Active Directory: how to return users account permissions RWDA?

In SCS 7.x
I`v been looking throught idoc functions and couldn`t find one to return the users account permissions when they log in with active directory..
How is this done..
I`v noticed they added the code in 10g..
<$userHasAccessToAccount("profile_account", "R")$>
Thanks.
Update:: I ended up just writing my own function that called a service returned AD info split the string and matched it against the account to return 1 = R, 2 = W, 4 = D, 8 = A
R = 1
RW = 3
RWD = 7
RWDA = 15

Similar Messages

When provision to Active Directory, how to create user in a specific OU????

Hi all,
I have installed Oracle AD Connector 9.1.
When I try to provision a user to AD, the user is creating in the Users ou.
1) How can I create a user inside a specific ou.(other than Users ou)?
2) How can I add users to AD Groups?
I have tried to solve this problem by reading the Oracle Connector Documentation. And I already done it for 3 times.(all the steps in that documentation). But, couldn't find any way to solve these problems.
Also, I tried to read other forums. But, can not solve the problem.
Please help me.
Thank you.
Chaturanga

Hi,
Just see the process form.You will see a field name organization.You need to pre- populate this fields as per your logic.Let me know if you have any clarifications.
Regards
Nitesh

10.5.5 Active directory problem for mobile users

I an running 10.5.5 on a MBP 2.4. The computer is attached to Active Directory for authentication. The accounted is setup as a mobile user with automatic home sync. Below is the problem I'm experiencing after 10.5.5.
Upgrade worked fine, everything went through as expected. When I got home with computer, couldn't login. I did eventually get logged in, computer became extremely unresponsive at intermittent times.
At work next day, everything worked fine.
I believe this is a problem with 10.5.5 computers that are bound to AD, when AD is not available (but internet is.) Some type of weird priority locking or timeout setting? It seems to fail immediately if no network is available, but if the internet is available it is like it gets "hung" waiting for a response.
Anybody else having similar problems?
Below are the details on the specific tests that brought me to this conclusion.
1) Boot with work network cable connected - Works fine
2) Boot with work wifi network enabled - works fine
3) Boot with public wifi network enabled and work cable - works fine.
4) Boot with only public wifi - appears "frozen" (turned off after 5 minutes of trying to login)
5) Boot without network or wifi - works fine using cached mobile account info
6) Boot with network cable and public wifi, remove network cable after login- works fine for a period becomes periodically frozen. attempts to do anything become queued, when computer starts responding queue emptys out (can see menus / applications switch around to correspond with clicks.)
7) Change account to Manual sync of mobile account, again boot with network cable and public wifi, remove network cable- no freezing responds normaly.
All steps repeated after rebinding computer to AD - same results.

First rule of installing an upgrade, run permissions repair both before & after. Did you do that?
I'm using a Mac dual bound to AD & OD, works perfectly. I can't speak for the exact setup of your network but I personally would be suspicious of AD. I had a similar issue some time back where my processor would go crazy with the net directory authentication running like crazy. Turned out AD had somehow forgotten my computer. It only happened away from work where my Mac couldn't contact the AD server (not exactly sure why). I'd try the following.
1. While at work create a local administrative account on your Mac (you should always have a backup account anyway).
2. Login as local admin account.
3. open Directory Utility from the Applications/Utilities folder & remove the AD server (you'll need an account that can bind machines to AD).
4. re-add your Mac to AD.
This may resolve your issue & shouldn't hurt anything in the least.

Pre-populate adapter for setting the Active Directory OU for a user

Hi All
I created a pre-populate adapter that set the Active Directory OU for a user...
In the end the status of the resource is still showing "provisioning"..
It must be "Provsioned"..did I miss something ?
The logs speak as below :-
08:01:12,678 INFO [STDOUT] Running Create User
08:01:12,678 INFO [STDOUT] Before appending Root Context:OU=Human Resources,
08:01:12,678 INFO [STDOUT] tcUtilLDAPController.java : hierString : OU=Human Resources,dc=mydomain,dc=com
08:01:13,553 ERROR [ACTIVEDIRECTORYCONTROLLER] Problem creating object: javax.naming.OperationNotSupportedException: [LD
AP: error code 53 - 0000001F: SvcErr: DSID-031A0FC0, problem 5003 (WILL_NOT_PERFORM), data 0
]; remaining name 'cn=ASYMONDS'
08:03:18,756 INFO [[xlWebApp]] action: LogonAction: User 'XELSYSADM' logged on in session 8116CBC0FA1481D06A207A1941B9
E096
08:22:31,256 ERROR [WEBAPP] Class/Method: ProvisionedResourcesForUserAction/confirmEnableSelection encounter some proble
ms: No checkbox was checked.

