Access level to users at specific fields

Dear Techies,
I am new guy In BO and also to this forum icon_smile.gif
I am designing my universe and now i little concern
I want to design one universe for 5 departments in company
and then i want to give specific rights for users for specific fields in the universe level
any best way / solution there...
any suggestion / help / link / tutorial would be highly appreciated
regards
Nadir Firfire

Hi,
You can deifne metadata restrictions for group of users in the universe.
In Universe Designer, select the "Tool" menu then the menu option "Manage Security" and finally menu option "Manage access restrictions".
Then click on "New" button to create an access restriction and select the "Object" tab.
Last you have to associate the restrictions to users or group of users.
Didier

Similar Messages

Multiple Access Levels per User

In a site I'm building, I need the ability to allow an administrator to intuitively assign different access levels to different users. There may ultimately be roughly 25 different pages to which a user may be granted access. One user may have access to section/page levels 1, 4, 5, 7 and 21. Another user may get access to 2, 3, 4, 17, 19 and 24, etc. While this is possible under the existing ADDT user login system by creating a separate access value that includes only the permissible pages (access level 1 could get to page 1, 4, 5, 7 and 21; access level 2 could only get to pages 2, 3, 4, 17, 19 and 24) it becomes impractical for the administrator since the developer (me) would have to come up with an access value and corresponding permissible pages for every possible combination. Every time a new combination was needed, my client would have to contact me to add that access integer and modify all the corresponding sections/pages that the user could access.
The ideal solution IMHO in this scenario would be for the administrator to simply be able to select or deselect a checkbox at will for each page to which the user is granted access (this is actually the scenario to which another of my feature request post refers:
http://www.adobeforums.com/webx/.59b75119
In searching the old InterAKT forums, I came across a post in which this exact scenario was requested. The user and Ionut came up with a solution which I was able to modify to enable the system I describe above. Rather than repeating the solution, here is a link to that post:
http://www.interaktonline.com/Products/Dreamweaver-Extensions/MXUserLogin/Product-Forum/De tails/110205/Access+level+based+on+pages.html
While it appears this solution will work for me, it took me quite a while to find it, and even longer to understand it.
So, that's my feature request: The ability for an administrator to easily assign any combination of pages to which a user is granted access, preferably with a set of checkboxes.
Thanks!

This is functioning now. With 9.0 you simply use a forward slash between device IDs.
[device ID #1]/[device ID #2]
Put this information in the "Mobile Device ID" field on the user form.
It also has been verified with 8.82 PL15-16, but I don't know how far back it goes.

Restrict access of "domain user" to specific computer

I need to restrict access of "domain user" to a specific computer in the domain/
I try to Do it by using "Active Directory Administrative Center"
In Computers\Computer name\Properties\Extensions\Security
I add the name of user and I marked deny to all and I canceled inheritance
And yet the user can login to the computer
I searched Policy that contradicts the security and I not found.
With the "gpo" I was able to block, but I need necessarily used the Security
Because of Security can be partial restriction.

Hi,
Based on your description, I understand that you want to allow some certain users to access specific domain
computers.
Please open ADUC (Activity Directory Users and Computers) and click User container. Then select that specific
user account, open its Properties and navigate to Account tab. Please click
“Log On To…” option to open Logon Workstations panel. In Logon Workstations panel, please change
This user can log on to: All computers to The following computers. Then type the specific computer names. Please check if this can help you to achieve target.
If anything I misunderstand or any update, please don’t hesitate to let me know.
Hope this helps.
Best regards,
Justin Gu

QaaWS Access Level

All,
I am setting up access level for users in the production environment for QaaWS tool. All users can view QaaWS in production, but they CAN'T create/modify/delete QaaWS in production. What access level do I need to enable this?
I tried to use the "View" access level out-of-the box, but I got this "You are not authorized to design or edit a query. Please contact your administrator (QWS 02718)." If I use "Full Control" access level, the user can login fine, but the issue is that user can create/modify/delete QaaWS in production. I am puzzled as to what access level can give me the view ability...
Please advise...
thanks...

qaaws is a query tool designed for editing wsdl's. If you grant view that is most likley for infoview not for opening with the client. So I believe this is by design. If you do not get anyone to verify this then I'd suggest opening a case with support admin team so they can test it and verify that for you.
Regards,
Tim

Allow users to select Fields that the resulting report would be sorted on

Is it possible to make available to the users some specific fields from the database that they would be allowed to select themselves which fields they would like the resulting report sorted upon?

