ACI and embedded groups

I'm wondering how the "embedded group" feature works from an ACI point of view.
I've defined an ACI bades on groupdn = "ldap:///cn=group_A,ou=groups,dc....
If group_A is a static group containing group_B, it works fine if group_B it a static group that uses objectclass=groupofuniquenames and RDN = cn (I mean using uniquemember attribute is not enough).
If group_A is a static group containing group_B and group_B is dynamic - filter = (&(objeclass=person)(uid=testuser)) - it works fine too.
But - maybe I mis use the feature - : if group_A is a dynamic group containg - through filter = (&(objectclass=groupofuniquename)(cn=group_B)) - and group_B is either dynamic or static, it doesn't work.
Does it mean that dynamic groups used within ACI can only contain users and not groups or that the "embedded group" feature doesn't work with dynamic group concept unless the dynamic group is the last one of the chain and therefore contains users ?
I'm sure I don't understand something but I can't figure what.
Regards,
Christian

ismemberof only works for static groups.
My main objective so to use dynamic groups to setup some ACI.
eg: allow user w/ attribute gidNumber=400 full read/write.Have you considered using filtered roles ?

Similar Messages

  • ACI and dynamic groups

    I can't seem to get dynamic groups working. Here's my dynamic group setup:
    ldapsearch -D "cn=directory manager" -w "passwd01" -b "ou=internal,dc=example,dc=com" "objectclass=groupOfUrls"
    version: 1
    dn: cn=istest,ou=Groups,ou=internal,dc=example,dc=com
    cn: istest
    objectClass: top
    objectClass: groupOfUrls
    ou: Groups
    memberURL: ldap:///ou=people,ou=internal,dc=example,dc=com??sub?(uid=user1)
    I know for sure user1 exists:
    ldapsearch -D "cn=directory manager" -w "passwd01" -b "ou=internal,dc=example,dc=com" "uid=user1"
    version: 1
    dn: uid=user1,ou=people,ou=internal,dc=example,dc=com
    objectClass: shadowAccount
    objectClass: posixAccount
    objectClass: account
    objectClass: top
    loginShell: /bin/bash
    uidNumber: 3000
    homeDirectory: /home/user1
    gecos: User1
    cn: User1
    gidNumber: 500
    uid: user1
    When I run a search, I get nothing:
    ldapsearch -D "cn=Directory Manager" -w passwd01 -b "ou=internal,dc=example,dc=com" "(isMemberOf=cn=istest,ou=Groups,ou=internal,dc=example,dc=com)"
    Directory Server version: 6.3
    Using /usr/bin/ldapsearch on solaris 10.
    My main objective so to use dynamic groups to setup some ACI. eg: allow user w/ attribute gidNumber=400 full read/write.
    mike

    ismemberof only works for static groups.
    My main objective so to use dynamic groups to setup some ACI.
    eg: allow user w/ attribute gidNumber=400 full read/write.Have you considered using filtered roles ?

  • Trouble with ACIs and dynamic groups

    Hi!
    Does Dirctory Server stop searching for subgroups after evaluating a dynamic group?
    Example:
    A User "uid=A,o=company" is member of a dynamic group "cn=dyn,o=company" via memberURL: "ldap:///o=company??sub?(uid=A)".
    The dynamic group "cn=dyn,o=company" is member of a static group "cn=stat,o=company" via uniquemember: "cn=dyn,o=company".
    If I grant any permission using an ACI with (groupdn = "ldap:///cn=stat,o=company") user A gets that permission.
    BUT
    A User "uid=B,o=company" is member of a static group "cn=static,o=company" via uniquemember: "uid=B,o=company".
    The static group "cn=static,o=company" is member of a dynamic group "cn=dynamic,o=company" via memberURL: "ldap:///o=company??sub?(cn=static)".
    If I grant any permission using an ACI with (groupdn = "ldap:///cn=dynamic,o=company") user B does not get the permission.
    Has anyone any suggestions?

