Assign a role automatically based on resources assigned to the user?OIM 11g

Hi,!
i have a request and this is:
in my scenario i have roles associated with access policies that assign resources .
i have resources assigned by a target reconciliation ... what i need is assign a role based on resources that the user has..
if the user has 4 resources added by a target reconciliation and these 4 resources make a role then the role has to be assigned automatically...
any idea?? this is possible?? thnx..

any idea?? ... this is possible??

Similar Messages

Can the license manager load the computer-based license first, instead of the user-based license?

We have several machines in the lab with computer-based licenses on them and a number of techs with user-based licenses. When a tech needs to occassionally sign in as themselves, instead of the generic service account, the license manager attaches the machine to their user account. Not a problem until they try logging in to LabVIEW from their own PC again and they get the 14 day trial period notice.
Is there a way to have the license manager look for the computer license first instead of the user license?
Thanks for any help.
Joe
Solved!
Go to Solution.

Hi Joe,
In the license file hosted on the license server, you may be able to manually change the "sort" tag in the file to modify the order in which VLM checks out licenses. Licenses are checked out in descending order (2, then 3, then 4, etc.). Typically, your license file is set up in a default order, but in special cases such as this, it may be beneficial to alter the order. To do this, follow these steps:
1. Open the license file with a text editor (such as Notepad)
2. Search for the "sort" tag. For instance, the "VLM_Core" entry will have a sort tag value will appear as "sort=first". Do not alter this value. VLM_Core should always be first.
3. Change the sort tag value for the named-computer license to a value that is lower than the sort tag value for the named-user license. (e.g. "sort=2" for named-computer and "sort=3" for named-user).
4. Save the file and reinstall the license.
Let me know if you have any questions!
Rick C.

Getting records based on date entered by the user

Gurus,
I have a valid to and valid from dates in ODS. The user is allowed to enter a date on the selection screen. If the user entered date lies in between Valid from and Valid to dates only these records need to be displayed in the report.
E.g.
ODS:
Valid From                   Valid to                       Functional Area
01/01/2009                  01/01/2099                             X
01/01/2010                  01/01/2011                             Y
01/01/2011                  01/01/2012                             Z
User Entered Date: 01/02/2010
Report Output:
X
Y
How do i do this? Appreciate your immedite assistance.
Thanks,
Ravi Ananthuni

Hi Ravi,
You can do this by using cust exit, but that would affect the query performance adversely.
I would suggest that you use condition in your report.
Include Valid to and valid from dates in your report layout. Make 2 replacement path type formula variables on these 2 dates.
And also the date you are entering in selection option, make it a formula variable ready for input.
Now make a CKF. In the calculation write: (user date > valid from)AND(user date <valid to)*1.
And apply a condition to show only those rows where this CKF is 1.
The replacement path variables will work only when you have those 2 dates in the report layout. If you don't wanna do that , you can make 2 date type KFs and use them directly in calculation.
I hope this helps.
Best Wishes,
Mayank

Resource assignment to Parallel activities

Hi,
this is regarding resource allocation to Parallel activities. I have two activities that occur in parallel 1. Preparing drawings for table, 2. Preparing drawings for Chari.
Now these activities occur on the same day (one day duration) and done by one single draft man.
I have assigned one draft man as a resource to both the activities. (Meaning one draft man will do both activities in one day), the problem is in the histogram it is showing two draft man as a required resource on this particular day.
Qstn: How to make P6 understand that this single resource will do both activities in one day (and still assign one draft man as resource to both the activities.)
Thanks in advance..
Regards,
Imad

You need to reduce the units (hours) by one half for each of them. If you currently have them for 8 hours/day and the resources limit is 8, it will show as needing two.

How to Setup User Folders Automatically when the user is being created

Hi All
I am setting up a new Windows Server 2012 R2 Standard Edition with Full/GUI install.
Q.1. Is there a way to create User Folders on Data Drive (D: Drive - OS is installed on C) automatically as I create Users?
Q.2. Additionally can these folders be assigned appropriate permissions automatically?
Q.3.What is the best approach If appropirate permissions are not assigned automatically. I have drive D: as a share with Full permissions to all. Is there a better way.
Thanks
Respectfully
Jamal

Hi,
Not sure you mean local computers or domain environment. In domain, we can create folder redirection GPO.
With this policy we can redirect folder to a shared folder or another local drive.
For your information:
Configuring Folder Redirection
http://technet.microsoft.com/library/cc786749.aspx
Security Recommendations for Folder Redirection
http://msdn.microsoft.com/en-us/library/cc736916(v=ws.10).aspx
Hope this helps.

