Blocking user access if employee is inactive

Hi All
We are planning to have HR-CRM integration, whereby employees will be downloaded in CRM as in BP Role='employee".
These employees will also have their user ids, which will enable their access to CRM application.
Now if an employee is terminated in HR (becomes inactive), then with the Idoc flow the BP Role="employee" is deleted from the employee BP in CRM.
I have observed that even if employee becomes inactive in HR and its BP Role="employee" is deleted from the BP in CRM, its SU01 user id (in CRM) remains active.
My question is that with the above mentioned trigger, how will the user id (SU01) of employee be blocked so that employee is unable to access the CRM application. What is the best practice around it ?
Any thoughts around this will be awarded with suitable points.
Thanks & Regards
Vishal

Thanks Ashish and Jushan for sparing your valuable time. However I think I could not communicate my query properly so let me rephrase it.
See, even I know how to block the SU01 user either by removing roles, making it inactive etc.
But my question is that what is the best practice around the communication process between the HR and CRM admins ?
"If an employee becomes inactive, then is it expected that HR team will communicate to CRM administrator thru mails etc. to block the CRM account ?"
I was assuming that in "ideal" scenario, if an employee becomes inactive in HR and its BP role="employee" gets deleted in CRM, then there should be some automated process to block the CRM user id so to restrict the employee access to CRM application.
However it does not happen presently. My question to the forum is that how have you guys have handled the process around it ?
Does HR guys put email to CRM admins to block the account ? Does HR has written some sort of actions/workflows to trigger mails to CRM admins to block the account? -OR- is there is some automated way to block the account immediately, once an employee becomes inactive in HR. -OR- any other process ?
Thanks & Regards
Vishal

Similar Messages

Blocked user accessing log in screen

Hello all
I have the EA4500 router with cisco connect cloud, must say this router is great for limiting kids online.
1 question I have however is the ability for a blocked user (internet access block) that is redirected to the cisco web site and presented with a log in screen. Is there anyway I can disable this becuase the kids stay up all night trying to figure out the password to log in, I just want it to say internet access blocked with no option for logging in for the blocked user.

This is could be how they designed that feature to work. I agree with jaymay
I believe that I can make it

Block user access to table

Hi,
may be an easy question, but have not managed to find an answer yet.
I have a table MYTABLE and I have a view MYVIEW.
MYVIEW is set up as:
create or replace force view MYVIEW
as select * from MYTABLE
Is it possible to restrict direct access to MYTABLE so that users cannot run a select * from MYTABLE, but they can view the results only if they run select * from MYVIEW?
Thanks very mucyh in advance

Did you actually grant select on myview to user1? User1 does not need to have any privileges on the base table to be able to select from it. Unless there is a synonym defined pointing to the view (either a private synonym in user1's schema or a public synonym) user1 will need to qualify the view name with the owner.
What are you doing differently than this?
SQL> select * from t;
        ID DESCR
         0 One
         0 Two
         0 Three
SQL> create view my_view as select * from t;
View created.
SQL> create user user1 identified by secret;
User created.
SQL> grant create session to user1;
Grant succeeded.
SQL> grant select on my_view to user1;
Grant succeeded.
SQL> connect user1/secret
Connected.
SQL> select * from ops$oracle.my_view;
        ID DESCR
         0 One
         0 Two
         0 Three
John

Service Desk User access

Hi Experts,
I want my service desk users login on Solman and they can update Msg status and ther remarks.
so what are auth. object needs on there profile, please suggest.
Can we block users access in such a way , they are not able to do add change on other users issue msg.
bcoz , if i give access on crm_dno_monitor to any user, he may access and process all issue tickets.
Thanks
Andrew

Andree,
Actually we provide variants for crm_dno_monitor.
so they have option of seeing only tickets belonging to themselves only
For e.g create a variant of crm_dno_monitor by choosing mine and then save it and create a ztcode in se93 for the same.
assign this tcode for the user menu to the respective role of the user.
So whn this user logs in and click on the link he sees only mine tickets or tickets belonging to him..he doesnt hav access to crm_dno_monitor.
Pls assign pts.

