Automatic deassigning of users/company when aapplication group is deleted

Hi everyone
As per my requirement, Application is created in OIM as resource object.
A group will be created with the same name as the application created.
Through permitted resources option,application is added to the company.If a user belongs to that company,he will be automatically given provision to that application.
Through group member ship ,a user will be assigned to the group and access policy will be triggered which in turn provision user to few application roles(i. e entitlements of the group) present in LDAP.
Application role is a normal group in LDAP. they are the entitlements of the application group.
If the application role is removed in LDAP, then how to automatically de assign the application role to the user/company ?
Does OIM provides this functionality ? or what is the procedure ?
Could any one pls help me to resolve the issue.
Regards,
divya

I would create a scheduled task for this process. I would perform the following tasks in it after you remove the role from the access policy
Attributes:
Group Name=Company
Resource Object=Object XYZ
Remove Role=Role ABCD
1. Find all users who are a member of the group
2. Get all objects for that user with the name Object XYZ
3. Get the process instance key and then get the child table details
4. Find the entry that matches Role ABCD and remove the child table entry
This will trigger the removal of that entry from the child table and cleanup when you remove roles from access policies.
You could even create a proivisioning workflow of organization type and create a process for removing roles using all the code above if you think you are going to be doing this often.
-Kevin

Similar Messages

IPhone6 is not sending or receiving texts from non-Apple users, except when in Group texts. I've tried the various fixes on the main support page to no avail. Any ideas?

iPhone6 is not sending or receiving texts from non-Apple users, except when in Group texts. I've tried the various fixes on the main support page to no avail. Any ideas?

Have you contacted your carrier to make sure there's no issues with your account?
~Lyssa

How to disable the previously entered user ID's that automatically appear. For example ; when logging into email , first letter of user ID promts the previously used email user IDs... Want to disable this feature---How can ot be done ?

Question
How to disable the previously entered user ID's that automatically appear. For example ; when logging into email , first letter of user ID prompts the previously used email user IDs... Want to disable this feature---How can it be done ?

*Click the (empty) input field on the web page to open the drop down list
*Highlight an entry in the drop down list
*Press the Delete key (on Mac: Shift+Delete) to remove it.
*http://kb.mozillazine.org/Deleting_autocomplete_entries
* Tools > Options > Security: Passwords: "Saved Passwords" > "Show Passwords"
* Tools > Options > Privacy > History: "Remember search and form history"
* https://support.mozilla.com/kb/Remembering+passwords
* https://support.mozilla.com/kb/Form+autocomplete

Automatically create a profile page when user registers?

Hi everyone,
I am building a site along with other people and I am the main web designer. I need to know how to have my site automatically create a users profile page when the said user registers on the site. Something very similar to YouTube or MySpace. Example: If a user where to create an account with the username bob678 the site/code would automatically create and directory called examplesite.com/userid/bob678 (like I said before very similar to YouTube). I cant seem to find the answer to this anywhere but I know it is possible. Any and all help is very appreciated!
PS. I already know how to allow people to register, I just need it to create a page for them.
Thanks

If you want to actually create a physical directory, then you would call your server side scripting's file system functions. FWIW, many of the site's you've seen probably do not use physical directories. In many cases, the data is saved in a database and the server uses the rewrite engine to make the location more human readable.

I want to ask company when user update to ios7 it stuck all of device and not clearly about apple id to active how to solve it or just keep all of device into recycle because can not use?

i want to ask company when user update to ios7 it stuck all of device and not clearly about apple id to active how to solve it or just keep all of device into recycle because can not use?

You need to enter the Apple ID and password that was used to set up/activate the phone. There is no way around this.

HT201250 Will the automatic backups backup the entire disk (even other user accounts), when I'm not logged into those accounts?

Will the automatic backups backup the entire disk (even other user accounts), when I'm not logged into those accounts?
I want to be assured that my back up is working completely. What if my MacBookPro auto-logs off my account during the backup due to no activity? Or, is the backup considered activity and it won't log off?
What about the Energy saving options - will they affect the backup ?

FOTO123456 wrote:
Will the automatic backups backup the entire disk (even other user accounts), when I'm not logged into those accounts?
Assuming you mean via Time Machine, yup. It backs up your entire system, including all user accounts (unless you specifically exclude things).
What if my MacBookPro auto-logs off my account during the backup due to no activity? Or, is the backup considered activity and it won't log off?
I've never tried it, but the backups run as the "root" user, so will probably continue. If they don't, it's not a problem, as the next backup will "catch up" with all changes.
What about the Energy saving options - will they affect the backup ?
Not really. If you have the Mac set to shut down at a particular time, that will of course interrupt a backup if one is running. But again, the next backup will catch up.