Role nodes to be made invisible - As per User

Hi gurus,
I have created a role with many nodes and sub nodes in it. I want to display say node1, node2 and node3 for one user and node1, node3 for another user. Can I do it with the same role (Invisible in Navigational areas for that role would make it invisible for all the users).
Is there a way to use the same role and achieve the abovementioned goal.
rgds,
Sree

Yes, You can use PCD filter to achieve this. But this should be your last option as it effects the performance and not intutive for the administrator. You can achieve the same result with Merge ID. which will give you better performance and is easy to maintain.
Refer to
Filtering Role Content by User Attributes
For PCD filter.

AD Resource forest access with user from different forest

I am trying to access a AD resource forest using a user from a different forest.
The "different forest" is the main forest used to contain all user accounts etc. This domain is trusted by the resource forest (which contains things like outlook distribution lists etc) and so I am able to log into the resource forest (using ldp.exe or the mmc ad snap-ins) with my credentials from the main forest.
How can I replicate this in java?
I can connect directly to the user forest with simple authentication. But I can't do the same with the resource forest (as the user does not exist on it - it is merely trusted). Is there an authentication method that will allow me to do this?
In this organisation user accounts for the resource forest are not given out - you have to use one from the main user forest. So I have to find a work-around where I can connect with my current credentials.
Any ideas anyone?

Devid,
I am facing the same problem.
Did you get the solutions.
I am getting exception while calling "InitialDirContext"
"Problem searching directory: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece"

CProjects-MS Project - import and export of task-role-resource assignment

Hi,
We are on PPM5.0
We are currently working on cProjects-MSP client integration.
What we have not been able to configure for import/export so far is:
1. Task-Role-Resource assignment
Whereas we are are able to import/export the "Person Responsible" and "Role Responsible" fields, we have not been able to align the task-role-resource assignments.
We see a "Resource Name" column (Standard) in MSP. When we click on the drop down, we see all the roles from the cProjects project. But the alignment does not happen.
Summary:
On export and import, we need to automatically see the role-resource-task assignment. How is this possible?
2. Code field to "VC_BUPA_GUID" gets a number which is not the BP ID.
Is it possible to import the BP numbers in MSP. Also, how can we assign a number to the role in MSP such that on import into cProjects, the role is already staffed with the corresponding BP.
3. Is it possible to export all the resources (BPs) into a drop down in MSP - like we see the Project Type, Role Type etc.
Thanks.

Hi Anuradha,
Thanks for your inputs.
When we export to MSP, we see the cProjects roles under the "Resource Name" drop down in MSP.
However, they are only seen when we expand on the drop down.
For e.g. RoleA, and RoleB are two roles in cProjects project, along with many other roles.
Both of these roles are assigned to a task, say TASK1.
When exported to MSP, we expect both of these roles to show against TASKI, as "RoleA, RoleB" under the "Resource Name" column. However, these roles are not seen. They only appear as elements of drop down, along with all other roles in the project, when we explicitly click on the drop down.
Please let me know if I are missing out on something.
Thanks.

Automatic assignment of Support Team based on processor

We have a help desk team creating Service Desk messages directly into SOLMAN (not from satellite system) using transaction NOTIF_CREATE and assigning processor. After they save the message, they open the message again in transaction CRM_DNO_MONITOR and change the Support Team manually based on the processor's Support Team. They are requesting if
the assignment of Support Team can be done automatically based on the processor assigned during creation of message and
when processor is changed/re-assigned after message has already been created.
I've read some suggestions in the blogs and forums that partner determination can be done by creating your own BADI.
So I've created a new BADI "Z_FIND_TEAM" (copied from BADI CRM_DNO_PARTNER_1) and commented the logic which derives the support team based on the rule in transaction PFAC, and replace this with my own logic of getting the processor's Support Team. Then I assign this to the action. When I tested the action during creation of message (NOTIFCREATE), the action failed to get the support team because the CRM documents (where I'm getting the processor) is not created yet at the time that the BADI is executed.
I also tested the same action (but I didn't schedule it to run automatically) during changing of message (in CRM_DNO_MONITOR). The action successfully assign the correct Support Team when I already saved the new processor before choosing the action.
But if I change the processor and do not save first before choosing the action, the support team of the old processor is assigned.
In both cases, I need to get the value of the processor in the screen and pass this to the BADI.
Can anyone help me how to pass the screen value of processor to the BADI.
Or do you have other suggestions on how I can automatically assign the Suport Team based on processor.
Thanks in Advance.
Regards,
Tess