Win 8.1 domain workstation. Block all access, except for a fews users/groups and domain controller information/date.

Hi!
Win 8.1 pro, domain workstation. How Block all access, except for a fews users/groups and domain controller information/date.
Nuance:
From domain AD is locked Workstation Firewall "Domain profile" edit.
Possible?
cenubit

Hi GirtsR,
I am not sure the command to use the SID to accomplish what you want to achieve, if you only know the SID, you could take use Powershell to find the related information, more information, please check:
Working with SIDs
And a similar thread for reference:
How to find user/group known only SID
More reference: Default local groups.
Best regards
Michael Shao
TechNet Community Support

Block users from dba access

Hi all,
I am currently using a oracle 10.2.0.1.0. when i create user i want to block user from dba access how can i do that

connect test/test as sysdba;The problem isn't here with user/password, see below :
SQL> conn userdoesntexist/fake as sysdba
Connected.
SQL> show user
USER is "SYS"
SQL> conn / as sysdba
Connected.
SQL> show user
USER is "SYS"
SQL>As it already said above, the problem is with the usage of password file on the server connection. Try to disable this one.
Nicolas.

How can I block IMAP access to allow only 1 external IP and all LAN IP's

I have a PostFix/Dovecot Standard OSX server setup and functioning perfectly, but I need to make a pretty major tweak.
Here is some background : I have 1 network connection that connects to the LAN and provides connection to the email server over the local LAN. I also have a satellite office that has access to the email server offsite over the internet on a different network connection.
What I want to do is limit IMAP access to the server so they cannot access the email server from home, smartphone, or any other device. I only want them to be able to access their email from work.
So I have a long list of local IP's 192.168.56/23 and one External IP 1xx.x.x.x I want to make sure has access to send and receive mail.
I have been researching this and it looks like the config has to take place in dovecot since that is the imap server, but I am a novice at dovecot. I would love to just turn off the imap port from the firewall but that would block the satellite office and they would be unable to connect
Anybody out there able to lead me in the right direction?

I'd go out on a limb here and suggest that your best solution lies in setting up a VPN between the main and satellite offices. That way the remote office can share whatever resources you like in the main office without fear of opening services to unwanted users.
Failing that, your next best option is some kind of policy/access control at your firewall/router. This may range anywhere from trivial to next-to-impossible depending on the make/model of your firewall/router.
If your firewall/router can't do it then you could run a software firewall on your server, with access controls for the IPs you want to allow/block, but it's a poor option IMHO.
Unfortunately there's no support for this kind of thing in dovecot itself, which is why you need to look further up the network for solutions.
It's also worth mentioning that restricting dovecot access will do nothing for who can connect to your server to send mail. Dovecot is only concerned with end-user access to their mailboxes (e.g. IMAP) and has no bearing on who can submit messages to the server. For that you need to understand Postfix's configuration and access controls, but it's highly unlikely you want to restrict incoming SMTP to specific addresses only since that would prevent other domains' mail servers from sending you mail.

Multiple User Accessing the same record issue

I am planning to design an app where we have the following use case requirement.
If a user who is logged into the system is accessing a record(plan in this case) anyone else who is logged into the system at the same time should be locked out of that same plan but should still be able to access other plans in the system. A plan has many things associated with it so the 2nd user should be locked out of everything associated to the plan being accessed by the first user.
What is the best way to implement this at the application or the database level?
Here are some options we have been bouncing around.
1. When the first user logs in and accesses the first plan we lock the plan at the app level using a singleton class which has one and only one instance on the app server. The plan_id can be put as an entry into a hashtable which can be in the session and is created if one does not exist. When the 2nd user tries to access the same plan, since the plan_id is still in the hashtable he would be locked out. However we somehow need to timeout the first user after 30 mts of inactivity or so so that others can access the plan and are not locked out for ever if the first user walks away from his PC or does not close his browser, thus keeping his session alive indefinitely.
2. In the database in the plan table we add a column for 'locked'. When the first entry is created in the plan table locked column is marked as 'yes' or 1 and when the user closes the browser we use some javascript to trigger an event which changes that 'yes' or 1 to 'no' or 0 thus unlocking the plan. However the big issue we see in this concept is that we will have to put a javascript onUnload method in all jsp pages in the app because the user could be anywhere in the app after starting his plan access after login.
Conceptually the 2 options are the same but one is done at the app whereas the other is at the database level.
Is there a better way to handle this scenario using transactions or some other technological option.
Thanks

