Authenticate against AD then Internal Store with same username?
I know this sounds easy at first glance but I am having a nightmare of a time finding a way to get this to work. Our engineers were used to OUR old ACS 3.2 method where an account was either authenticated against the internal user store or Wwindows AD and would like to duplicate this functionality with the our new ACS 5.3 setup. I fully realize that the two models are not even close to being similar between those two versions but I am being asked anyway.
Here is the crux of the issue. If you have a jsmith account in the internal user store with one password, and also a jsmith in AD with a different password then the system cannot seem to handle different accounts with same name when it comes to passwords.
I have an internal store sequence setup to authenticate against AD then the local data store. The problem is that if the user puts the password of the internal store user the ACS server sees that the user exists in AD but that password was incorrect and authentication fails.
Bottom line is that I need some kind of logic that says try to authenticate against AD first with this username and password, and if that fails instead of ending there try to authenticate to the internal store using the given username and password.
Appreciate any help on this.
Jagdeep,
I thought ACS 5.3 allowed you to use the internal database but point the password authentication to AD? However if the user isnt found then we can point to AD by using a identity sequence store?
Similar Messages
-
Get the Common from Two Internal Tables with same structure
Hi ,
I need to get the Common data from Two Internal Tables with same structure with using the looping method.
For e.g.
I have two internal table say ITAB1 and ITAB2.
ITAB1 has values A,B,C,D,E,F
ITAB2 has values A,H,B,Y,O
Output at runtime should be : A,BHi mohit,
1. If u want to compare all fields,
for matching purpose,
then we can do like this.
2.
report abc.
data : a like t001 occurs 0 with header line.
data : b like t001 occurs 0 with header line.
loop at a.
LOOP AT B.
IF A = B.
WRITE :/ 'SAME'.
ENDIF.
endloop.
ENDLOOP.
regards,
amit m. -
Workaround to adding two e-mail alias accounts with same username.
I have two e-mail addresses (aliases) (for example [email protected] and [email protected]) running under one (same) username "jimmy" and the same password on the same mail server (basically one e-mail account with two e-mail address aliases). I wanted to have both added to my iPad running iOS 5. I added the first without a problem, but when I tried to add the second one, the iPad complained that an account with the username "jimmy" already exists and gave me a prompt window with two options, "Cancel" and "Edit". Cancel was supposed to cancel the whole e-mail account creating procedure and take me back to Settings/Mail, and "Edit" was supposed to take me back to editing this e-mail account so I could change it (select another username). It turned out that both "Cancel" and "Edit" threw me out of the editing procedure and put me back into Settings/Mail. Seems like a bug.
I managed to use a workaround to add my second e-mail address account (alias) to the iPad 2 with the same account username. I started creating the second account and filled in all the information but I intentionally mystyped the username as "jimmo". Now when I tapped "Done" the iPad wanted to verify the account (as normal) but soon warned me that either the username or password were incorrect and that the account may not work correctly, but it did allow me to add it. I then went in and edited this second account and changed it's incoming mail server username to "jimmy".
Now I have both e-mail addresses (aliases) using one account correctly set-up. Just thought I'd write this in case anyone would encounter the same problem/bug.EDIT: When using Mail application to check e-mails I am getting sporadic "Cannot Get Mail: The user name or password for "<name_of_account> is incorrect." The password is correct and it works when I retry. If I disable one of the accounts in the Settings/Mail (set to Inactive) then the other one (using the same password on the same server) works without hiccups. They definitely have to work on this bug and fix it.
-
Logging into a previously working website with same username and password
I am now unable to log into a previously used website for work after I cleared safari's history and website data. I am using the same username and password as previously performed before it was cleared. I am able to log in on my desktop at work using the same username and password. How do I fix?
Although LiveCycle will allow you to create two users with the same user ID (each in different domains) it is not recommended for the reson you are experiencing. The domain is not used in the authentication, LiveCycle attempts to authenticate with the first user id it locates that matches the supplied user id.
In your example, The first instance of "user1" that LiveCycle is finding happens to be part of "Domain1", this is why SecuredDoc1.pdf can be opened and SecuredDoc2.pdf can't be opened (the user1 that is a member of the policy applied to the second document is not the user that has been authenticated).
You need to keep all user ids unique.
Regards
Steve -
Server 2012 - Can't access external website from internal domain with same name. Tried everything.
Hello All.
I have read loads of forums and tried numerous fixes and configurations, but nothing seems to work and I am extremely frustrated at this point.
I have a client where I setup Server 2012 Standard with Exchange 2013. After reading best practice documentation for DNS naming and reasons not to use ".LOCAL" I opted to use ".com.na" in which case the Internal Domain Name and Internet
Website now has the same name.