    Hi!
    Does Dirctory Server stop searching for subgroups after evaluating a dynamic group?
    Example:
    A User "uid=A,o=company" is member of a dynamic group "cn=dyn,o=company" via memberURL: "ldap:///o=company??sub?(uid=A)".
    The dynamic group "cn=dyn,o=company" is member of a static group "cn=stat,o=company" via uniquemember: "cn=dyn,o=company".
    If I grant any permission using an ACI with (groupdn = "ldap:///cn=stat,o=company") user A gets that permission.
    BUT
    A User "uid=B,o=company" is member of a static group "cn=static,o=company" via uniquemember: "uid=B,o=company".
    The static group "cn=static,o=company" is member of a dynamic group "cn=dynamic,o=company" via memberURL: "ldap:///o=company??sub?(cn=static)".
    If I grant any permission using an ACI with (groupdn = "ldap:///cn=dynamic,o=company") user B does not get the permission.
    Has anyone any suggestions?

  • Web and embedded sound in PDF

    Hi,
    Made a posting in the Windows group but no one seems to know anything about the item.
    I found the possiblity to embed sound in a pdf very accurate to a project I´m working on (example pages from a teaching material in languages) and embedded the corresponing sound (from a CD that is included with the book) and put a nice poster image to start playing. Those pdf:s was then published on the net. It seems to work fine on every PC I´ve tested but the customer has a Mac and when the pages where opened there was no poster or possibility to listen to the sound file. I´m not sure what OS he is using but is there any problems related to this that anyone here can enlighten me.. ?
    Most thankful for any help.
    My best
    Michael

    First of all, I'm not that familiar as a user of Acrobat Pro. But as its included in my CS4 suite I checked it out by "intuition" and as I understood it the "embed-media" feature is a rather new one. Anyway, how I did it is staight forward from the interface. You insert at media type (in my cas a mp3-file) and optional you can use a "poster" as a trigger/button to play the file. Both the sound file and the image is included in the pdf-file.
    Anyway, it would be helpful to know if you can play the sound filde from your Mac. Most helpful would be if anyone knows any limitations connected to my pdf with embedded sound in terms of the average web-user, and especially those running on Macs.
    You don't need to download the file, just open the URL http://www.imatri.se/lab/Prosim/pdf/prosims8.pdf. The page displayed is an excert from a language material in swedish but regardless this: Everything is OK if theres an image of an CD, a playbutton and some text in swedish ABOVE the chapter name "1 Ahoj". A click on that image will play the sound.
    Please let me know how it looks and again I ask anyone who knows about possible limatations to use this kind of docs.
    My best
    Michael

  • Jazn-data.xml file, authentication in web.xml and embedded oc4j

    I've defined new security-roles, security-constraints and an authentication method in my web.xml file and i've created a new jazn-data.xml file that holds the different users and their groups.
    If I want to link the security-roles of the web.xml file to the roles in the jazn-data.xml file I always need an orion-application.xml file, is this correct?
    If I want to deploy an application as this to the embedded container the security won't work, I'm always getting the '403 forbidden' page.
    Can somebody point me out how I need to define security for an embedded and standalone environment when using authentication and jazn-data.xml file + how do I deploy this to a standalone oc4j and how to get this same application to work in the embedded oc4J.

    hi "romanna"
    Part of the answer to "Can somebody point me out how I need to define security ..." can probably be found in the "Oracle ADF Developer's Guide" that has "18 Adding Security to an Application".
    success
    Jan

  • AFEFontManager,TextLayoutFramework and embedded fonts

    Should we not use AFEFontManager in conjunction with TextLayoutFramework and embedded fonts. I have a project that was using the compiler argument -managers=flash.fonts.AFEFontManager. I would embed fonts from a loaded swf, but the fonts would be of type "embedded" instead of "embeddedCFF". Since the type wasn't embeddedCFF, the font wouldn't display correctly.
    I removed the -managers=flash.fonts.AFEFontManager argument and it works perfectly.
    So, is there a different way to reference the AFEFontManager? Or perhaps it's not necessary to do so at all?
    thanks.

