanks for the quick and correct response. Yes, after doing the research, I'm also came to same conclusion. But what stops me here is that where exactly I need to check for this permission.
    I mean the theory what I built on this Authorization/Permission is that:
       For the resource - WebService (SupplierService), there is an assigned application role for which the Entitlement/Permission is provided.
    Pls. help me in the below items:
    a. What is the application role(in role hierarchy) assigned to this resource(Webservice). Which page I need to check(navigation) this and the required credentials..
    b. What is the Entitlement provided for this application role for this operation (getSupplierVO) invoke.. Which page I need to check(navigation) this and the required credentials..
    Thanks in Advance.
    Thanks & Regards
    Madhu

  • FusionApps web service call fails with error access denied (oracle.wsm.security.WSFunctionPermission)

    Hi Gurus,
    I started test this webservice from EM (Test Web Service)
    But while calling the service it is failing with the below error message
    access denied (oracle.wsm.security.WSFunctionPermission http://xmlns.oracle.com/apps/prc/poz/suppliers/supplierService/SupplierService#getSupplierVO invoke)
    As per OER cookbook i have attached the "oracle/wss_username_token_client_policy" to the Fusion  apps web service.
    I am trying to pass security credentials to the service by using all the methods... through composite ..through bpel through wsse header but in all cases i am getting similar error.
    Please let me know if some one has called the fusion apps web service to create a supplier of solution to my problem  as mentioned above.
    Is it any policy error or the authorization error ...
    Are there any navigation steps I can check the existed permission on this resource etc..,
    Thanks in Advance

    Hi Sai,
        Thanks for the quick and correct response. Yes, after doing the research, I'm also came to same conclusion. But what stops me here is that where exactly I need to check for this permission.
    I mean the theory what I built on this Authorization/Permission is that:
       For the resource - WebService (SupplierService), there is an assigned application role for which the Entitlement/Permission is provided.
    Pls. help me in the below items:
    a. What is the application role(in role hierarchy) assigned to this resource(Webservice). Which page I need to check(navigation) this and the required credentials..
    b. What is the Entitlement provided for this application role for this operation (getSupplierVO) invoke.. Which page I need to check(navigation) this and the required credentials..
    Thanks in Advance.
    Thanks & Regards
    Madhu

  • [SOLVED] Access denied by Application security check (3.0.1 on Oracle XE)

    Cannot log in as admin. http://localhost:8080/apex/apex_admin
    After entering user admin and password I receive a page that says:
    Access denied by Application security check
    Application access restricted to internal workspace users.
    Return to application.
    I can run Apex interface just fine, this only happens for the apex_admin login screen.
    Help??!!??
    ===========
    Resolution
    ===========
    Logged on to INTERNAL workspace with admin username.
    Message was edited by:
    edkocol

    Hello Spadafore,
    Thank you, for your quick answer. I found another way, and it is solved.
    =========
    SOLUTION:
    =========
    Login as sys with sqlpus (sqlplus sys as sysdba )on the database and run this script:
    update flows_030000.wwv_flow_fnd_user
    set change_password_on_first_use ='N'
    where lower(user_name) = 'admin'
    commit
    However it's worked, but the whole story strange a little bit...
    I tried to logon (internal, admin, xxx), then I got this: Access denied by Application security check
    When I tried logon with wrong password I got this: Invalid Login Credentials
    Afterwards I run the script above, and try relogon, I got the password change page, but at this time it worked, and it is working now....
    Tiboir

  • Access denied by Application security check (4.0.2)

    Does any body know how to solve that problem: [SOLVED] Access denied by Application security check (3.0.1 on Oracle XE) on 4.0.2.
    Solution: Logged on to INTERNAL workspace with admin username.
    Is not working anymore, it doesn't take the user name. Error msg:
    "2 errors have occurred
    * Your Username is not available. Please close your browser completely. After restarting your browser, your Username should be displayed correctly.
    * Invalid Password"
    Edited by: its_working on Jun 3, 2011 3:57 PM

    Hello Spadafore,
    Thank you, for your quick answer. I found another way, and it is solved.
    =========
    SOLUTION:
    =========
    Login as sys with sqlpus (sqlplus sys as sysdba )on the database and run this script:
    update flows_030000.wwv_flow_fnd_user
    set change_password_on_first_use ='N'
    where lower(user_name) = 'admin'
    commit
    However it's worked, but the whole story strange a little bit...
    I tried to logon (internal, admin, xxx), then I got this: Access denied by Application security check
    When I tried logon with wrong password I got this: Invalid Login Credentials
    Afterwards I run the script above, and try relogon, I got the password change page, but at this time it worked, and it is working now....
    Tiboir

Maybe you are looking for