The suggestion that was provided seems to have worked. But right now I have a situation where I would like to give the users the option to select the desired sort order from 6 different fields.
Invoice Date
Due Date
TransDate
PO Num
Invoice No
Status.
Right now I have a Sort Parameter created
Then I also have a Sort Formula generated as follows.
If {?SortField} = "DueDate" Then {APMASTER.DUE_DATE}
Else
     If {?SortField} = "TransDate" Then {APMASTER.TRANS_DT}
     Else
          if{?SortField} = "InvDate" Then {APMASTER.INVDATE}
as soon as I attempt to add another line to this formular that would be for the Invoice No as shown below.
Else
             if{?SortField} = "InvNo" Then {APMASTER.INVNO}
I keep receiving a "A date-Time is required here" I am assuming it must be because CR is not allowing me to create a formula and/or parameter that is using a mixture of Date and Text fields.
If you have any suggestion for a work around, it would be appreciated.

The best way to implement user's access level via Servlet & JSP (or more)?

Hi all,
I am trying to implement user's access level in an application to allow certain access to certain page or components within a page (buttons, etc.). From my experience with JSP, Java, servlet, I am think of having the jsp/servlet to check for user's access level to decide what jsp components or forward page to go to next but that doesn't seem clean or elegant way to handle it.
Any suggestions of how to do this? Are there other technologies (Struts) out there that can handle this?
Thanks so much in advance for your feedback or suggestion,
Thong Bui

I haven't experienced a lot in defining security roles before, and there is probably a lot to learn about this area. However I might be able to assist you in some way. Whenever I have 2 or more objects that need to be stored in the session, I create a class called UserContainer. Say you have three properties:
empSsn (String) , isAdmin (Boolean), isAgent (Boolean), then:
public class UserContainer implements Serializable {
private String empSsn = null;
private Boolean isAdmin = null;
private Boolean isAgent = null;
public UserContainer() {
super();
public void setIsAdmin(Boolean isAdmin) {
this.isAdmin = isAdmin;
public Boolean getIsAdmin() {
return this.isAdmin;
// getters and setters for the other properties
Of course after you decide (in your sevlet) whether the app user is an administrator or an agent, you can set the corresponding property in the user container, and then save it in the session. Afterwords, in any jsp, you can decide to display a certain element (e.g a button) after you check the user's role. Example:
// Welcome.jsp
<% UserContainer userContainer = (UserContainer) session.getAttribute("userContainer");
boolean isAdmin = userContainer.getIsAdmin().booleanValue();
boolean isAgent = userContainer.getIsAgent.booleanValue();
if(isAdmin) { %>

<% } if(isAgent) { %>

<% } >Of course, this is a very simple way of doing such a task, you will find more secure ways if you look at LDAP or something of that matter.
Cheers

Is there an "Access Level" field on the "Send for Shared Review" screen (Pro X)?

I'm using Pro X, but haven't come across the "Access Level" field expalined in this on-line video http://tv.adobe.com/watch/learn-acrobat-x/getting-started-the-basics-of-reviewing/
Is this something you can enable?

It's only available if you select Acrobat.com as the review server.

How to find user exits for a specific field

hi,
    How can we find a user exit for a specific fields .
as i know Three ways to search user-exits
1. SE80 look includes in a packages with name user-exits
2. by zreport which will fetch user-exit in a T-CODE
3. SMOD
but what if we have to find a user-exit for particular field for e.g bupla(bussiness place) in MIRO.
Please suggest me.
Thanks and Regards ,
Rahul Singh.