    I think this question needs to go to the flex forum, since it is more about AFEFontManager. "embedded" fonts work with TextField, "embeddedCFF" fonts work with TLF and flash.text.engine. It's possible there is a way for you do this with embeddedCFF, that is a question for the Flex group, they are the best source fr information about the compiler.
    Thanks,
    - robin

  • Difference Between Calculated Member and Embedded summary

    Hi,
    Can anyone explain me the difference between the Calculated Member and Embedded summary.  Please also clarify when to use which one.
    The issue I am having a crosstab report displaying sales revenue for product over the years.
    I have my years in columns, product in rows and sales revenue in summarized field.  There are 10 products in my report. Its static as of today.
    I have to group the first 4 products and display the sub total over the  years.  Similarly I have to group the last 6 products and display the sub total over the years in the cross tab.
    I have to display a column next to the sales revenue having the percentage contribution by the product to that group that I have created earlier.
    How to achieve the same.
    Thanks and Regards,
    Subbu S

    Please re-post if this is still an issue to the Crystal Report Design Forum or purchase a case and have a dedicated support engineer work with you directly

  • How to restrict Sales office and Sales Group.

    Hi All,
    I want to restrict the users from changing the sales office and sales group in the sales order.
    Is there any standard way to achieve this or do we need to do with User exit??
    Please help.
    Thanks,
    Pavan.

    hi
    there is no standard settings for estrict the users from changing the sales office and sales group in the sales order
    so you have to write the logic in userexit
    DATA: lt_user_list   TYPE STANDARD TABLE OF tvarvc,
           lw_user_list   TYPE tvarvc,
           lr_user        TYPE RANGE OF syuname,
           lw_user        LIKE LINE OF lr_user.
    IF screen-name EQ ' VBAK-VKBUR' and   VBAK-VKGRP.
    * IF sy-tcode EQ 'VA02'.
    **Get list of users who are allowed to change SO - only they can change payment terms
         SELECT *
           FROM tvarvc
           INTO TABLE lt_user_list
          WHERE name = 'ZSD_VA02_ALLOWED'
            AND type = 'S'.
         IF sy-subrc = 0.
           LOOP AT lt_user_list INTO lw_user_list.
             lw_user-sign = lw_user_list-sign.
             lw_user-option = lw_user_list-opti.
             lw_user-low    = lw_user_list-low.
             lw_user-high   = lw_user_list-high.
             APPEND lw_user TO lr_user.
             CLEAR lw_user.
           ENDLOOP.
    **    If user is not in the users listed for change allowed
           IF sy-uname NOT IN lr_user.
             screen-input = 0.
           ELSE.
             screen-input = 1.
           ENDIF.
         ENDIF.
       ENDIF.
    ENDIF.
    go to STVARV t code here you check the NAME and give the user ids who need to change

  • V I Engineering, Inc has immediate needs for Systems Engineers (Contract) and Senior Systems Engineers (Contract) (reporting to the Test Software and Integration Group Manager)

    Company: V I Engineering, Inc.
    Locations: Various - USA
    Salary/Wage: $negotiable
    Status: Hourly Contractor
    Relevant Work Experience: 5+ years system integration (LabVIEW/TestStand experience required)
    Career Level: Intermediate/Experienced
    Education Level: Bachelor's Degree
    Residency/Citizenship: USA Citizenship or Greencard required
    Driving Business Results through Test Engineering
    V I Engineering, Inc. has a vision for every client we engage. That vision is to achieve on-time and on-budget program launch more efficiently that the competition. To realize this vision, customers need to achieve predictable test systems development, eliminate waste in test information management, and drive increased leverage of test assets. An underlying requirement for all of these areas is metrics tracking and measurement based decision making.
    Job Description
    Ready to make a difference? Bring your experiences and skills to the industry leading test organization. Help us to continue to shape the way the world views test. We are seeking a talented Systems Engineer Contractor to be responsible for technical execution of successful projects in the Medical, Military, Transportation, Consumer Electronics and Aerospace Industries. The position will have very high visibility to customers and vendors. This is a very fast paced team with close customer contact and strong career development opportunities. A large part of the position is to identify, own and drive technical design, development and installation of test systems. You will work alongside other like-minded and equally talented engineers, and be creative in a fast-paced and flexible environment that encourages you to think outside the box. You will be available to spend extended periods at our customer sites to complete system installations.
    Required
    5+ years of Systems Integration experience
    3+ years LabVIEW experience
    1+ years TestStand experience
    Experience in Implementation and Delivery of Test Systems, including integration
    Experience in ATE usage and development
    Experience in building and Integrating Mechanical Fixtures
    Experience in Understanding the design of Circuit Boards as they relate to a total system, and their fault-finding
    Experience in Taking Part in Technical Teams throughout All Phases of Project Lifecycle
    Experience in Interfacing with Sub-vendors and Customers
    Ability to Multitask
    Comfortable Working on Various Team Sizes
    Excellent Communication Skills
    Desired
    Requirements generation and review experience
    National Instruments Hardware knowledge
    Experience with Source Code Control (SCC)
    Experience executing verification and validation for projects
    Experience generating and/or reviewing cost proposals
    RF Technology (DAQ, General RF Theory)
    FPGA (with LabVIEW)
    Professional software engineering processes and metrics experience
    TortoiseSVN
    V I Package Manager (VIPM)
    Experience with Projects for Regulated Industries
    MS Project
    Formal Education
    Technical degree (BS Engineering, Computer Science, Physics, Math)
    National Instruments Courses a plus
    National Instruments certification a plus
    Notes:
    Expected Travel Time is up to 50%.
    V I Engineering, Inc. offers a dynamic work environment and the flexibility of a small company.
    The Test Software and Integration Group values innovation, out-of-the-box thinking, high-tech toys and a fun / amazingly collaborative working environment. We're a National Instruments Select Integrator, and we're the closest you can get to playing with all the pre-released and new NI toys without joining the NI R&D team - and we get to play with them in the real world.
    To apply for this position, email a cover letter and resume to [email protected] with the subject "TSIG Systems Engineer (Contract) employment application".
    Copyright © 2004-2015 Christopher G. Relf. Some Rights Reserved. This posting is licensed under a Creative Commons Attribution 2.5 License.