Another solution involving no modification of the database structure:
As soon as a user want to access a plan, try to UPDATE the plan record... if it fails, the record was locked
by another user before. When the user has finished with the plan, you can COMMIT or ROLLBACK the changes, which will free the lock for other users.
An advantage of this solution is that if program crashes unexpectedly, there will automatically be a ROLLBACK.
Of course, you need a transaction for this... and perhaps more if you want to separate the 'locking transaction' (virtual update just for restricting access) from the 'operating transaction' (in which you will
do the DB stuff: inserts, updates, deletes, etc.)
Hope this helped,
Regards.

Blocking internet access in a virtual windows xp box

Is there a way to block internet access when I have a virtual windows xp box within Windows 7?
The reason, is I just want to run one application and restrict internet access as I some users are restricted from the internet.
Thanks
John

Hi, Juke.
I'm afraid I'm a dummy, and don't know how to do this. I'm sure as April 8 approaches, a lot of people with important DOS or XP apps will be wanting to insulate their XP VM from potential hacking while still running programs locally.
Thanks -- Dave K.

I can access my employers web site, but when i try to access the employees section of the web site it says that i need netscape, can someone help

Hi, My employer has a web site & as a part of the service to the employees, the employees can access personal details through the web site. I can access my employers web site not a problem, BUT - when i try to access the employees part of the web site it tells me "This browser is not supported.
You must be running Netscape 7.1 or greater."
Can someone please help?

It is possible that the server gets confused by the user agent that is modified by your Ubuntu distribution and adds Ubuntu/10.10 (maverick)
Mozilla/5.0 (X11; U; Linux i686; en-AU; rv:1.9.2.13) Gecko/20101206 Ubuntu/10.10 (maverick) Firefox/3.6.13
You can try to reset the pref general.useragent.extra.* that add that part.<br />
See [[Web sites or add-ons incorrectly report incompatible browser]]

HR Auths - Manager has access to employee in OOSB but cannot access record

Hi,
I currently have a problem where a manager (M1) has the A012 relationship to an org unit (O1), however org unit (O2) reports (O1). Employees in org unit (O2) report to a supervisor who in turn reports to manager (M1).
I assumed that with structural authorisations in place the manager (M1) would have access to employees from O1 & O2 - however it seems that the manager can only view/access employees from O1 which is the org unit that the manager is part of.
If I take a look at the records that the manager can access via structural authorisations in OOSB, employees from both org units appear in the list. However when the manager attempts to create a leave record for any employee in O2 he gets an authorisation error.
I have ensured that the depth field for the structural authorisations is blank.
For object type O - I use eval path O-O-S-P and the function module RH_GET_ORG_ASSIGNMENT. For object type P - I use the eval path O-O-S-P and the function module RH_GET_MANAGER_ASSIGNMENT.
I have changed an employee from O2 to report to the manager (M1), but this still does not correct the problem.
Can anyone assist with this problem?
Thanks in advance
Sujeet

Hi,
Verify if the trace is showing authorization failure for other Objects like PLOG.
as this might require access to new HR Objects (with infotypes like 1001)pertaining to leave record creation.
verify 0105 entry exists for all the persons in context
Second thing is te evaluation path might not be the correct on in some cases.
For troubleshooting add the ALL PD profile and see if the user is able to perform the actions if he is then the problem is with the PD profile. if he is not able to do that even with that then the problem is with authorizations.
Hope this helps