Hi Rahul,
Here is the procedure to create field exits.
Step by step procedure for creating Field Exits
There are eight steps to creating a field exit:
Step 1: Determine Data Element
Step 2: Go To Field Exit Transaction
Step 3: Create Field Exit
Step 4: Create Function Module
Step 5: Code Function Module
Step 6: Activate Function Module
Step 7: Assign Program/Screen
Step 8: Activate Field Exit
Step 1: Determine Data Element
u2022     Before you can begin adding the functionality for a field exit, you must know the corresponding data element.
Step 2: Go To Field Exit Transaction
u2022     The transaction to create field exits is CMOD.
u2022     You can use the menu path Tools -> ABAP/4 Workbench -> Utilities -> Enhancements -> Project management.
u2022     From the initial screen of transaction CMOD, choose the Text enhancements -> Field exits menu path.
u2022     After choosing this menu path, you will be taken to the field exits screen. From here, you can create a field exit.
NOTE : Even though you use transaction CMOD to maintain field exits, you do not need to create a project to activate field exits.
Step 3: Create Field Exit
u2022     From the field exit screen of transaction CMOD, choose the Field exit -> Create menu path.
u2022     After choosing this menu path, a dialog box will prompt you for the appropriate data element .
u2022     Enter the data element name and click the u2018Continueu2019 pushbutton.
u2022     Now, you will be able to create the function module associated to the data elementu2019s field exit.
Step 4: Create Function Module
u2022     You will automatically be taken to the Function Library (SE37) after entering a data element name and clicking the u2018Continueu2019 pushbutton.
u2022     In the u2018Function moduleu2019 field, a function module name will be defaulted by the system based on the data element specified. This name will have the following convention:
FIELD_EXIT_<data element>
u2022     You can add an identifier (an underscore followed by a single character ).
u2022     The first function module for a data elementu2019s field exit must be created without an identifier.
u2022     To create the function module, click on the u2018Createu2019 pushbutton, choose menu path Function module -> Create, or press u2018F5u2019.
u2022     After choosing to create the function module, you will get the warning: "Function module name is reserved for SAP". This message is just a warning so a developer does not accidentally create a function module in the field exit name range. By pressing u2018Enteru2019, you will be able to go ahead and create the function module.
u2022     Before coding the function module, you will have to specify the function modules attributes -- function group, application, and short text.
Step 5: Code Function Module
u2022     From the function moduleu2019s attributes screen, click on the u2018Source codeu2019 pushbutton or choose the Goto -> Function module menu path to the code of the function module.
u2022     Here you will add your desired functionality for the field exit.
u2022     Remember that field exitu2019s function module will have two parameters -- one importing parameter called "INPUT" and one exporting parameter called "OUTPUT". These parameters will be set up automatically by the system.
u2022     You must remember to assign a value to the OUTPUT field. Even if the value does not change, it must be moved from the INPUT field to the OUTPUT field.
Step 6: Activate Function Module
u2022     After coding the function module, you must remember to activate it.
u2022     Use the Function module -> Activate menu path to activate the function module.
u2022     At this point, you can return to the field exit transaction.
u2022     You should be able to 'green arrow' back to this transaction.
u2022     When you return to the field exit transaction, you will see an entry for the newly created field exit.
u2022     At this point, the field exit is global. That is, it applies to all screens that use a particular data element. On any screen that uses the data element, the corresponding field exit function module will be triggered, once it is active.
u2022     Also, the field exit will not be triggered yet because it is inactive.
Step 7: Assign Program/Screen
u2022     This step is only needed if you want to make a field exit local.
u2022     To make a field exit local, select the field exit and click on the u2018Assign prog./screenu2019 pushbutton.
u2022     In the dialog box , indicate the appropriate program name and screen number.
This information indicates that the field exit is local to the specified screen in the specified program.
u2022     In the dialog box, you determine which function module gets executed for the field exit by specifying the identifier in the u2018Fld. Exitu2019 field.
u2022     If this field is left blank, the function module triggered will be 'FIELD_EXIT_<data element>'.
u2022     If a single-character identifier is entered into the field, the function module triggered will be 'FIELD_EXIT_<data element>_<identifier>'.
Step 8: Activate Field Exit
u2022     The field exit must be active for it to be triggered by the system.
u2022     Activate the field exit by choosing the Field exit -> Activate menu path.
u2022     After assigning the field exit to a change request, its status will change to u2018Activeu2019 and it will be triggered automatically on the appropriate screen(s).
NOTE : In order to activate the field exit the profile parameter abap/fieldexit = YES must be set on all application servers
Execute the transaction SE38 with PROGRAM NAME - RSMODPRF
Then give the Data Element Name for which field you want to create the exit(Just cross check with your field data element) and execute.
then it takes you to SE37 with the function module name FIELD_EXIT_<DATA ELEMENT NAME> and then create the same function module.
and in the coding part, You can write your logic to display the output of that field. and activate it.
once you complete the above,
Again execute SE38 transaction with program RSMODPRF and again click on Execute button without any Data Element Name. Now you select the data element which you have created and click on Assign prog/ Screen button and assign the program name and screen number of the filed and click on the menu Field Exit and Activate.
Hope it helps.
Regards
Radhika
Edited by: Radhika Pande on Nov 26, 2009 7:58 AM

