Add ldap user to Delegate Admin role programmatically

Dear all,
I have problem with
@Control
private DelegationRoleManagerControl roleControl;
roleControl.addUserToRole(EWPConstants.USER_DA_ROLE_NAME,username,ResourceContext.createResourceContext(getRequest(),false));
I used that control to add user to delegate admin role. It is working fine on admin server.
But after we deploy on managed server (stand-alone), we get this exception intermittently.
15 Sep 2009 12:59:40 [[ACTIVE] ExecuteThread: '1' for queue: 'weblogic.kernel.Default (self-tuning)'] ERROR ewp.control.pageflow.login.LoginController - login():
com.bea.p13n.entitlements.common.PolicyMgmtAccessException: Attempt to access Entitlement Policy Mgmt API by user in invalid role. Entitlement Policy operation attempted by disallowed user ["principals=[ewpwlpuser01]"].
at com.bea.p13n.entitlements.management.internal.SecurityHelper.isWLPAdminRole(SecurityHelper.java:881)
at com.bea.p13n.entitlements.management.internal.RolePolicyDelegate.roleExists(RolePolicyDelegate.java:387)
at com.bea.p13n.entitlements.management.internal.RDBMSRolePolicyManager.getGlobalRoleExpression(RDBMSRolePolicyManager.java:1702)
at com.bea.p13n.entitlements.management.internal.RDBMSRolePolicyManager.addGlobalRoleUser(RDBMSRolePolicyManager.java:1421)
at com.bea.p13n.entitlements.management.internal.RDBMSRolePolicyManager.addGlobalRoleUser(RDBMSRolePolicyManager.java:1388)
at com.bea.p13n.entitlements.management.RolePolicyManager.addGlobalRoleUser(RolePolicyManager.java:514)
at com.bea.p13n.delegation.management.internal.DelegationRolePolicyDelegate.addPredicatesToGlobalDARole(DelegationRolePolicyDelegate.java:614)
at com.bea.p13n.delegation.management.internal.DelegationRolePolicyDelegate.updateRole(DelegationRolePolicyDelegate.java:254)
at com.bea.p13n.delegation.management.DelegationRoleManager.updateRole(DelegationRoleManager.java:431)
at com.bea.p13n.delegation.management.DelegationRoleManager.updateRole(DelegationRoleManager.java:398)
at com.bea.portal.tools.da.controls.DelegationRoleManagerControlImpl.addUsersToRole(DelegationRoleManagerControlImpl.java:76)
at com.bea.portal.tools.da.controls.DelegationRoleManagerControlImpl.addUserToRole(DelegationRoleManagerControlImpl.java:223)
at com.bea.portal.tools.da.controls.DelegationRoleManagerControlBean.addUserToRole(DelegationRoleManagerControlBean.java:295)
at ewp.control.pageflow.login.LoginController.login(LoginController.java:126)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)

hi
it should work even if the managed server is not part of the cluster.
Again do you get this error randomly or can you replicate it?
Its possible that your Database / LDAP is out of sync. Can you access portal admin console and can you see if the default two visitor entitlements show and you dont get any error saying PortalSystemAdministrator is not valid?
Also you can just delete the managed server directory (under the domain/servers) it should recreate the LDAP (assuming admin server is running)
regards
deepak

Similar Messages

How to add/invite users to your admin console

I have read the FAQ regarding this but there is no option to invite users under the 'Admin Users' section as it states in the FAQ. I have WebBasics plan but it states I am allowed to have up to 3 users yet there is no way for me to invite these users. Also if I can not add any users is it possible to change my email for this account as I actually made the website for a client.

