ACS 5.2 does not check Active directory changes
Hi all,
I am working with ACS 5.2 and using Radius authentication for vpn client.
The authentication method used is Active Directory in an Windows enviroment with multiple domains in the same forest.
My problem occurs when i change a user from one group to another in Active Directory. After that i receive the following message when try to connect:
15039 Selected Authorization Profile is DenyAccess
The message is because match the default policy.
Another user in the same AD group works fine.
All domain in the forest have trust relation each other.
I am using universal groups to include users from all domain belongs this forest.
Can anyone help me?
Regards
Dear all,
Hope you can help me with a similar issue i am facing on migration from Cisco ACS 4.1.24 to Cisco 5.3.0.40
and testing Radius authentication for vpn client users.
The authentication method used is external Active Directory and for some users authenticating to the external AD via ACS, the following message is obtained:
"15039 Selected Authorization Profile is DenyAcces", which results in Auth failure.
Other users on the same AD group seem to work fine and there are no changes performed on the AD for any of the concerned users.
Looking at the detail report for the user, confirms that no attributes are returned to the Radius(under the other attributes field) from the external server. The Radius also returns the following messages:
"24412 User not found in Active Directory"
"22056 Subject not found in the applicable identity store(s)"
Within the ACS Identity sequence in the ID store, the sequence is set to match on AD first and then Internal user. The Identity for the default network profile(for Radius users) is configured to General sequence. The same user/s seem to work fine when swithced to ACS4.
We are also looking at possible NTP sync issue with the ACS/AD or any NTLM/Kerberos auth issues or any issues related to applying the latest ACS patch to the box.Please let me know if there is any AD related configs to be modified.
Any help will be appreciated.
Thanks and Regards.
Similar Messages
-
ARD does not see Active Directory to join Macs
I just moved to a new company and have been setting up Mac support from the ground up there.
In my previous school district, I just used a network range to get the computers I was administering, but here, since we have SO MANY network ranges, I decided to try the directory search feature, which I dont remember ARD having.
Problem is we have no Open Directory here (yet) so the computers are just bought to AD for user login. Is this why I can not see computers populated in the directory search, or is something else wrong here, and I should normally see computers there regardless of the directory type the computer is bound to.
Worse case I just go searching network ranges by hand, but this would help speed up the proses.The MAC information that ARD is going to use when it attempts to query the directory for machines is likely missing from AD.
Turn on logging for directory services and you can see the request to AD for the machines:
http://support.apple.com/kb/HT3186
I had the same situation here at my company between search order of OD and AD. Unfortunately with AD being your only choice you don't have the option of using computer lists as far as I know. What about task server? You'll have to depend on DNS updating properly etc but it'll give you a dynamically updating list as your users move about. -
PO creation-ME21n-Why SAP does not check company code and Plant relation
Hi All,
Does someone know, why SAP does not check Plant and company code relation at the time of PO creation or how can we put validation between plant and company code at the time of PO creation.
<b>Example:</b> Suppose i have a company 0001 which is assinged to Plant 0001. when i am creating a PO with another company code 0002(Entering at header level-Org, data) and using Plant 0001 at line item level. SAP does not do this validation.
How can we put this check in place?
Thanks in advance.
DeepakHello Deepak,
There are three types of purchasing
- Company code specific :You need to assign company code to Pur organization
- Plant specific : You must assign plant to pur organization
- Cross company purchasing: No assignment between company code and pur organization.
In the case 3, the system will not check company code and plant relationship, but it will check plant and pur organization specific.
The following is the copy of sap help text:
You can assign a purchasing organization to one company code. This is company-specific purchasing.
You can assign a purchasing organization to no company code. This purchasing organization can then procure for all plants assigned to it, irrespective of the company code to which the plant belongs.
Since each plant must be assigned to a company code, the company code can be determined via the plant in each procurement transaction, even if the procuring purchasing organization is not assigned to a company code.
A purchasing organization must be assigned to one or more plants. This is plant-specific purchasing.
Now, check your company-code and purchase organization assignment.
Hope this helps.
Regards
Arif Mansuri -
Vl01n for so does not check batch management
batch management on the mm was not initially checked.
was checked after the material was put on the so.
unrestricted batch stock does exist
attempt to vl01n for that line creates a delivery but does not check batch management under material tab
what needs done to get the delivery to inherit the batch management check?Dear Starz,
I guess according to SAP standard - The indicator cannot be changed if stocks exist in either the current period or in the previous period.