When attempting to open the extarnal website eg. "www.company.com.na" from a client PC within the internal "company.com.na" Domain, I keep getting error "403 - Forbidden: Access is denied. You do not have permission to view this
directory or page using the credentials that you supplied."
I should also mention, the website is hosted by an ISP and not locally.
I added a "www" Host record in the Forward Lookup Zone, I have added the url and ip address to the Hosts file on a client pc (Windows 7) and even tried setting up Split-Brains DNS. Nothing seems to work.
Running a Tracert takes me to the correct public ip address of the website, but I keep getting this 403 error.
I am so sick and tired of this issue that iI am at the point of backing up the Exchange and re-rolling the entire server with the ".local" DNS domain name. I have a mirror setup in a VMWare environment and simply using "rendom" to rename
the domain seems to cause new issues with Exchange connectivity.
Any pointers and help will be greatly appreciated.
Thanks in advance.
Hentie LootsI opted to use ".com.na" in which case the Internal Domain Name and Internet Website
now has the same name.
This ends up with a split-DNS stup for internal and external resolution which requires extra administration tasks and attention from the administrators.
When attempting to open the extarnal website eg. "www.company.com.na" from a client PC within the internal "company.com.na" Domain, I keep getting error "403 - Forbidden: Access is denied. You do not have permission to view
this directory or page using the credentials that you supplied."
I should also mention, the website is hosted by an ISP and not locally.
I added a "www" Host record in the Forward Lookup Zone, I have added the url and ip address to the Hosts file on a client pc (Windows 7) and even tried setting up Split-Brains DNS. Nothing seems to work.
Running a Tracert takes me to the correct public ip address of the website, but I keep getting this 403 error.
This means that you are able to reach the Website but it is responding with the access denied error message. That should be checked on the middleware level so if this is IIS running then I would recommend asking them in IIS forum: http://forums.iis.net/
If this is a Website that is completely managed by your ISP then I would recommend checking with them.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile -
Mitigation runs against role but not user with same role assignment
Hello, I'm currently running Compliance Calibrator 4.0. I've created a Mitigation Control and assigned a number of Risks to the Mitigation Control.
I've then assigned the Risks in that Mitigation Control to a specific role.
When I run the SoD check, the role no longer shows any issues. This is good and expected.
However, when I run the SoD against a user that has that role assigned the user is reported with issues when no SoD issues should be shown.
Am I missing something? I don't believe I need to assign Mitigation Control to the user, because one day the risk might be valid to that user, but just not for the role I'm trying to mitigate against. Many thanks.Hi Dylan, the system is reacting correctly.
When you mitigate a role, you mitigate the risk associated with the role and under 'Role Analysis' you will see that this role has been mitigated.
However when u run a User analysis, the system will still identify him if there is a 'RISK' associated with the user and this is regardless of whether the associated Role is mitigated or not because what you want to know is the risk of the user and not what roles this user has.
You will need to specifically mitigate the User in order for the mitigation control to show against the User in the report.
This is the same Vice Versa. when you mitigate a User, it also does not mean that all the associated Roles that the user have are mitigated. The risk associated with the roles will still appear when you do 'Role Analysis'
Cheers! -
Internal table with same variable and one select query
Hi,
I am a new bee here with may be a silly question.
I have a internal table as below.
DATA: BEGIN OF IT_ORDERDETAILS OCCURS 0,
VBELN LIKE VBAK-VBELN, "Order number
BSTNK LIKE VBAK-BSTNK, "customer PO
ERDAT LIKE VBAK-ERDAT, " Order created date
MATNR LIKE VBAP-MATNR, "Sales order line item
KWMENG LIKE VBAP-KWMENG, "Quantity
D_VBELN like likp-vbeln, " delivery no
POSNR like lips-posnr, " delivery item
KUNNR LIKE LIKP-KUNNR, "ship quantity
END OF IT_ORDERDETAILS.
Where VBELN field is in VBAK and LIKP table.
VBELN in VBAK table = order #
VBELN in LIKP table is = Delivery #
I want to use join to fetch data in single select query.
Below is the select query
SELECT VBAK~VBELN
VBAK~BSTNK
VBAK~ERDAT
VBAP~MATNR
VBAP~KWMENG
likp~vbeln
lips~posnr
LIPS~VGBEL
INTO (IT_ORDERDETAILSvbak, IT_ORDERDETAILSbstnk, IT_ORDERDETAILSerdat, IT_ORDERDETAILSmatnr, IT_ORDERDETAILSkwmeng, IT_ORDERDETAILSd_vbeln,IT_ORDERDETAILSposnr, IT_ORDERDETAILSkunnr)
FROM VBAK left outer JOIN VBAP ON ( VBAKVBELN = VBAPVBELN )
left outer JOIN LIPS ON ( VBAKVBELN = LIPSVGBEL )
join LIKP on ( LIPSVBELN = LIKPVBELN )
WHERE VBAK~ERDAT IN CR_DATE.