Script to logout users from a specific group, when queries are long

Hi,
I have a requirement that users from a specific group need to be logged out, when they are running queries for more than say 20 mins.
I could get the list of users from that group and could get the list of active sessions on the application, but I get too many info there like connection IP request state etc. and if I spool it to a file, output is not very easy to format to select what's required, rather I have to write lot of shell scripting to format the file.
So my question here is to know if there's a MAXL script or any other method through which I can just get only couple of columns from the "display session on application <app name>" that I require for my work like username, session ID, DB connect time, and request time.
Thanks!!

There are a number of ways to accomplish this, but AFAIK none of them is straightforward like writing a script to accomplish the task.
This could be accomplished quite readily with the Essbase API.
Unfortunately, when Maxl outputs tabular data such as what comes out after DISPLAY SESSION ALL; - it comes out as all one big string with lots of spaces.
So to parse that output you would need to use a language that can tokenize the text into a collection and parse that for the users.
Then you need to do the same sort of thing after running DISPLAY USER IN GROUP ALL; (or instead of all, use a specific group name);
Then run ALTER SYSTEM LOGOUT SESSION BY USER <parsed_username>;
What would be ideal (hello Oracle... <wink> ) is a MAXL command ALTER SYSTEM LOGOUT SESSION BY GROUP <GroupName>;
The way I would approach this would be to write a little utility that does exaclty what you seek:
- Scan the current session periodically (say, once every 5 mins)
- for each user that belongs to group(s) <group>(<group>...)
- if user has an open query running longer than n minutes, kill the user request.
This way you're not kicking people, your just taking back resources. Of course you can be more aggressive and code it to kick the user by forcefully ending (invalidating) his session too.
I can give you a hand with this offline if you want.
Robb

WS2012r2 - Cross-forest trust - Can add groups to user but when I open it again, groups are not listed

Hello Everyone,
I hope you can help me resolve this issue, I'm missing something but I don't know what.
I have 2 ws2012r2 domain controllers, each one with it's own forest (Lets call them A.com and B.com).
I have a validated 2 way external trust relationship between those domains.
I've added the domain admin "B\Administrator" to the DL group "A\Administrators", so I have permissions to modify everything on A.com
From "Active Directory Users and Computers" on B.com, I can see all users and "Domain Local" groups of A.com
From "Active Directory Users and Computers" on A.com, I can see all users and "Domain Local" groups of B.com
What I need: Add users from B.com to DL groups in A.com using the "B\Administrator" account
The problem: I'm able to open a user from B.com, add a DL group from A.com, click Apply, then OK.
But if I open the user again and go to the "Member of" tab, the group is no longer listed there.
If I go to the A.com domain and open the DL group membership tab, I can see the user from B.com listed there.
So there's something wrong, cause even If the user is listed in the group in A.com, It's not assigning the right permissions when trying to access the resources that group grants access to.
Any ideas what did I do wrong ot forget to do?
Thanks!

Hi,
Have you tried to take a force replication or refresh and then check the membership? Please verify DNS is well configured and we got a GC in both sides of the two forests.
In addition, please take a look at the below link:
Understanding the Global Catalog
Hope that may help
Best regards
Michael
If you have any feedback on our support, please click
here.
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Automatic email with logon details when user creation

Hi,
Does any one can through some light on sending automatic emails with logon details when the users created with SU01? I know we have lot of tools like GRC, Approva we can do but I would like to know any thing within SAP not with any external tools.
Thanks,
Venkat

Quick and easy way without any development:
a) Create a variant for report RSUSR100N to search for created user IDs where the creator was not equal to the expected "false positive" ones.
b) Save a dynamic date and time calculation for the variant.
c) Define a mail distribution list for the spool request if there is one ...
d) Schedule the variant periodically as per the dynamic date and time period.
e) Check that SCOT is configured to send the mail or SMS.
f) Wait for the mail to be sent (this step might take some time...)
Cheers,
Julius

Shared Calendars / Room Lists and automatically forcing them to users based on Security Group Membership