Set sales employee as inactive

Hello,
in SAP BO you can add sales employee, but can not be erased. Number of buyers is growing - when you create a document (invoice, ...) list of sales employees becomes confusing. We would welcome the possibility of setting sales employee as INACTIVE. The documents would then be offered only to active sales employees.
Many thank.
Alexandra Herichová

Hi,
thank you very much for your comment. I would like to inform you we are currently working on de-activation of Sales Employee (S.E.) in B1, where option to define active / inactive S.E. will be available. Consequently inactive S.E. will be by default not visible in all relevant lists, however user will have an option to report all data for all existing S.E. due to backward compatibility.
Other areas are planned to be covered in a future as well. Please consider this as a potential Patch candidate and not as an SAP commitment.
In case of any questions, feel free to contact me.
Best Regards,
Martin Pavlinsky
B1 Product Definition

Block users from downloading from internet

I'm curious as to what everyone is using to block users from downloading certain file types (.exe, msi, zip, bat, etc) from the internet? We had websense, now barracuda for a web filter but have major issues with filtering downloads from the internet. The main issues is filtering SSL sites.

Hello,
The WSA has a feature called Object Filtering which allows admin's to configure access policy parameters to block certain file types from being downloaded through the WSA. To apply the same settings to HTTPS requests the WSA would need to decrypt the request.
I Hope this helps.
Best Regards,
Michael Hautekeete
Customer Support Engineer
Cisco Content Security - Web Security Appliance
http://www.cisco.com/en/US/products/ps11169/serv_group_home.html
https://supportforums.cisco.com/community/netpro/security/web
https://supportforums.cisco.com/community/feeds?community=2091

Multiple User access in ATP

I am designing custom ATP for our client. Actually, this logic accesses batch classification data and the calculation logic also differs.
The concern that I have is if one user (say A) creates a sales order item and runs a successful Availability check and goes on to create second sales order item. simultaneously if another user (say B) comes to create new sales order item for same material. now the ATP quantity that second user gets should be less than the quantity confirmed by user A. But both the sales order have not been saved. so how do I block the quantities confirmed by A but yet not saved.
Is there any special method for multiple user access at runtime.

Thanks for ur reply. it was really helpful to gain more insights in my issue.
1. For performance-related reasons, the only time when it makes sense to set the material block with quantity transfer is when it is common for several users to work on the same material simultaneously. And in VA01 there are many parallel Sales order creation
2.You create a sales order for a material. During the availability check, this material is blocked. After the availability check is completed, the block is removed. The quantity reserved for this transaction is recorded in the blocking table. This information can be assessed by all others who are working with this material. If you save the order, the blocked entries are cancelled. this how Material block with quantity transfer in SD works.
The concern that I have now is how to get Blocking Tables for transaction VA01.

WRT1900AC does not block internet access in Parental Control

Hi,My router does not block internet access on my other PC. I tryed "Always" tryed specific addresses, tryed IP addresses and everything tech support suggested. I even replaced the router at their advise. Nothing helped. I realize that the problem is not the router but probably my home network configuration, but I can't figure out what is it. To my defence, so couldn't they Does anybody have or had such a problem?Thank you

What Firmware version is currently loaded?Can you post screen shots of how you have the controls configured?Does the User Manual give any configuration help? Internet Service Provider and Modem Configurations
What ISP Service do you have? Cable or DSL?
What ISP Modem Mfr. and model # do you have? Router and Wired Configurations
Setup DHCP reserved IP addresses for all devices ON the router. This ensures each devices gets its own IP address when turned on and connected, eliminates IP address conflicts and helps in troubleshooting and maintain consistency for applications that need to connect as well as mapped drives.

Blocking user access if employee is inactive

Similar Messages

Maybe you are looking for