I am getting error in the query.
Please suggest.
Thanks,
RajeshHi rajesh.nayakbola,
although this is not quite the right place for this, let me give you some notes:
1. Code should be
formatted as code
by markin it with mouse and use above <> button.
2. Internal tables shoult not be declared using OCCURS clause - this is last century style
3. Internal tables do not need and should not have a header line, they should use TYPES for declaration
4. Data should not be declared using LIKE: If they refer to dictionary TYPES, use TYPE. LIKE is only mandatory for data objects declared in your program, i.e. DATA IT_some_ORDERDETAILS like IT_ORDERDETAILS.
5. If you get an error here, never write "I am getting error" but copy and paste the error message fully.
- The fields in brackets in the INTO clause never have ~ character, there is no IT_ORDERDETAILS~vbak, only IT_ORDERDETAILS-vbeln
It could be something like this:
TYPES:
BEGIN OF TY_ORDERDETAILS,
VBELN TYPE VBAK-VBELN, "Order number
BSTNK TYPE VBAK-BSTNK, "customer PO
ERDAT TYPE VBAK-ERDAT, " Order created date
MATNR TYPE VBAP-MATNR, "Sales order line item
KWMENG TYPE VBAP-KWMENG, "Quantity
D_VBELN TYPE likp-vbeln, " delivery no
POSNR TYPE lips-posnr, " delivery item
KUNNR TYPE LIKP-KUNNR, "ship quantity
END OF TY_ORDERDETAILS.
DATA:
IT_ORDERDETAILS TYPE TABLE OF TY_ORDERDETAILS.
SELECT VBAK~VBELN
VBAK~BSTNK
VBAK~ERDAT
VBAP~MATNR
VBAP~KWMENG
likp~vbeln AS D_VBELN
lips~posnr
LIKP~KUNNR
INTO CORRSPONDING FIELDS OF TABLE IT_ORDERDETAILS
FROM VBAK left outer JOIN VBAP ON ( VBAK~VBELN = VBAP~VBELN )
left outer JOIN LIPS ON ( VBAK~VBELN = LIPS~VGBEL )
join LIKP on ( LIPS~VBELN = LIKP~VBELN )
WHERE VBAK~ERDAT IN CR_DATE.
Regards,
Clemens -
Syntax for internal tables with same structure
Hi,
I would like to knwo what is the syntax to declare a table that has the same structure as the exisiting one?
Say for example:
Begin of it_tab,
Data (1000) type c,
End of it_tab.
Now I would like to declare IT_Tab2 with the structure of it_tab, how should I do that? Thanks!HI Anyi,
DATA <itab> TYPE|LIKE <tabkind> OF <linetype> WITH <key>
[INITIAL SIZE <n>]
[WITH HEADER LINE].
Regards,
Laxmi. -
Multiple LDAPS with same username!
Hi,
we have a case where we need to connect to multiple LDAP servers and configure SPNego for Kerberos authentication of portal. we have a problem in case of user names. some user names are same in both LDAPs. LDAPs are portal are positioned as (Landscape convension)
LDAP1: xxxx.yyyy
LDAP2: ssss.yyyy
Portal : pppp.gggg.yyyy
where as gggg.yyyy is a trusted domain for both xxxx.yyyy and ssss.yyyy.
we have login problem in same user case. (same user exist in xxxx.yyyy and ssss.yyyy). I haven't gone into details yet like logs and all troubleshooting stuff. Before doing all this just want to know your views whether I can do this or not. If I can achieve any suggentions how to proceed further?
Regards
RavindraHi,
Kerberose (Spnego) is possible with multiple ADS data sources. Check SAP Note 1007227 and the below link.
http://help.sap.com/saphelp_nw70/helpdata/en/45/40a320773a7527e10000000a114a6b/content.htm
Regards
Deb -
Internal order with excise problem
Dear All
W have internal order budgeting for consumables.whenever we make purchase order , the account assignment category is f and we purcahse against the particular internal order.
when G/R is done the consumable material gets cosnumed against the particular interla order. ie goods receipt and the issue against the internal order with same movement type.
here is the problem
Whenevere G/R is made the part 1 register(country india version) gets updated .
But because of goods issue against internal order , the part 1 register shows both the receipt and the issue . so whenever the excise invoice is made through j1iex thesystem shows that part 1 entry is not vailable.