Just verify the OU value is correctly populated , first try doing the provisioning by manually giving OU and everything .
Is it successful ?
Then we can check if something wrong going with pre pop.
Thanks
Suren

How to exclude user account for auditing.

I would like to know how to exclude user account from the audit policy, such as below.
AUDIT SELECT TABLE BY ACCESS WHENEVER NOT SUCCESSFUL ;
thanks in advance.
May

Security team request to reduce the amount of the audit data based on the user account. Can I use FGA to implement it?possible as it lets you specify the conditions necessary for an audit record to be generated:
FGA policies are programatically bound to the object (table, view) by using the 'dbms_fga' package. It allows you to create any desired condition,
for example: Audit an event only when the following conditions are true:
A table is accessed between 6 p.m. and 6 a.m. and on Saturday and Sunday.
An IP address from outside the corporate network is used.
A specific column has been selected or updated.
A specific value for this column has been used.
more detail available on Oracle by example
http://www.oracle.com/technetwork/articles/idm/fga-otn-082646.html

How to disable user account

Hi,
How to disable user account after few failed login attempt.
We have the password policy settings. But we also like to disable account after 5 failed login attempt.
thanks

This function is not available in Connect.

How to transfer user accounts from Active Directory to Open Directory

Please help me , want to tranfer user accounts from Active Directory (Windows server 2012 ) to Open Directory (OS X server 10..2.9)

Hi,
Go to the advanced administration for the OSX Server:
https://help.apple.com/advancedserveradmin/mac/3.1/#apd6D7FE39D-32AA-400C-91E1-5 0ABC15655C8
This pretty easy way of connecting your server to the Windows server should give AD users access to OD services. That will be a good start.
Read up on this as well:
http://support.apple.com/kb/PH15469
Do you want to import them all or just the Mac users?
Goodluck!
Jeffrey

How to manage user account and management through AMS

Hi all,
I’m in the process of designing a new mobile app that requires user registration, login and password reset. Basically all the standard user self service activities that public apps provide. Imagine Instagram for example.
We’re already looking at Azure Mobile Services and Facebook, Live, etc. authentication. But I’m a bit unclear on how to best handle manual user registrations. How would you best handle a user who decides that they want to register
without their social account?
User table in the custom application DB with user name, password, etc. and custom user management pages for registration, login, password reset
Azure Active Directory and OAuth same as with facebook, etc. Then build custom user management pages for registration, login, password reset, etc.
Some other Azure service that I don't know about?
Something else?
I noticed there is already another related question here:
https://social.msdn.microsoft.com/Forums/azure/en-US/ca5527f6-1130-4ebb-b335-2d4d6eda7734/create-new-account-and-reset-password-options-on-aad-signin-page?forum=azuremobile
The 2 important aims for this app are to require minimal maintenance and support overhead and high security at the same time.
Thanks,
Kia

I am not saying that, but with your question it looks like you want a custom auth.
Did you saw these article:
Register your apps to use an Azure Active Directory Account login
Authenticate your app with Active Directory Authentication Library Single Sign-On
Sara Silva - Microsoft Visual C# MVP
My blog |
My Windows 8 Store Apps Samples |
More Samples
Follow me in Twitter @saramgsilva
My Windows 8 Store Apps:
Female Pill |
Galinho (Tic tac Toe) |
24 |
My Snake
My Windows Phone Apps

CMC Authentication Active Directory Synchronization Updates Drops Users

We are using SAP Business Objects on a Windows Server 2008 box and have configured single sign-on using Active Directory. We schedule the Active Directory in the Authentication tab to synchronize every day. Yesterday not all of the users updated and actually were dropped from the CMC. We think it was because one of the domain controllers went down for a group of users during the last CMC Active Directory Update. My question is, are there any log files we can look at for the active directory synch to see if there were any errors detected during the synchronization. It would be nice too, to be able to see a list of what actually happened during the Active directory synch like what groups, users and user group associations where added and deleted.
The result was when the users were dropped we lost any manual security setups and the user lost their favorites and preferences settings because they were dropped. Is there anyway we can insulate our Acitve Directory updates from accidentally dropping users when something goes wrong with the Active Directory Synch Update?
Any best practices would be greatly appreciated.
Thanks,
Bill