    Edit
    Jeff

  • V I Engineering, Inc has immediate needs for Systems Engineers and Senior Systems Engineers (reporting to the Test Software and Integration Group Manager)

    Company: V I Engineering, Inc.
    Locations: Positions available in our Farmington Hills, MI Office
    Salary/Wage: $negotiable
    Status: Full Time, Employee
    Relevant Work Experience: 5+ years system integration (LabVIEW/TestStand experience preferred, but not required)
    Career Level: Intermediate (Non-Manager)
    Education Level: Bachelor's Degree
    Residency/Citizenship: USA Citizenship or Greencard required
    Driving Business Results through Test Engineering
    V I Engineering, Inc. has a vision for every client we engage. That vision is to achieve on-time and on-budget program launch more efficiently that the competition. To realize this vision, customers need to achieve predictable test systems development, eliminate waste in test information management, and drive increased leverage of test assets. An underlying requirement for all of these areas is metrics tracking and measurement based decision making.
    Job Description
    Ready to make a difference? Bring your experiences and skills to the industry leading test organization. Help us to continue to shape the way the world views test. We are seeking a talented Systems Engineer to be responsible for technical execution of successful projects in the Medical, Military, Transportation, Consumer Electronics and Aerospace Industries. The position will have high visibility to customers and vendors. This is a very fast paced team with close customer contact and strong career development opportunities. A large part of the position is to identify, own and drive technical design and development of test systems. You will work alongside other like-minded and equally talented engineers, and be creative in a fast-paced and flexible environment that encourages you to think outside the box.
    Required
    5+ years of Systems Integration experience
    Experience in Design and Implementation of Test Systems, including integration
    Experience in ATE usage and development
    Experience in reviewing of Mechanical Fixtures
    Experience in understanding the design of Circuit Boards as they relate to a total system
    Experience in Taking Part in Technical Teams throughout All Phases of Project Lifecycle
    Experience in Interfacing with Sub-vendors and Customers
    Ability to Multitask
    Comfortable Working on Various Team Sizes
    Excellent Communication Skills
    Desired
    Requirements generation and review experience
    National Instruments Hardware knowledge
    LabVIEW/TestStand experience
    Experience with Source Code Control (SCC)
    Experience executing verification and validation for projects
    Experience generating and/or reviewing cost proposals
    RF Technology (DAQ, General RF Theory)
    FPGA (with LabVIEW)
    Professional software engineering processes and metrics experience (statement coverage, code size, reuse measurement, etc)
    TortoiseSVN
    V I Package Manager (VIPM)
    UML
    Experience with Projects for Regulated Industries
    MS Project
    Formal Education
    Technical degree (BS Engineering, Computer Science, Physics, Math)
    National Instruments Courses a plus
    National Instruments certification a plus
    Notes:
    Expected Travel Time is up to 25%Re
    location assistance is possible.
    V I Engineering, Inc. offers incredible opportunities to grow and advance your career, a dynamic work environment and the flexibility of a small company.
    The Test Software and Integration Group values innovation, out-of-the-box thinking, high-tech toys and a fun / amazingly collaborative working environment. We're a National Instruments Select Integrator, and we're the closest you can get to playing with all the pre-released and new NI toys without joining the NI R&D team - and we get to play with them in the real world.
    To apply for this position, email a cover letter and resume to [email protected] with the subject "TSIG Systems Engineer employment application".
    Copyright © 2004-2015 Christopher G. Relf. Some Rights Reserved. This posting is licensed under a Creative Commons Attribution 2.5 License.