In the part 1 register printout shows the receipt and the removal of goods.
as per the excise regulations the part 1 entry sholud be there for the particular material. please suggest how to avoid the removal entry in part 1 register. only receipt has to be updated in the part 1 not the removal ie goods issue.
please suggest how to overcome this issue.
With Regards
balajiWhat is G/R?
-
Can anyone help me? I cannot sign in my iChat. I've been using iChat with same username and password with my Gmail account. Now, I cannot sign in my iChat, but I can still sign in my Gmail with the same username and password. Can someone advise me what to do?
Hi,
I am beginning to see more threads that suggest that something may be up with the Google Servers.
In iChat Menu > Preferences > Accounts > Server settings tab try changing the port to 443 (With SSL still selected)
It may be that in a couple of days the Google Servers will get back in sync.
10:25 PM Wednesday; June 29, 2011
Please, if posting Logs, do not post any Log info after the line "Binary Images for iChat"
G4/1GhzDual MDD (Leopard 10.5.8)
MacBookPro 2Gb( 10.6.8)
Mac OS X (10.6.7),
"Limit the Logs to the Bits above Binary Images." No, Seriously -
Each time I start Firefox it says:
"URGENT! Your version of Firefox is no longer protected against online attacks. Get the upgrade - it’s fast and free!"
I am using ver. 3.6.13 and upgrading "successfully" only stays on 3.6.13 with same URGENT message.Your UserAgent string in Firefox is messed up and needs to be reset. <br />
[http://en.wikipedia.org/wiki/User_Agent]
type '''about:config''' in the URL bar and hit Enter <br />
''If you see the warning, you can confirm that you want to access that page.'' <br />
Filter ='''general.useragent.''' <br />
Right-click the preferences that are '''bold''', one line at a time, and select ''' ''Reset'' ''', <br />
Then restart Firefox -
2 different tables in the main window with same internal table data
Hi All,
can we have 2 diffterent tables with same internal table data into its work area in the main window.Is it possible or we will get any run time error.?
is it like having 2 nested loop with same internal table ?
ex : loop at itab1 into wa_itab.
loop at itab1 into wa_itab.
endloop.
endloop.
can we use like this?Hi,
there will not be any error ...but what is the use of it...
do you need to have a controlled way of display ...of the data...
If so then you create another workarea in the global definitions of the same type and then use it...
Regards,
Ram -
APP store indicates 1 update. Press "store", "loading" briefly on screen then white screen with updates bar on top. Press updates button in lower right; nothing happens frozen with white screen and still indication 1 update. Other store features and ipod work ok
Try:
- Reset the iOS device. Nothing will be lost
Reset iOS device: Hold down the On/Off button and the Home button at the same time for at
least ten seconds, until the Apple logo appears.
- Go to Settings>iTunes and App Stores and sign ut and sign back in
- Reset all settings
Go to Settings > General > Reset and tap Reset All Settings.
All your preferences and settings are reset. Information (such as contacts and calendars) and media (such as songs and videos) aren’t affected.
- Restore from backup. See:
iOS: How to back up
- Restore to factory settings/new iOS device.
If still problem, make an appointment at the Genius Bar of an Apple store since it appears you have a hardware problem.
Apple Retail Store - Genius Bar
Also see:
https://discussions.apple.com/thread/4751197?tstart=0 -
I have a iphone 5 and I can login with my apple id to purchase music. However, when I try to login into icloud using the very same username and password that I use in the apple store it does not work to enter icloud, so what what gives???
I could do that, however when I select the icloud button (or whatever the heck it is) I am asked to enter the apple id and password. So if you are suppose to create another one for icloud you'd think it would give you the option at this point which would be logical.
Maybe you are looking for
-
Hello, We have an intranet platform with 8000 users on SharePoint 2007. We currently have issues every day around 9am or 8:30am : The intranet is not responding (white page loading during minutes) until we kill a process in SQL that is blocking every
-
Hello all, we are using GRC AC 10.0 (SP14). Today I found out that the access removal for multiple user is not working. The role removal for one User is working fine. But for multiple user who all have the same role it is not possible to select this
-
Need to change the Tag name of Response Tag.
Hello, While creating the Wsdl in eclipes, in which,I put operation name is (*PX_GET_INSTPRD*) Then automatically get its elements for input= (*PX_GET_INSTPRD*) and for output (*PX_GET_INSTPRDResponse*). I change the output element to PX_GET_INSTPRD_
-
Question: Can I use my imac G5 as a second display for my imac coreduo? Or perhaps could I use my ibook as a second display for my imac???
-
No .java file found in the target directory of JSP compilation
There are only .class files. Where are those .java files? I am using WL5.1 SP7.