Hi Bill,
Usually, if a group has been deleted or renamed in the AD controller, the group is deleted from the CMC. If a DC is not available, the group shouldn't have been deleted.
As far as I know, there are no options for debugging the action of the schedule. If you suspect that this can happen again, you can enable/disable traces on your CMS programming the creation/copy of CMS_trace.ini when the AD graph/alias schedule is going to happen.
There is an Idea that you can vote to avoid users being deleted when the group is accidentally deleted from the CMC:
https://cw.sdn.sap.com/cw/ideas/2645
In the meantime, you can also create Enterprise alias for your AD users, so even if the problem appears again, the security, inboxes and favourites will still be there.
1401058 - How to create Enterprise aliases for LDAP or AD accounts
[https://service.sap.com/sap/support/notes/1401058]
Regards,
Julian

Active Directory Changes have causes users to loose access to Projects they are set as contributor too.

Hello,
We recently had an employee of our helpdesk delete (by accident) and recreate a number of Active Directory user profiles. The profiles were created exactly like they were before, but now those users are not able to access the projects in TFS that they
have contributor permissions too. Some of these users can see a minimal set of objects in the Source Control Explorer, but each item has a (+) plus sign next to it as if the object does not exist in the repository. The users and windows groups
that are concerned are still listed inside of TFS's group memberships for each project. I have confirmed that the sync from AD with TFSJobAgent.exe is completing with out errors as well.
Is this a SID issue where TFS actually thinks that these are new users, and if so how can I best fix it for those users?
Doug Dayley

Hi Doug,
Thanks for your reply.
Ok, let’s check whether TFS Server can identify this user and its groups which this user belonged to. Please execute below command for this one user, then view command result, check if the user name and SID both show correctly in result, and whether this
user belonged to groups all listed in command result.
Tfssecurity /imx “domain\username” /collection:URL
If this user’s all information show correctly in command result. Please try to remove this user from your TFS server, then clean the TFS Cache, re-add this user back to TFS Server, then check if this user can access your team project as expect.
Clean the Cache for TFS 2013 manually(delete the content of the folder only, not the cache folder itself):
Clean the Cache folder on Server machine. The folder path is:
C:\Program Files\Microsoft Team Foundation Server 12.0\Application Tier\Web Services\_tfs_data.
After cleaned, on Server machine, click Start and select
Run… to open the dialog box, then input iisreset.exe and click OK, wait it run completely.
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

How to change user account's Short Name

Hopefully this is a fairly simple question.
When I installed OX 10.3 I mispelled my short name, and now I'm can't find how to change it.
Reffering specifically to: System Preference>Accounts>Short Name
It's not super important, but would be handier to have it displaying correct for networking.
If anyone can let me know how to change the short name, and any issues that may result from changing it, it would be great.
Thanks for any input

Hi baobhanjex!
Here is a direct link that usually works, to the utility ChangeShortName by Dan Frakes.
Read all of the instructions carefully, and proceed cautiously, as an improper change can result in unwanted results.
Such as;
Return to Default Desktop, Apparent "Loss" of Home Directory
Mac OS X 10.3 Help: My home folder and desktop are different than before
Also, here is a KB Article on How to change user short name or home directory name.
ali b

Can i recover my all active directory domain computers and users from IFM and in-cooperate them in new forest ??

My only Active Directory Server on win server 2008 R2 with one domain controller crashed today. The only backup that i had was IFM media.
So what i have done till now to recover it is a follow
I reintalled window server but this time it is winserver 2012. I added AD DS role to it. Promoted it to Domain Controller. (functionality level is 2008 R2)
On second server i installed win 2008 R2 and trying to add additional domain controller from IFM to recover all of my domain users,computers and GPO's. but i am getting this error
Could not replicate the directory partition CN=schema, CN= configuration, DC=XXX, DC=com from the remote domain
the naming context specified for this replication operation is invalid
i dont know weather my approach is correct or not
but my simple questions is
Can i recover my all domain computers and users from IFM and in-cooperate them in new forest ?? if yes how can i do that?? urgent help required.

yup exactly i created a new domain(in new forest) with same previous name in window server 2012 on SERVER-1. As ifm file that i had was generated from 2008 r2 so on second server i installed window 2008 r2 and tried to add role of additional domain controller
from ifm file on SERVER-2 using dcpromo /adv . every step went ok but in last step when it starts replicating domain controllers it poup following error
Could not replicate the directory partition CN=schema, CN= configuration, DC=XYZ, DC=com. . .
and roll backs every thing.