Hi Ragu.
Thanks for your quick response.
I've already tried assigning some standard access sequence in the support team's partner determination although the assignment of the support team always returns with the BP of the top organization unit in our org chart that's why I tried using the BADI afterwards.
Our org chart is defined something like :
IMS Support Team org unit
      Help Desk org unit
           Person 1
      Functional Team org unit
           Person 2
      Technical Team org unit
           Person 3
I've tried access sequence like "Organizational Data: Employee for an Org. Unit" and "Organizational Data: Organizational Unit for a User", but when I test this the support team is always defaulted with the "IMS Support Team's" BP Number (the top org unit).
I'm not sure which access sequence I can use to assign the support team, for example, processor = "person3", the support team should be "Technical Team".
Or do I need to create my own access sequence?
I'm not familiar with these access sequence and not really sure how it works.
Thanks.
Tess

Assign roles automatically when user gets created

Hello,
I want to know if there is a way to assign basic roles to all the users in the system when they get created in the back end as well in the portal.
Thanks in advance.

Hi Rahul,
There is no such way to assign automatically basic role to all users. You can go for tool sugested by Alex.
And also you can check one solution if this works for you that we have used in Past and proposed by business. In that if the Basic role is like end user role and needed for all portal users. Then you can create on Template users (Type dialog) . Then you can create the new users by copying the template user.

Assigning the role automatically when a user is created.

Hi all,
we are usign the EP 7.0 eph1 sp6 . we have a requirement that:
When we are creating a new user and click save, then a user is created and to that user automatically a role should get assigned (without manual assignment of role to user). the role will have the framework page etc.
and suppose we are assigning some role to the same user the above assigned automatic role should be deassigned automatically again.
is there any possible way.
Please help.
regards,
kavitha

Hi
When we are creating a new user and click save, then a user is created and to that user automatically a role should get assigned (without manual assignment of role to user). the role will have the framework page etc.
for the above one we can follow the simple process ,
as u need 2 assign the role automatically while creating the user it self, u have to do the following.
In user Adminstartion we have a button called Copy To New User.
u just slect a user already created and just click on the button above, the new user which is going to be created will get all the credntails and roles groups ,everything as the previous one.
Just have a try .
Sandeep

Approval work flow for Role based and Resource based

Hi All,
We have to implement approval work flow for the following things in OIM 9.1.0.1
Approval work flow for Functional Roles (Groups in OIM) (Approvalsrequired for users to get these roles)
IT Roles (Resources in OIM) (Approvalsrequired for users to get these resource)
Functional Role (Group) contains policy1,polici2. Polciy1 contains res1,res2 and Policy2 contain res3,res4.I want to create approval work flow for this Functional Role to achieve the following
User raise a request for the functional role, then it should wait to get manager approval. then once its gets approval, that user account should create on all resources which are involved in that group.
And, I have to define approoval work flow for all individual resources to get users account creation on target with approvals. These resources may include in the groups as well.
After getting approval for functional role (Group), then Will OIM starts the approval flow for all resources involved in the group? becase, all resources have approval workflow at resource level also.
My Goal: Approval work flow for Group, should not process the approval work flow for resource. can we do it in OIM 9.1.0.1?
And can we do the same in OIM 11g also?
Please help me and do let me know, if you need any information from my end.
Thanks.