Problem with user access level

David,
I have so far succesfully implementend your tutorial on users registering and having to validate their emailaddress (both part I and II).
Part I: http://cookbooks.adobe.com/post_Registration_system_that_requires_the_user_to_vali-16646.h tml
Part II: http://cookbooks.adobe.com/post_Registration_system_that_requires_the_user_to_vali-16649.h tml
When creating a login form however, I don't get it to work based on the access level verified = y. The database is set up exactly as you described in the above tutorials.
This is the HTML for the log in form (index.php):
<form ACTION="<?php echo $loginFormAction; ?>" method="POST" id="logon">
<label for="user">Username</label>
<input type="text" id="user" name="username" />
<br />
<label for="pass">Password</label>
<input type="password" id="pass" name="password" />
<br />
<label for="done"> </label>
<input type="submit" value="Log On" />
</form>
Below the code that is found above the <html> tag in the index.php file:
<?php require_once('../Connections/conn.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
$theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
return $theValue;
?>
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
session_start();
$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
$_SESSION['PrevUrl'] = $_GET['accesscheck'];
if (isset($_POST['username'])) {
$loginUsername=$_POST['username'];
$password=$_POST['password'];
$MM_fldUserAuthorization = "verified";
$MM_redirectLoginSuccess = "overview.php";
$MM_redirectLoginFailed = "index.php";
$MM_redirecttoReferrer = false;
mysql_select_db($database_conn, $conn);
$LoginRS__query=sprintf("SELECT username, password, verified FROM users WHERE username=%s AND password=%s",
GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text"));
$LoginRS = mysql_query($LoginRS__query, $conn) or die(mysql_error());
$loginFoundUser = mysql_num_rows($LoginRS);
if ($loginFoundUser) {
    $loginStrGroup = mysql_result($LoginRS,0,'verified');
    //declare two session variables and assign them
    $_SESSION['MM_Username'] = $loginUsername;
    $_SESSION['MM_UserGroup'] = $loginStrGroup;
    if (isset($_SESSION['PrevUrl']) && false) {
      $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
    header("Location: " . $MM_redirectLoginSuccess );
else {
    header("Location: ". $MM_redirectLoginFailed );
?>
On the overview.php page, I applied the restrict access to page behaviour, which results in the following code:
<?php require_once('../Connections/conn.php'); ?>
<?php
if (!isset($_SESSION)) {
session_start();
$MM_authorizedUsers = "y";
$MM_donotCheckaccess = "false";
// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) {
// For security, start by assuming the visitor is NOT authorized.
$isValid = False;
// When a visitor has logged into this site, the Session variable MM_Username set equal to their username.
// Therefore, we know that a user is NOT logged in if that Session variable is blank.
if (!empty($UserName)) {
    // Besides being logged in, you may restrict access to only certain users based on an ID established when they login.
    // Parse the strings into arrays.
    $arrUsers = Explode(",", $strUsers);
    $arrGroups = Explode(",", $strGroups);
    if (in_array($UserName, $arrUsers)) {
      $isValid = true;
    // Or, you may restrict access to only certain users based on their username.
    if (in_array($UserGroup, $arrGroups)) {
      $isValid = true;
    if (($strUsers == "") && false) {
      $isValid = true;
return $isValid;
$MM_restrictGoTo = "index.php";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {
$MM_qsChar = "?";
$MM_referrer = $_SERVER['PHP_SELF'];
if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0)
$MM_referrer .= "?" . $QUERY_STRING;
$MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);
header("Location: ". $MM_restrictGoTo);
exit;
?>
Any idea/thoughts on what I'm not adding to the page in order to work?