However the same would be applicable as soon as you post the new stock after changing the material master record.
Hope this helps...
Give points if useful...
Thanks,
Jignesh Mehta -
Record does not "check in" after workflow is complete
Hi All,
I have built a very simple workflow as below
1. start step
2. process step
3. approve step
4. stop step
in the fourth step that is the stop step i have selected "check in" so that the record automatically check's in after the process is complete,
but the record does not check in and the data manager shows it as in workflow. please help
Thanks in Advance
Sharma.Hello Abhishek,
Thanks for the reply.
The issue is resolved.
The user had the authorizations and the records were checked out as well.
i was missing the step of "Mark as approved" that was the reason for the records not to check in automatically.
Thanky you again.
Regards,
Sharma -
GetSubwebsForCurrentUser does not check Root site
Hi,
I am trying to check if logged-in user has permissions to site. I have used the "getSubwebsForCurrentUser", but it does not check the Parent site and only checks for subsites. What am I missing?
My current code is as below:
function sharePointReady() {
clientContext = new SP.ClientContext.get_current();
web = clientContext.get_site().get_web();
_currentUser = clientContext.get_web().get_currentUser();
webCollection = web.getSubwebsForCurrentUser(null);
clientContext.load(webCollection);
clientContext.executeQueryAsync(Function.createDelegate(this, this.onWebsLoaded), Function.createDelegate(this, this.onQueryFailed));
function onWebsLoaded(sender, args) {
var webEnumerator = webCollection.getEnumerator();
while (webEnumerator.moveNext()) {
var web = webEnumerator.get_current();
olist = web.get_lists().getByTitle("Pages");
clientContext.load(olist);
clientContext.executeQueryAsync(onRequestListSucceeded, onRequestListFailed);
I have also tried the "web" variable as
web = clientContext.get_site().get_rootWeb();
How to fix this?
ThanksHi,
The SP.Web.getSubwebsForCurrentUser Method returns the collection of child sites of the current site.
http://msdn.microsoft.com/en-us/library/office/jj246242(v=office.15).aspx
If you want to check permission for current application scope, we can use
SP.Web.getUserEffectivePermissions Method to achieve it.
http://msdn.microsoft.com/en-us/library/office/jj850885(v=office.15).aspx
http://blog.fidelityfactory.com/2011/11/29/sharepoint-client-ecma-script-check-user-permissions/
More information:
http://sharepoint.stackexchange.com/questions/40082/js-jquery-check-if-on-root-web-of-root-sitecollection
Thanks,
Dennis Guo
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Dennis Guo
TechNet Community Support -
Hi, AVK does not check include jsp files <jsp:include
any clues?Hi
This is a known issue with the AVK which we will be addressing in a future release -
I am on a MAC Application.
It has been rejected by following reason.
This app does not check for the existence of a purchase receipt, which can prevent In-App Purchases from being correctly processed.
We recommend implementing receipt validation to resolve this issue.
At a minimum, the app will need to check for the existence of an App Store receipt and exit at launch with a status of 173 if it does not exist.
Any help ?
Thanks in Advance.I am on a MAC Application.
It has been rejected by following reason.
This app does not check for the existence of a purchase receipt, which can prevent In-App Purchases from being correctly processed.
We recommend implementing receipt validation to resolve this issue.
At a minimum, the app will need to check for the existence of an App Store receipt and exit at launch with a status of 173 if it does not exist.
Any help ?
Thanks in Advance. -
Freehand MX does not retain activation.
I had to reinstall Freehand MX on my new laptop. I have the new activation code from Adobe, it opens but does not retain activation. I must enter serial number every time. How can I fix this?
Hi SeaJaye,
What OS and version of FreeHand MX?
Thanks,
Sumit Singh -
262 Movement Type Issue - Does not check order
Hello,
A material is issued via a 261 to an order.
Say this order is now complete and we want to do a 262 back into stock SAP does not check whether or not the material had ever been issued to the order I entered in my 261.
Is there anyway we can have a 262 movement type check whether the material is in the order we enter?
N.B. I am aware we can use MBST, however this doesn't help for partial reversals.
E.G.
MIGO - 261
Material 123456789
Order2 123XYZ
Plant 1234
MIGO- 262
Material 123456789
Order2 RANDOMORDER
Plant 1234
The above scenario will post okay. We don't want it to as Order 2 has never had anything to do with material 123456789.