Thats configurable buddy ! ! And possible in 10G and 11G both versions.
Functional Roles : These are the groups/roles in OIM 10g/11g with access policies attached at the backend.
- Create a dummy resource and name it Request Role or anything as you like. Attach an Object Form to it and have form field for Role Name, this would be a lookup type field linked to all OIM groups (leave system values using lookup query). So a user can select any OIM Group in this request as per configuration. Have approval workflows defined on this dummy resource Request Role and in its Provisioning Process make user/s a part of the requested group.
- Now once the user is made a part of the group, the associated access policy would be invoked automatically and thereby provisioning. The only thing you need to keep in mind is that create the access policy without approval (there is a check box). If you do this the approvals would never be invoked even if you assign a group manually to the user coz it suppresses all the approvals in this access policy.
IT Roles : These would be linked to the resource and you can define individual approvals on the resources as required.These approvals would be required if someone raises a request for these resources individually.
Thanks
Sunny

Resource Assignment in WMS-TRM

Can anyone please let me know how I can define the user profiles and equipment profiles in SAP WMS We have a decentralized WMS that we are implementiing . Can any one please let me know how I can define the user profiles and aalso the equipemtn profiles. Ability to skip tasks and task groups.
Thanks

Hi James,
Let me explain what I understood:
1/ In your operational project, you have role-task assignments.
2/ You assign a resource to the role
--> You would like the system to automatically assign the resource to the task (and not do it manually). Am I right?
First, I would precise that it's not mandatory to assign the resource to the task in order to see the task in the worklist. The role assignment is enough.
Then, if you still want to assign the resource automatically, you can use the BADI dpr_events, with a filter on "resource assigned". You can then simulate the entity link between the concrete role (assigned resource) and the task.
Matthias

Assigning database roles on SQL Server db

I am trying to set up a SQL Server adapter (not a database table adapter for SQL tables) to manage role assignment on a database 'test1' on my sql server ( 2000) 'sqlserver1' using IdM 7.1. I am trying to assign role1 to user tuser1 on test1. I am using 'sa' account so permissions should not be an issue.
Per resource reference document, I mapped:
userNametest1 <-> userNametest1
rolestest1 <-> rolestest1
My login for user 'tuser1' gets created on the SQL server. However the database and role assignment is not happening. I do not get any errors in the IdM admin pages from where I am testing this. Hence I am assuming I am not setting something right in the resource schema. I have tried different ways such as
userNametest1 <->userName
rolestest1 <-> roles
and some more combination but none seem to work. How can i find out what my resource attribute mapping should be? If anyone has done this, can you please share how you got it work?
Thanks in advance.

Some more info.
I have set up the out of the box MS SQL server adapter to connect to MSDE version of SQL server running on my local machine. I used the MSSQLServer Form provided in the samples folder and assigned it to an admin user and turned on the trace.
I am able to create logins by assigning the resource to a user. Using the admin user I am able to see in the trace that the server Roles are also being retrieved fine. What I am not able to get is assigning a database to the user and then assigning db roles.
Following the documentation (Resource Reference guide for IdM 7.1) I have created following attributes on the left hand side of schema.
defaultDB,serverRoles,domain, userNameMyTestDb,rolesMyTestDb.
No matter what I map the last two attribute I am not able to assign a db and dbroles to a user. I turned on sql profiler and then again used the admin user to view a test user using MSSqlServer form and it appears that the procedure sp_databases is not being called at all. I have decompiled the sql server class file and it appears there might be an issue with the way list of databases is being retrieved.
Has any one seen this before? If you were able to get it to work, can you please give me information on the resource schema and any other settings you had to make to get it to work?
Thanks in advance.

Track changes on indirect assignment of roles to users

Hi Experts,
We have been facing an issue where users have roles assigned indirectly(position/job/org unit).
I have checked the relationship between position/org unit and job to find if there are any roles assigned to these position(HRP 1001).
To my surprise there are no roles assigned to any of the position,org unit or job.
Our production system is linked with CUA(Solman) and role assignment is selected as Global.
I have checked both the systems and couldn't find any roles assigned to the position/org unit/job.
These roles are assigned to the users in the year 2005?
I would like to know
1.) How these roles got assigned to the system? Any logs are there to track it down?
2.) either we have to change the CUA setting to local and to run the RHAUTUPD_NEW in production system?
or to run the report RHAUTUPD_NEW in CUA system? am i following the right approach?
Kindly advise and let us know suggestions on this?
Thanks a lot in advance for your help.

Julius,
What change log says about these role assignments?
I think ,Having the system in part of CUA (SCUM setting :role assignment global) and maintaining postion based role assignment is contradictory.
So better to detach the system and perform PFUD(comparison type :HR org mgmet) to make the role assignments up to date and connect it back .
Thanks,krishna

Assign a role automatically based on resources assigned to the user?OIM 11g

Similar Messages

Maybe you are looking for