David,
Thank you for that insight, I figured it would be something like that and when I woke up this morning, it all made sense. I changed somthing from the tutorial (part I) you wrote and now it works fine.
I had trouble with the validation link in the email that is sent automatically. In your tutorial, section "generating and sending the validation email", you write:
$message .= urlencode($_POST['username']);
$message .= '&t=';
$message .= urlencode($token);
When using the code like this, it wouldn't set the verified column to y. However, when I changed the middle $message to
$message .= '&t=';
it updated the verified column to y. The URL that displayed from the original code displayed the & sign as & in the URL itself.
Next to that, whenever I try to add something to the e-mail, the validation link becomes not clickable anymore.
As the login problem concerns, encrypting indeed did the trick.
if (isset($_POST['username'])) {
$loginUsername=$_POST['username'];
$password=sha1($_POST['password']);
Putting the $_POST['password'] between brackets, adding sha1 in front of it. It works just fine now.
Hopefully no further problems on this anymore! Thanks a lot for your insights!
EDIT: I can't mark this thread as answered anymore?

Best way to handle user access levels with spring.

I'm a spring newb, and I'm not sure how to properly handle user access levels with a validation controller. There seems to be a lot of information out there about creating simple login validators but like I've said I need to create multiple levels of user access. I could throw something together but i want to do it correctly. Does anyone here have any links to resources or information they could provide?

ZimmerS1337 wrote:
SoulTech aren't you a smart ass, why post anything at all?You don't get to control what people post, any more than we can control what people ask. It's best to let stuff roll off your back.
ST wasn't exactly abusive. If you had typed "spring security" into Google, you would have gotten exactly what I recommended. So why would you say that his advice to try Google first was being a "smart @ss"? It's actually a good recommendation. Try it before you post here.
%

Custom Access Level/User groups in BOBJ XI

Experts,
We are currently implementing BOBJ XI 3.1. Up on go-live, it will be handled by the Operations team from BOBJ CMC. We do not want to give administrator group for the operations users in CMC. Instead, we want to create custom groups with custom access levels.
Ex. one for basis who will set up authentication, licenses etc
one for the functional folks to maintain universes, export universes and set up security.
Is there a way to set up user groups like this. We were able to successfully restrrict access just to folders, universes by creating a custom access level. But we were not able to do it on other items listed in CMC. Has anyone done this level of access before for the operations or even with in the development team instead of using administrator group>
Appreciate your response
Thanks
Kee

Hi,
We can assign different rights to a group by creating custom access levels.
Create a new group ,and also create custom access level and assign it to the new group.
you can provide access to different objects to the group by adding rights to the access level.
Under the access level > click Included Rights > Add and Remove Rights > Under the Rights Collection > click on System.
You could find all the CMC object access rights can be assigned.
Regards,
Rameez