Hi,
The option should be located within the admin panel via Site settings -> admin users -> invite.
If you are not seeing this please provide the site so we can investigate.
Kind regards,
-Sidney

Can not add Domain User to Local Admin Group Win8.1

Hello,
I am trying to add a domain user to the local admin account on a Win8.1 Enterprise computer. When I click the check name button it asks me to enter network credentials even though I am signed in to the computer with a domain admin account. When I try to
type in any of my domain admin accounts it says "The Username or Password is incorrect". Even though I used that same account to login with. I can successfully ping all 3 of my DCs from the computer and have tried putting my second DC as the primary
DNS and my third DC as the primary DC and same problem. I have checked for Active Directory errors on the DC and everything says it is running fine on the DC in server manager. I have this problem on multiple computers. Some of the computers it will work on
but 90% of them it won't allow me to add the local user to the local admin group.
DCs are running Win Server 2008 R2 Enterprise.
Any help would be greatly appreciated.
Thank You

I would suggest you to use Restricted Group(via GPO) to add domain users/group to a local admins group
1)Create a new group in Active Driectory
Create a new group in Active Driectory that you wish to add to every workstations local administrator group. DO NOT add any users to this group at this time.
2.
Create a new GPO
Create a new group policy object and link it to the desired OU. Make sure that the GPO you are using covers the OU that the WORKSTATIONS you are wanting to give users local administrative rights over.
3.
Edit the newly created GPO
Navigate within the newly created GPO to Computer Configuration -> Policies -> Windows Settings -> Security Settings --> Restricted Groups
4.
Add your new Active Directory group to the Restricted Group
Right-click the Restricted Groups folder and select "Add Group" to add your new Active Directory group to the Restricted Group. In the Group field, type the name of the newly created Active Directory group and click "OK"
5.
Add the Restricted Group to the local administrator group
In the Restricted Group Properties windows click "Add" under the section titled "This group is a member of:" Type "Administrators" (without the quotes and yes it is plural), in the Group Membership window and click "OK"
6.
Wait for GPO updates to apply to the workstations
Once your users receive their updated group policy settings every workstation within the OU you specified will have your new Active Directory group as a member of the local administrators group. If you need to force the GPO update on a specific workstation,
run "gpupdate /force" in a command window on that workstation.
7.
Add a user or group of users to the Active Directory Restricted Group
When you are ready, or in a position where you need to provide local workstation admin rights you can simply add the users or group of users to the Active Directory group that you created for use with Restricted Groups within your Active Directory Management
Console.

Can't add new users in Server Admin console in Server 10.1.4.

I've run into an issue with an older OS X Server 10.1.4 running on a G4 platform. It functions as a shared file repository and I need to add new users. However, it would appear that I've developed a problem.
When trying to add new users I get the following error:
An error occurred in the Users & Groups module in entry point "RACMMenuItemSelected".
A program error has occurred.
1004
Now, my best guess is it's a corruption somewhere. But, I don't want to go poking around the production server taking it down and up until I've got some idea where I'm going. Any suggestions on where my troubles might be? Or has anyone had this issue before, and how was it corrected? (Hopefully not by a full software reload.)
I'd like to replace/upgrade this server, but until there's money in the budget, that's just a dream, I need to try to figure out how to fix what's here.
Help, please?
PowerBook G4 17 Mac OS X (10.3.9) 1.5G RAM

No answer was found for this issue. I've finally removed the server from production and will likely reformat and reinstall for use in other production areas. Hopefully we'll be upgrading the OS at the same time.

How java will identifies LDAP user groups to admin/normal users -BOXIi3.1

Hi all,
We have successfully implemented Java interface with BOXI3.1.Now our client wants to move to LDAP Configuration in CMC.
If we use LDAP configuration, is java login page will identify the user role(wether user is admin group/normal group).
we have used below API for enterprise authentication:
IEnterpriseSession enterpriseSession;
ISessionMgr sessionMgr = CrystalEnterprise.getSessionMgr();
enterpriseSession = sessionMgr.logon(userID, password, CMS, auth);
auth=<secEnterprise> is it enough to use auth=<secLDAP>
or do we need to add any code/API for this requirement.
Thanks,
Subash

Use secLDAP as the authentication type, and ensure both the CMS and your Java Web App Server machines can connect to the LDAP server.
Sincerely,
Ted Ueda

Adding a domain user to the admin role within the local user management breaks all metro apps for all users!!