Any help is greatly appreciated.
JamesShakti,
You did not read my problem.
As I have said using MIGO to reverse the 261 does not check if the material was issued to that order. If I wanted to I can 262 back to an order that I've just found randomly....
My question was how can we get SAP to check whether the order we used has issued that material before (in the 261). -
Modify existing vpn traffic rule does not become active
Hi,
When I modify an existing traffic rule, the rule does not become active.
Instead I always need to do a stopvpn and startvpn.
Is this a known issue ?
We are running Bordermananager 3.8 servicepack 5 (running on Netware 6.5
servicepack 5)
regards,
PieterIs the scmserviceconfiguration java process running? (See JAVA -SHOW).
Do you have a replica on the server?
Have you tried clicking on the synchronize buttons in either iManager
or NRM?
Craig Johnson
Novell Support Connection SysOp
*** For a current patch list, tips, handy files and books on
BorderManager, go to http://www.craigjconsulting.com *** -
I bought and legally own PS CS3. Installed on a desktop and the machine died completely. Downloaded a trial of CS3 from Adobe site. Went to activate and said too many activations. Activate over the phone. EXCEPT Adobe does not handle activation issues over the phone. Adobe doesn't care about their older products - they don't care that I spent hundreds of dollars for CS3. This is truly disgusting corporate behavior. Is there anything I can do? We aren't all rich photographers. I paid a great deal of money for this product. Is it now useless?Thank you,
James ScottHI James please contact the Adobe Chat Team for activation issue
kindly do the mentioned steps as follow in order to get hold of chat rep of adobe
Go to www.adobe.com/getsupport
select the product as adobe creative suite - then select the issue as adobe id and sign in - and then click on still need help contact us then you will be able to find chat option and they will help you with the chat issue -
Why wsgen does not pick up the changed interface in wsdl.jsp?
Hi,
After I changed the type of return value in a method in a stateless EJB. The wsdl.jsp
generated by wsgen does not pick up the changed interface (it still has the old interface).
The installed ejb works well with new type of return value. But the web service (wsdl.jsp)
and client.jar does not work. At begining I thought it might be cached. So I cleaned
the cache in the browser and temporal directory inside wls domain. I also deleted
all old version of ejbs on my local disks. But there is no effect. I am confused.
Please help. Where does the wsgen looking for when generating wsdl.jsp?
Thanks a lot.
JimHi,
Please check the following path if your application is deployed or not properly if you are using eclipse:
Workspace\.metadata\.plugins\org.eclipse.wst.server.core\tmp0\wtpwebapps -
In Security, clicking on the "Saved Password" button displays your current saved password for each site. It only allows you to view and delete site passwords. It does not allow you to change a password. How would you do that?
If you enter a new password Firefox should offer to change the password.
*You may not need to delete the old password. Try "Refreshing" the page, entering the site again, you may need to let Firefox fill in the old password, then enter the new password, and Firefox should ask to save the new password. See:
**http://kb.mozillazine.org/Deleting_autocomplete_entries
*If you delete the old password, you may need to "Refresh" the site after deleting the old password.
If you want to delete the password that has been saved do the following:
#In the Tools menu select Options to open the options window
#Go to the Security panel
#Click the "Saved Passwords" button to open the passwords manager
#Select the site in the list, then click Remove
<br />
<br />
'''You need to update the following.''' The Plugin version(s) shown below was/were submitted with your question and is/are out of date. You should update to avoid known security issues with the version(s) you have installed. Click on "More system info..." to the right of your question to see what was included with your question.
*Adobe PDF Plug-In For Firefox and Netscape 8.3.0 (''Note: this is a very old version and installing the current version may not delete it or overwrite it. To avoid possible problems with having 2 versions installed on your system, you may want to remove the old version in Windows Control Panel > Add or Remove Programs before installing the new version'').
*Shockwave Flash 10.3 r181 (''this may be current but a new version was released on 2011-06-14 with a ".26" after the "181". You can use the Plugin Check below and/or look in Add-ons > Plugins for the version of Shockwave Flash that you have installed. The newest version will be shown in Add-ons > Plugins as "Shockwave Flash 10.3.181.26"'').