Php code limit a user based on access level

building site where users post items for sale
different levels of access
want to limit basic access level to 10 postings
use php/mysql and dreamweaver CS4
thanks for your help,
jim balthrop

sounds phenominal
Like Craigslist but you have to pay... sign me up!
If the activation method of the registration being sent to your email is this method then, as mentioned, it can be circumvented. And the IP address is an absolute fool-proof way to prevent multiple registration. That is of course without the consideration that the user may use a proxy server or otherwise cloak their IP address.
Think of it this way: what if you were only allowed to post 10 threads in the Adobe forums and after that you had to pay to get "many benefits besides unlimited posting" What do you think DWFAQ would do?

TFS - Access Level - page not found when trying to add user

When I'm trying to modify some group under Limited Access Level I cannot do that because of the following error:
Page not found.
wrapErrorCallback/</<@server/tfs/_static/tfs/12/_scripts/TFS/debug/Presentation/Scripts/TFS/TFS.Core.Ajax.js:175:37
endRequest@server/tfs/_static/tfs/12/_scripts/TFS/debug/Presentation/Scripts/TFS/TFS.Core.Ajax.js:114:17
wrapErrorCallback/<@server/tfs/_static/tfs/12/_scripts/TFS/debug/Presentation/Scripts/TFS/TFS.Core.Ajax.js:141:1
jQuery.Callbacks/fire@server/tfs/_static/3rdParty/_scripts/jquery-1.8.3.js:984:10
jQuery.Callbacks/self.fireWith@server/tfs/_static/3rdParty/_scripts/jquery-1.8.3.js:1094:7
done@server/tfs/_static/3rdParty/_scripts/jquery-1.8.3.js:7815:1
.send/callback@server/tfs/_static/3rdParty/_scripts/jquery-1.8.3.js:8528:8
Any ideas why it happens?
Environment: Windows Server 2012 with latest updates, TFS 2013.4, user which is used for TFS is a member of local administrators group.

Hi Rybak,
Thanks for your reply.
Try to clean the Cache for TFS 2013 manually(delete the content of the folder only, not the cache folder itself):
Clean the Cache folder on Server machine. The folder path is:
C:\Program Files\Microsoft Team Foundation Server 12.0\Application Tier\Web Services\_tfs_data.
After cleaned, on Server machine, click Start and select
Run… to open the dialog box, then input iisreset.exe and click OK, wait it run completely.
If clean Cache cannot resolve this issue, please try to repair your TFS 2013 Update 4 Server, then check the result.
Additionally, you can run TFS 2013 Power Tools BPA to scan the installation of your TFS Server.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Query users, access level and last logon date

<p>Hello,</p><p> </p><p>Does anybody know how to query Essbase to look up users accesslevel and last logon date?</p><p> </p><p> </p><p>Rey Fiesta</p>

It can be done using the API. Access level is a little complicated because it can be by individual or group they belong to and it of course is different by application/database

Can not assign custom access level with a user login

Hi,
I am using Business objects XiR3. When I am loging in with a user having full control access and then I select a folder added a principal from user sercurity and when I am trying to add custom access level it gave me error
An error occurred at the server during security batch commit: Request 0 of type 38 failed with server error : You do not have sufficient rights to make the requested security changes.
it allow me to give access to standard access levels. also when I tried to assign custom access level with administrator user, it assigns custom access level to a principal without error.
Can any body tell me what I am doing wrong?
Thanks in advance,
Rajendra

Hi Rajendra,
You have to make sure that the user group has the right 'Use access level for security assignment' assigned as granted on the access level you created. You can find this right under System / Access Level. That should do the trick!
Hope this helps...
Martijn van Foeken
Focuzz BI Services
http://www.focuzz.nl
http://nl.linkedin.com/in/martijnvanfoeken
http://twitter.com/mfoeken

Access level to users at specific fields

Similar Messages

Maybe you are looking for