Hi,
I have posted this in another large thread under the "Windows 8 General" group but have not had any appropriate feedback from MS.
After hours of testing and working with other users I have managed to isolate a simple situation that breaks all metro ui applications within Windows 8 for all users on the machine. Here are my exact steps and notes.
Before continuing if you are running Avast then your solution may be to turn of the behaviour shield functionality as this also breaks metro apps. This is NOT the problem we are having!
I have performed 3 cleans installs after isolating the problem and am able to reproduce the issue every time using the same steps on two different machines.
First thing to say is that for us it has nothing to do with simply joining the domain, domain/group policies nor does it appear to have anything to do with the software we installed, the problem here is much more simple but the result is pretty terrible.
Here are my exact steps of what I did to reproduce our problem:
Complete format of HDD in preperation for a clean install
Clean install performed
Set up the machine initially with a local account
Test metro apps - all working fine
Open control panel from the desktop, click on System, change the system to join the domain, click reboot
Log into the system using my domain account
Test metro apps - all working fine
Here's were the problem starts. I need my domain account to have admin rights on the local machine so I can install programs without the IT men having to come over and enter their password every 5 mins.
I go to control panel via the desktop and click on User Accounts. From with here I then click on "Manage User Accounts". This requires the IT guys to enter their details to give me access to such functionality. This is fine
In the dialog box that opens I can only see the local user that was initially created during setup. The "Group" for this local account shows as "Administrators" - Image included below (important to note that metro apps are working at this point)
I click add and then add my domain account - also giving it administrator access
Sign off or reboot to ensure the new security is applied
Sign back in to the domain account
Test metro - ALL BROKEN
Sign out
Sign in as local account
Test Metro - NOW ALL BROKEN FOR THIS USER ALSO
So as soon as I add my domain account to the local user accounts and set it as admin it breaks all metro apps for all users. This is on a totally clean install with nothing at all installed other than the OS.
Annoyingly if I go back and change the domain account to a standard user or if I totally remove the domain account from the local account management system the problem does not go away for either user. basically it is now permanently broken. The only fix I
could fathom was a full re install and not giving the domain user admin access to the local machine.
Screen one - this is the local user accounts window AFTER joining the domain and logging in with my domain account (All metro apps working at this point)
Screen 2: User accounts AFTER joining the domain and AFTER adding domain account to local user management (METRO BROKEN)
I have isolated my machine from all group policies so nothing like that is affecting me. Users I have spoken to in different companies have policies that automatically add users to the local user management. This means that metro apps break as
soon as they join the domain which leads them to wrongly think it is group policies causing the error. Once they isolate themselves from this they can reproduce following my steps.
Thanks

Hi Juke,
Thank you for the response and apologies for the delay in getting back to you. My machine was running a long task so I couldn't try your suggested solution.
I had already tried running the registry merge suggested at the top of the thread to no avail. I had not tried deleting the OLE key totally so I did that and the problem still exists. I will post all the errors I see in event viewer below. For
your info, since posting my initial comment I have sent out my steps to 7 different people and we can all reproduce the problem. This comes to 10 different machines (3 of them mine then the other guys) in 3 different businesses / domains. We see the same errors
in event viewer.
Under "Windows Logs" --> "Application" : I get two separate error events the first reads "Activation of app winstore_cw5n1h2txyewy!Windows.Store failed with error: The app didn't start. See the Microsoft-Windows-TWinUI/Operational log for additional
information." The second arrives in the log about 15 seconds after the first and reads "App winstore_cw5n1h2txyewy!Windows.Store did not launch within its allotted time."
Under "Windows Logs" --> "System" : I get one error that reads "The server Windows.Store did not register with DCOM within the required timeout."
Under "Applications And Services Logs" --> "Microsoft" --> "Windows" --> "Apps" --> "Microsoft-Windows-TWinUI/Operational" : I get one error that reads "Activation of the app winstore_cw5n1h2txyewy!Windows.Store for the
Windows.Launch contract failed with error: The app didn't start."
If you require any further information just let me know and I will provide as much as I can.
Thanks