Good morning all,
I need some help achieving the following in our Exchange 2013 Environment. First off, we have Exchange 2013, but all our clients have Outlook 2010.
Here's what I would like to be able to do:
1) create/manage public calendars / rooms in exchange 2013
2) force these shared public calendars / rooms to users' calendars who are members of particular security groups
3) give edit permissions / "booking" permissions for the shared calendars so select users are able to make changes to the shared calendars, as well as accept/deny requests to "book" shared room calendars
Any one got any resources they can give to point me in the right direction?
I have already created two mailbox room resources, and have them set up in a room list in AD. But need to know the above as far as creating a shared calendar for events, and forcing these calendars / room lists out to users based on security group
membership.
I don't want my users to have to know how to add a shared calendar...that would be a nightmare explaining. I just want it to show up.
Any help on this is greatly appreciated, thank you!

1) I recommend using Room Mailboxes for resource calendars because it just works better.
2) This is a standard feature of a Room Mailbox.
3) You're pretty specific here, but I think this is also more or less available with a Room Mailbox combined with folder rights.
I don't know any way to just make them "show up". You'll have to teach them. Well written instructions can work wonders.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Firefox 3.5.1 on WinXP automatically switches to "Work Offline" when a connection to the internet drops. User must un-click "Work Offline" for it to work once a connection has been restored. Why?

Firefox 3.5.1 on WinXP automatically switches to "Work Offline" when a connection to the internet drops. This was not the case with earlier versions. Why is this necessary? Is there an option/preference setting to change this?

# Yes, if you go to accounts.firefox.org, sign out, you will now be signed out.
# Sign back in, and you will be asked to save the password you entered.
# This will save the password and autocomplete if you have this option turned on.
I am not exactly sure why the menu did not detect the password change or if it was stored incorrectly after you changed it? But after storing the correct password you can manage any duplicate passwords in the password manager.[[Password manager - Remember, delete and change saved passwords in Firefox]]

Self-registration user assigned to anonymous group auto

hi experts,
how can i make the user self-registration user belong to anonymous group,not everyone group
best regards
zlf

Normally self registered users automatically assigned to everyone group. If client needs they should automatically assign to someother group , it is the only possibility in my point.
Ulitimately when modifying standard groups, this consultant should think about it whether modification really needed ?
It is just an idea
Koti Reddy
Edited by: Koti Reddy Chimalamarri on Feb 8, 2009 12:03 PM

Unable to push user profiles to AD groups with Profile Manager since upgrade to Server v3

Since upgrading our OS X Mac server from 10.8.5 to 10.9.1, and OS X Server app to v3 (now 3.0.2) I have been unable to push or modify user profiles to AD groups (or AD users) using Profile Manager. This was working fine on OS X 10.8.5. Pushing device profiles is still working OK after the upgrade.
From what I can see from the logs on the client side and server side, it seems related to a problem with the mdm authtoken.
In the client console I can see this entry:
27/01/14 14:30:15.844 mdmclient[38557]: *** ERROR *** [Agent:636102071] Unable to proceed with connection to: https://ourserver.ourdomain/devicemanagement/api/device/mdm_connect (com.apple.mdmconfig.mdm) because don't have valid MDM AuthToken
On the server, in the php.log I can see the corresponding attempt to authenticate:
1::Jan 27 14:29:50.930 [158] <192.168.28.171> {require_once (mdm_checkin.php:11)} vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv - PUT mdm_checkin
0::Jan 27 14:29:50.931 [158] <192.168.28.171> checkin: 'UserAuthenticate'
1::Jan 27 14:29:50.936 [158] <192.168.28.171> {Target_for_incoming_request (target.php:209)} Found target NETWORK LS: <User[156]@ourclientmachine>
0::Jan 27 14:29:50.937 [158] <192.168.28.171> {LabSession_validate_auth_token (mdm_checkin.php:22)} Failed auth for target NETWORK LS: <User[156]@Device[1697]>, incoming_request={
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'MessageType'=>'UserAuthenticate',
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'UDID'=>'17aff5c5a40f51acbbd78023d0028c80',
0::Jan 27 14:29:50.937 [158] <192.168.28.171>   'UserID'=>'A5EA25B7-7CCD-4EF4-B240-F23DED275EEC'
0::Jan 27 14:29:50.937 [158] <192.168.28.171> }
1::Jan 27 14:29:50.965 [158] <192.168.28.171> {SendFinalOutput (mdm_checkin.php:145)} Sent Final Output (407 bytes)
1::Jan 27 14:29:50.965 [158] <192.168.28.171> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ - /devicemanagement/mdm/mdm_checkin
0::Jan 27 14:29:50.965 [158] <192.168.28.171> {SendFinalOutput (mdm_checkin.php:145)} Completed in 34ms | 200 OK [https://ourserver.ourdomain/devicemanagement/api/device/mdm_checkin]
So I can see there is a failure to authenticate, but don't really know how to troubleshoot this further. Or maybe this is just a bug in the new server app?
I have tried to remove and re-enroll clients in Profile Manager but no joy there.
In the client's Keychain I can see an MDM user AuthToken linked to the correct user account.
Thanks in advance for any help or suggestions