*Next Generation Java Plug-in 1.6.0_24 for Mozilla browsers
#'''''Check your plugin versions''''' on either of the following links':
#*http://www.mozilla.com/en-US/plugincheck/
#*https://www-trunk.stage.mozilla.com/en-US/plugincheck/
#*'''Note: plugin check page does not have information on all plugin versions'''
#*There are plugin specific testing links available from this page:
#**http://kb.mozillazine.org/Testing_plugins
#'''Update Adobe Reader (PDF plugin):'''
#*From within your existing Adobe Reader ('''<u>if you have it already installed</u>'''):
#**Open the Adobe Reader program from your Programs list
#**Click Help > Check for Updates
#**Follow the prompts for updating
#**If this method works for you, skip the "Download complete installer" section below and proceed to "After the installation" below
#*Download complete installer ('''if you do <u>NOT</u> have Adobe Reader installed'''):
#**SAVE the installer to your hard drive (save to your Desktop so that you can find it after the download). Exit/Close Firefox. Run the installer you just downloaded.
#**Use either of the links below:
#***https://support.mozilla.com/en-US/kb/Using+the+Adobe+Reader+plugin+with+Firefox ''(click on "Installing and updating Adobe Reader")''
#***''<u>Also see Download link</u>''': http://get.adobe.com/reader/otherversions/
#*After the installation, start Firefox and check your version again.
#'''Update the [[Managing the Flash plugin|Flash]] plugin''' to the latest version.
#*Download and SAVE to your Desktop so you can find the installer later
#*If you do not have the current version, click on the "Player Download Center" link on the "'''Download and information'''" or "'''Download Manual installers'''" below
#*After download is complete, exit Firefox
#*Click on the installer you just downloaded and install
#**Windows 7 and Vista: may need to right-click the installer and choose "Run as Administrator"
#*Start Firefox and check your version again or test the installation by going back to the download link below
#*'''Download and information''': http://www.adobe.com/software/flash/about/
#**Use Firefox to go to the above site to update the Firefox plugin (will also install plugin for most other browsers; except IE)
#**Use IE to go to the above site to update the IE ActiveX
#*'''Download Manual installers'''.
#**http://kb2.adobe.com/cps/191/tn_19166.html#main_ManualInstaller
#**Note separate links for:
#***Plugin for Firefox and most other browsers
#***ActiveX for IE
#'''Update the [[Java]] plugin''' to the latest version.
#*Download site: http://www.oracle.com/technetwork/java/javase/downloads/index.html (Java Platform: Download JRE)
#**'''''Be sure to <u>un-check the Yahoo Toolbar</u> option during the install if you do not want it installed.
#*Also see "Manual Update" in this article to update from the Java Control Panel in Windows Control Panel: http://support.mozilla.com/en-US/kb/Using+the+Java+plugin+with+Firefox#Updates
#* Removing old versions (if needed): http://www.java.com/en/download/faq/remove_olderversions.xml
#* Remove multiple Java Console extensions (if needed): http://kb.mozillazine.org/Firefox_:_FAQs_:_Install_Java#Multiple_Java_Console_extensions
#*Java Test: http://www.java.com/en/download/help/testvm.xml -
Whne I download iTune, it shows that it will be downloaded to Drive K which does not exist in my computer. It does not allow me to change to other Drives has enough capacity. Then I click change bottom, attempting to change drive, it terminates the download.
Do you have any solutions??Try "Invalid drive X:\" install errors. You should still be able to chose the drive for the download when downloading the installer with a web browser. The iTunes application is installed on the active system drive, usually drive C:.
tt2
Maybe you are looking for
-
Is it possible to have Apple TV device "remember" all three ID's? If so how does one set that up?
-
Can anyone help me get my Apple TV display to stop blinking on and off every second?
Hi, My Apple TV is a little under a year old its not version 1 I'm pretty sure it's 2... When I started it up the other night it came on but the display in the screen was blinking on and off about one a second non stop. The white light on the Apple
-
iPad2 wifi. After updating to 4.3.5, sound from all my games no longer works. Has anyone else experienced this?
-
Disable/Remove context menus in XP
is there anyway to disable the following context menus from windows explorer? - Convert to Macromedia Flash (.swf) - Convert to PDF with Macromedia Flashpaper - Convert to PDF and Email with Macromedia Flashpaper i get them when i right-click on most
-
We are trying to find a function in ABAP program to download SAP table data to an excel file. We have tried the following two function on our BI 7.0 system: 1. function: GUI_DOWNLOAD Exist, but when run it with following code, get the error msg "Wro