How to Add Active Directory user to Admin Role

Hi All,
I am trying to figure out how to add a AD user to the Admin Role..
I am connected to AD and can see the user (myself), however, when I try to add myself to the admin role, it says user not found.
I go to Security Realms > myreals > Roles and Policies > Global Roles > Roles > Admin > View Role Condition.
I see that the Administrators Group is already added. Now I click "add Conditions" and select "User" from the Predicate List and type in the user " Doe' John".
On the next screen I get "user: John or Dow" does not exist.
Another option could be to add the user to the Administrator group, but I couldnt figure out how to do that as well. When I navigate to the user under Users or Groups, I dont see an option to add that user to the Administrator group.
Is it that you can only add users created in Weblogic to the Admin group?
Any help on this will be very appreciated.
Thanks in advance.

I think I got it. I had to add the AD group the user is part of to the Admin role.

Is it possible to add a user to a role at run-time?

basically I need to be able to add a user to a role programmatically before the role-based content is displayed to the user.
Example: I have a role called 'Manager' created in the portal. When a user logs on, I detect that the user has the attribute 'job title' = 'Manager' so I add the user to the 'Manager' role and the portal shows the content for the 'Manager' role.

Hi Umesh,
The assigning and unassigning of the users from the roles can be made dynamic using the IRole, IRoleFactory API's. The Blog below explains how users can be assigned or unassigned to a role programatically.
Restricting usage of iViews and Pages
Make some modifications to fit your requirement....
Hope this helps.
Regs,
jaga

COREid Administrator account cannot add other users

I'm brand new to this product (and to LDAP), so please bear with me...
After installing COREid, I cannot add new users using the admin account I established during installation. I get "You do not have sufficient access rights". I can perform other admin tasks, such as assigning "Master Identity Administrator" role to another existing user. I verified that my admin is also a "Master Identity Administrator". I'm using Sun One Directory Server as my back-end LDAP server. I also verified that the COREid admin account can add other users directly to the LDAP store through the Sun admin console.
Any suggestions would be greatly appreciated!
Thanks,
Andy

First create the workflow.
Go to "User Manager > Configuration > work Flow Definition"
- kpp

Is there any way to create admin role only for one resource.

Hi all,
I am trying to create an admin role with 'update user' capability. But I want to restrict the user(with the admin role) to be able to update a user's attribute only for one resource, The user(with the admin role) should not be able to update the attributes of the other resources which a user have.
Is there any way to create admin role only for one resource?
I customized the tabbed user form to show only one resource attribute (deleting the missing fields and adding my tab for the resource) and then assigned this new User Form to the user(with the admin role) in security tab.
It works fine. But the problem is that if any user(with the admin role) is also admin of some other resource then he/she will not be able to view the other resource attributes.
Please suggest,
thanks

The loop function always repeats the same region so of course the fade is also copied. So option+drag the original region to make a (non clone) copy, fade the first region and loop the second one (which you just copied).

Add new user action disabled sharepoint

I am not able to add new user as an admin user. If I add admin as site collection admin then only I am able to see new user add action in sharepoint groups and I can not do that. I
gave manage permissions rights but it does not allow to see new action in sharepoint groups.
MCTS Sharepoint 2010, MCAD dotnet, MCPDEA, SharePoint Lead