I just wanted to update my post, as this issue for me is resolved.
I uninstalled and reinstalled the Server.app on our Mac server, since then I've been able to push profiles to AD Users and Groups. I guess that in my case the Server app got into a bit of a mess when it was upgraded to v3.
Now the next headache I have is that my AD Groups which are displayed in Profile Manager are not syncing any recent changes. I think I'm probably seeing the same issue as described in this post
https://discussions.apple.com/message/25420919#25420919

How to grant new user permission when the acct is created from application?

Our application team will randomly create users in DB. But the new user need to have the permission of "execute on DBMS_SNAPSHOT, DBMS_STAT, DBMS_SYSTEM" being granted from sys. We need to grant it automatically after the user is created. I was thinking about using DDL "create" trigger or just DDL database trigger. Once the trigger is fired off, issue the grant statement. We can capture the create even for the user, but got error when running the grant in the trigger or from the procedure called by trigger. My guess is that the "grant" is a DDL and DDL trigger cannot start another DDL statement. I also think about put the insert trigger on the sys.user$. But oracle would not let trigger being created on the sys tables or views.
What can we do now? The other option, I am wondering if there is a system package that can call external program (like Unix shell script) from the DDL trigger, to let the shell script do the grant, since this may not be considered as the same execution tree. Do we have such package to call from database to the UNIX shell script? Or for such need, do we have any other option?
Thanks for help!
Edited by: user5973955 on Oct 6, 2010 3:51 PM

The application teams do not have the sys permission. If the application has privileges to CREATE USER, it can then issue GRANT
Change the privileges.
But they want this being resolved from DBA.DBA did NOT make this problem.
The flawed application created the problem.
Alternatively CREATE PROCEDURE that can issue GRANT & have application call this new procedure.

How to implement a single user in mutiple AD groups?

Hi all,
I need your help in achieving the following requirement.
1. Security should be applied based on a DeptName from DeptTable For example Department Name= A , Department Name =B, Department Name =C.
2. Also security should be based on Officer Indicator from EmployeeTable= Yes or No.
3. Employee Salary information is grouped into EmpFacts in presentation folder. Only a few users who belong to the group which has access to the folder, should be able to see this folder when they login.
(DeptAOfficerYesEmpFactYesSuper. All the groups which has EmpFactYes are given permissions to EmpFact Folder in presentation Folder)
4. On top of these all the users are classified into Mega and Super users. Mega users should have read only access to dashboards and Super users should be able to edit the dashboards. ( All the groups which are classified as Super are given access to "Edit Dashboard" in Presentation Catalog )
NOTE: As we are deploying our rpd in the shared environment we are not supposed to use SESSION VARIABLES.
TO achieve the above requirement we have created AD groups such that DeptAOfficerYesEmpFactYesSuper , DeptAOfficerNoEmpFactNoSuper and so on. By this method all the permutation and combinations will result in AD groups.
We know that this approach will lead to severe maintenance issues and hence looking for other alternatives.
We are now planning to have only DeptA, DeptB, DeptC groups and use them in conjunction with three other groups ( Officer, EmpFact, Super).
Can we add a single user in all these user groups ?
Kindly let me know if you need any clairty on this.
Your help is highly appreciated.
Edited by: user10682075 on May 11, 2011 7:24 PM

Yes and no..meaning a user with just 1 group assigned will retrieve less data then a user with multiple groups assigned, so yes, more data to select will affecct your performace (a bit), but no, the use of multiple security groups by itself won't affect performance..
The use of multiple security groups will reflect in the use of an IN or a subquery in your logical query, OBI will determine the best way in each case and your database (and statistics) will determine the best physical query and therefore query performance.
M.

Automatic deassigning of users/company when aapplication group is deleted

Similar Messages

Maybe you are looking for