    Edit
    Jeff

  • PO Line Item wise gross value for combination of WBS and Material Group

    Hello,
    Our requirement is to get report for PO Line Item wise gross value for combination of WBS and Material Group. Standard report ME2J gives net price but not gross value for Material Line items. Please let me know if any standard report( or ME2J) will suffice this requirement.
    Regards,
    Milind Dumbre

    Dear Milind
    No standard report available to get the PO Line Item wise gross value for combination of WBS and Material Group. Please go for development by taking reference ME2J.
    Warm regards
    Ramakrishna

  • Excise modvat accounts not defined for DLFC transaction and excise group

    Dear Experts,
    Iam raising this question after checking all the contents related to Sub Transaction type in SDN.
    My prob is: for raw material sales scenario i have created order delivery and invoice. For Invoice i have done account determination with a different G/L in VKOA. Now i have to create an excise invoice and the accounting entry for central ED on sales should go to different G/L account. for account determination i have done the following settings:
    Maintained Sub transaction type in
    IMG -> Logistics - General -> Tax on Goods movement -> India -> Basic Settings
    ->Maintain Sub Transaction types
    IMG -> Logistics - General -> Tax on Goods movement -> India ->
    Account determination -> Specify Excise Accounts per Excise Transaction.
    Here against DLFC sub transaction Type is maintained..
    Also
    IMG -> Logistics - General -> Tax on Goods movement -> India -> Account determination -> Specify G/L Accounts per Excise Transaction
    Here maintained Excise group with DLFC Company Code subtransaction type, chart of accounts and all required GL Account .
    But when the iam creating Excise Invoice in J1IIN and clicking on Subtransaction type-F4, no entries are shown. No values found is the message in green. Message no. DH801
    If i use subtransaction type and enter billing document and enter, the following error message comes:
    "Excise modvat accounts not defined for DLFC transaction and excise group"
    Iam unable to understand why the subtransaction type maintained is not showing in TCODE J1IIN?
    Regards

    For the error message DH801, please check note 840911
    Excise modvat accounts not defined for
           DLFC transaction and excise group"
    Please check  your G/L assignments "Specify G/L Accounts per Excise Transaction"
    thanks
    G. Lakshmipathi

  • Default Excise and series group

    Dear All,
    We have maitnain the Excise group and series group defaults for one sales area and shipping point and the plant and series group and excise group.
    The requirement is with the same combition we are doing local sale and the deemed export.We can do this by changing document type under utilization tab in excise invoice.As We have too many transections daily  we have done  settings as create excise invoice during creation of Invoice.In this its not possible to change the excise document type.In this case we want the excise documene type should come automatically.How we can do this?
    Furhter,with the same sales area and shipping point and the plant and excise group we have different series group.We want this also default. Is there any user exit to address this scenario.
    Please give your valuable inputs.
    Regards,
    Deepti

    Dear Dipti
    you can use J_1I7_USEREXIT_EXCISE_BEF_SAVE userexit , here you are refering to changing EXPIND in J_1IEXCHDR , then change the same and try
    for determining series group you can use the user exit J_1I7_USEREXIT_SERGRP_DETERM , to determine series group
    Jitesh

  • Maintain Excise and series group determination setting

    Hi Everybody,
    In maintain excise group and series group determination setting. My all the fields are common for both domestic and export and i have to differentiate with automatic excise invoice. When i was trying to do the setting in Maintain excise and series setting. Its not allowing me to save it.
    I explain in a better way
    Sales org.      Distribution ch.      Division    shipping point    Plant     excise Group    series group     export        sub transt. type
    in03                    z1                        z1                inpa              inpa            z1                  z1
    All these fields are common for export also. when i try to maintain setting for export. i just try to add export field as export under bond.  But it stops to do that. And our company policy is we can not create more distribution channel  or division.
    Can anybody tell me how to do that or is there any user exit for this.