Hi,
According to your post, my understanding is that you have an issue about add use in a group.
Per my knowledge, when we add a user in the site collection administrator, the user would be assigned full control for the site.
Then he would see the add option in a group.
If you want to add a user as a site admin, we can assign him full control directly or add him to the site owner group.
What did you mean "am not able to add new user as an admin user. If I add admin as site collection admin then
only I am able to see new user add action in sharepoint groups and I can not do that."?
If the use is a site collection admin, he would get full control, and the add option would be display in the group.
It would be better if you can give us more information or screen print about this issue.
Thanks,
Jason
Forum Support
Please remember to mark the replies as answers if they
help and unmark them if they provide no help. If you have feedback for TechNet
Subscriber Support, contact [email protected]
Jason Guo
TechNet Community Support

Restricting administrator tab to user created with default role OIM 11g R2

Hi,
I have a query, if we create a user in OIM 11g R2 without any admin role and then login to Self Service screen (Identity) with the newly created user, we can see the Administration Tab is visible to the user.
Is this mean that by default user is having admin role assigned to him to do some of the admin activities.
Please let me know how to control this behavior and not to show the Administration tab to the user until and unless he is having some admin roles assigned to him.
Please help.

You can hide Administration tab for normal users using EL's. By default users will get this tab when they login to identity console even though admin role is not assigned to them. But if you do any operation on any users, request will be raised accordingly.
Check this link to configure EL's http://docs.oracle.com/cd/E27559_01/dev.1112/e27150/uicust.htm#autoId18

Assigning admin role with bulk action

Using IDM 6.0 SP1 on tomcat and oracle db
Using a csv file, I can update users with an admin role only if there are more than one admin roles (pipe delimited)
CSV Header Row:
Command,user,accounts[Lighthouse].adminRoles
CSV Line One:
Update,cramert,Administrator - Second Level Help Desk|Administrator - Security Desk|Administrator - Registration Authority
CSV Line Two:
Update,morrisom,Administrator - Registration Authority
The first update with multiple admin roles works - the second does not...
Thanks,
Mike K

Seems we have documentation on this one:
For a list with one value use:
|List|Administrator - First Level Help Desk
For Merging one value to a List:
|List;Merge|Administrator - First Level Help Desk
Thanks,
Mike K

Add UME Role to LDAP User

Hi,
i'm having a problem with portal user management. We have a LDAP user called charlie81 in an Active Directory Server, which has a set of LDAP groups. We have also a UME Role (a role created in the portal) called "Manutenzione". Our target is to assign "Manutenzione" to charlie81 through the portal. I made it but when charlie81 is logged in, he can see only LDAP Roles; "Manutenzione" is not visible!!!! How can i resolve this problems? Do you help me, please? Thank you in advance, Carlo Paglia

Hi,
What kind of role did you assign to the user? A portal role (source = portal role) or a "UME role" (source = UME database)?
If it's a portal role, is it a standard or a custom role? If it is a custom portal role, make sure an entry point is defined or your role won't be visible. Here's a link to the documentation : [Defining Entry Points|http://help.sap.com/saphelp_nw70ehp1/helpdata/en/4e/3e703e632c7937e10000000a114084/frameset.htm].
Regards,
Pierre

Cannot select ldap user profile for SGD Global Admin

Hi all,
I'm trying to select some ldap users to be in the SGD Global Administrators role, but I am unable to check the check box next to the user profile once I navigate to the account. There is no check box to check.
I am actively using LDAP for regular user auth and application assignment, so I know my LDAP "works" in that sense, I just can't use it to assign global admins.
Any thoughts?
Adam

The only way to do this is to create a user profile for the (would-be) admin account. And since they're an LDAP user, you'll have to use LDAP mirroring to do this. For example, let's say the user you want is "cn=Joe Admin, ou=Users, dc=example, dc=com"
Go to "User Profiles", and browse to/open:
dc=com
cd=example
create the directory object "ou=Users"
Inside of "ou=Users", create the user profile object "cn=Joe Admin"
Add this user object to the Global Administrators role.
http://docs.sun.com/source/820-4907/chapter3.html#d0e13589

Add ldap user to Delegate Admin role programmatically

Similar Messages

Maybe you are looking for