User Accounts Permissions Problem!

Hi,
Have a new MacBook here with 2 user accounts on it. Both users are administrators. I tried copying a folder of files from the User A's desktop into the Drop Box of User B. That went fine. But when I logged out of User A's account and into User B's, User B could open the folder and files but couldn't change/write to them.
So, I tried changing the permissions of User B's home folder, by clicking Get Info. User B's home folder AND enclosed items are now:
User A - Read & Write
User B - Read & Write
everyone - Read only
This solved the problem of modifying that folder and files that came from User A's account. However, now some new problems have emerged. For example, User B now can't trash widgets from their dashboard.
Have I done the wrong thing? What are you supposed to do so that BOTH users on the same computer automatically have the permission to read and write to files and folders they exchange with each other?

Open up a Terminal and type "ls -l /Users/" (without the quotation marks; the stroke means "ell" not "I" as in "I think, therefore I am"). The output should be a list containig a line similar to
drwx------+ 31 <your user name> staff 1054 17 Mai 08:54 <your user name>
The important part is "drwx------" at the beginning. It informs you that it's a directory (d) and that the owner has (r)ead-, (w)rite- and e(x)ecute-access (the last meaning that you can change to that directory in a terminal using the cd command). The following lines indicate that neither the group "staff" nor anyone else has rwx-access. To grant full access to everybody the line would have to read "drwxrwxrwx". To change permissions in the terminal you can use the command chmod (for syntax help type "man chmod"). Let me know if that solved your question.
floba
Message was edited by: floba

How to troubleshoot user account in Lion?

I am using MS Office 2011 for Mac. When I open documents on my MBP that are using the 'Review' feature it crashes Word instanteously. It happens all the time. I have installed all updates for Lion and for Office. The same documents work on my iMac that ise the same version of Lion and Office.
I have tried the following:
1) Completely uninstalling Office and then reinstalling it. No joy.
2) Resetting all permissions for the file system/files. No joy.
3) Removing all user preferences for the whole system and restarting with no user preferences. No joy.
4) Checked all fonts and removed any font that had an issue. No joy.
5) I have created a new user account on Lion and the document opens fine on the new user account. So, some joy but I want to avoid having to move everything else to this user account just because Office works only on the new user account. I would prefer to find the problem with my main user account.
What can I do to troubleshoot the user account so I can fix and correct the problem so that these word documents open?
Since the document opens fine on my other computer and on the test user account I don't think it is MS Office 2011 that is the problem but some other thing.
Thanks for any help you may be able to give me.
Regards,
Martin

There is no mention of Office or Word in the logs at all. I tried to delete the cache too but no joy.
I have deleted all of the prefernces and Microsoft User Data and also no joy.
It is not just this document, it happens to all documents that have used Track Changes. The document is on my desktop now but I have also tried it from my dropbox folder.
Really strange as it is hard to narrow down.
Do you have any experience in moving all data/apps/etc. from one user account to another? It seems like a clumsy way to fix this but if I can't get the issue to be resolved I might have to do this.
Thanks for your help....

How to unlock user account in Windows Server 2003

Hi,
I want to unlock a user account in Windows Server 2003.
I have read a great post at http://forums.sun.com/thread.jspa?threadID=716240&start=0&tstart=0
But I can not get it to work. According to the post the only thing you need to do is:
"+to unlock an account, just set the value of the attribute lockoutTime to zero+".
When I set lockoutTime to zero nothing happens. The user can still not logon.
When I read the lockoutTime attribute for an account that is locked it is empty or zero if I have tried to unlock it earlier.
So it doesn´t seem to change when the account is locked.
Thanks!

Hi,
Windows Server 2012 has come with the concept of Group Managed Service Account (gMSA).
Following are the benefits of gMSA,
- A single gMSA can be used on multiple hosts.
- A gMSA can be used for scheduled tasks.
- A gMSA can be used for IIS Application Pools, SQL 2012 etc.
Checkout the below link regarding complete information on gMSA (creation and usage),
http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx
Checkout the below thread on similar discussion,
http://social.technet.microsoft.com/Forums/en-US/5bc96d1b-0cec-4d0c-a99d-7f34509c0714/how-to-use-correctly-managed-service-account-in-windows-server-2012-?forum=winserverDS
Regards
Gopi
JiJi Technologies

Active Directory: how to return users account permissions RWDA?

Similar Messages

Maybe you are looking for