    Hi,
    I had created a new series group and tried to assign in the maintain excise and series group determination. But it give the same error  "target ket must be different from the source key"
    What i had done is : i had created new series group i.e z3
    and maintained setting like that
    in03         z1       z1        inpa       inpa        z1     z3       Export under bond
    when i try to save it, it gives error.

  • How do I restore my tabs and tab groups after an update to version 36.0?

    I work with many tabs when I use Firefox. I keep them ordered in Tab Groups, which helps separate the different kids of work I do and interests I have. I have been using this environment for years. When I started my work today, Firefox updated to v36.0, and the following behaviour was noticed:
    1. There is only one tab group when attempting to show Tab Groups in Panorama, as opposed to around a dozen;
    2. Normally though the hidden tabs (the tabs in the same group as the startup group and not the default page) don't download content until clicked, the name of the page and icon, if available, will show on the tab. Presently, the tabs show "New Tab" and no icon. There appears, however, to be the number of tabs that exist across all Tab Groups but now are ghosts this one, default Tab Group. I'd have to add, though, I don't count the number of tabs, so I can't be exactly sure. When clicked, there is just a blank page. So it is odd that Firefox knows they are there but cannot simply attach the address to it.
    I have tried to restore the following files from my Windows Home Server backup to the AppData\Roaming\Mozilla\Firefox\Profiles\<gobbletygook>.default folder:
    1. In the sessionstore-backups folder, I replaced the previous.js, recovery.bak and recovery.js files (not any of the upgrade~) with files from yesterday and from two days before.
    When that didn't do anything, I replaced
    2. sessionCheckpoints.json
    I didn't see any file with a recent date that appeared to be one that I should restore. I should add that I do see hidden files. I thought about restoring the whole lot, but wasn't sure how this would affect the program on v36.0 and the profile files on 35.0.1.
    I have deadlines this week and need to immediately restore my environment in order to make those deadlines. I have no list of addresses to my Web pages to work in IE or other. Any help would be very much appreciated.
    On a second note, I had been wondering recently whether this tab group environment is a suitable way to maintain my work environment. Occasionally, when opening Panorama, I would get an error saying a script is taking too long, but if I clicked Continue, it would display the groups in a few seconds. I had considered putting all of it in Bookmarks though it would be tedious and more difficult to access and open multiple tabs. In the beginning, I tried Tab Groups thinking it was a simple matter of maintaining a table of addresses (in tabs) with a tab group ID or name. How could that go wrong? Well, it has, so it is obviously more complicated than that, and I didn't realise that upgrades would affect personal data. Should I abondon using tab groups?

    With the help of information from user, ptressel, in [https://support.mozilla.org/en-US/questions/1032154#answer-673322 a post here about the existence of sessionstore.js when version 33 was released], I was able to easily recover my tabs and tab groups as follows:
    # close Firefox and, perhaps, allow a few seconds (30s?) for any final closing of files;
    # check to see if you have a sessionstore.js file in your profile folder, named like the one I documented in my original post above;
    # if it is not timestamped prior to the discovery of your problem, open the sessionstore-backups folder;
    # check if the recovery.js file is suitably timestamped and, if not, the recovery.bak.
    # At this point, you are likely to find that none of them are prior to your problem occuring. If so, open your backups of this folder and go through steps 2-4 to find a file prior to your problem occuring.
    # When you find a file, copy it to the root of your current profile folder and name it, "sessionstore.js"
    # Open Firefox. Mine opened up as desired.
    This is a Windows solution. Sorry I can't comment on other platforms, but I'd bet that as this is just a file copy and renaming, it is likely the same.
    For Windows users, you may find you need to sign out and login as an administrator in order to access the backups. You need not logoff your standard account, but do have Firefox closed as described above.
    Hope that helps.

Maybe you are looking for