"Controls" on locking G/L accounts

Hi Gurus,
In standard delivered system there is no control in checking the account determination tables when a user locks a G/L account. For example if an authorized user locks a P+L account; no warning gets issued by system that the account is being used in MM account determination tables (i.e. OBYC). So in this scenario, if the user doesn't do a "manual" check; he/she won't be aware that by locking a G/L some materials management processes are impacted.
My question is if there are customer Exit or BADI available to check the account determination tables when a user locking a G/L account. If not then what are some of the best practices surrounding locking or changing G/L either at Chart or Company Code level.
Thank you very much for your inputs.

Hi Cyrus,
This is a manual check.
However, if any GL is assigned for automatic account determination, then it should be marked for automatic posting only in the GL master, company code section.. so you can have this check, that if any GL is marked for automatic posting only, that need not be blocked.
Regards,
Kavita

Similar Messages

Locking Schema Owner account in oracle

Hi
One of the oracle security policy recommendations is to lock the owning schema in the database. To overcome this issue I suggested to the developer that I can create a new access account with permissions to select ,insert,delete and update data on owning schema. But the developer is insisting that instead of creating that new account, should transfer the objects of the schema owner account to a new account and unlock the schema owner account this way he does not have to make changes to the application on his side...this did not make sense to me ,can some one please shed some light on this?

>
sorry , I meant that when we lock the schema owner ,connecting to the database with that account is denied. What I suggested is to create an access account with SUID priviliges on owning schema data. But the developer insists that I create a new account transfer the objects/data from schema owner to this new account and then unlock the schema owner account. This way he will not have to make changes on the application side,I was not entirely sure how it will benefit him by doing so
>
You still haven't stated what the actual issue is you are trying to address.
From the first post is seemed that your question was 'How can we implement the Oracle security recommendation to lock the application account without actually locking the application account'?
And your proposed solution is to create another account with exactly the same privileges as the schema owner and use that account instead.
That doesn't implement the recommendation. That is an attempt to circumvent the recommendation.
My advice is that if you don't want to actually implement Oracle's recommendation then don't implement it.
And if you do want to implement the recommendation then do so. But none of the options you are suggesting implement it they only circumvent it.
>
One of the oracle security policy recommendations is to lock the owning schema in the database
>
What is the citation for this statement? What reason was given for the recommendation?
One primary reason for using application users (rather than schema users) is to exert positive control over the functionality and data that the application has access to.
A schema owner has access to all objects owned by the schema. Applications typically don't need all of those privileges. A schema owner can create new objects and modify existing objects; applications seldom need to be able to do that.
Within a stored procedure a schema owner still has access to all of the schemas objects but other users/applications only have access granted directly to them and do not have access to objects granted only thru roles.
To properly implement the recommendation you need to create an application user and grant that user the roles and direct grants that are needed for the functionality and data that needs to be accessed. The result is two users: one has full access to the schema objects and the other has limited access. Application code should use the limited user credentials.
What you call the users is up to you. If you want to switch roles and make your current user the limited user and create a new user for the objects and move them all to the new schema go ahead.
But that is a lot of work and validation for you to have to do. The only change a developer should have to make to use a different user is to change the connection information. That should be very simple to do and if it is not it needs to be changed to make it simple.
Based only on the information you have provided it sounds like the developer is just lazy and wants you to have to do all of the work. So the developer needs to make their case as to why they can't just change connection settings and then management can make a decision about which method should be used.
Your work should be to create a new application account that specifically is NOT simply an account superuser but is only granted, either directly or via roles, the specific privileges that the application actually needs. My guess would be that no one actually knows or has documented what privileges are really needed so they just want them all.
The best contribution you could make for security is to resist the super user approach and actuallly push for documentation of the privileges needed and then implement those.
Management and auditors must ALWAYS be able to control and determine who is actually using their data.
I would suggest that you create a new user account account

When using HDMI to HDMI cable the Master Sound Control is locked.

master sound control is locked when using HDMI to HDMI using an HDTV for the display.
Although itunes sound control works. Why is the Master Control locked?

cpfamilia wrote:
Hello,
I am new to OS X and i have tried to adjust the sound when plugged to the secondary monitor through HDMI which of course didn't work.
I have been using windows and a linux for years now, and everything works seamless.
I believe that this could be easily solved by Apple as long as their are willing to do it. Having a virtual device for sound control is not that difficult.
All the bests
There are two ways to 'solve' this.
Alter the volume before sending the digital signal down the HDMI connection, this means the signal is no longer exactly as it was originally. Apple's current (apparent) view is that this should be done at the end i.e. playback device not at the originating (Mac) end so as to minimise the number of devices making changes to the signal. Basically 'volume' is the amplitude of a an analogue wave form. (Where else do you think the term 'amp' comes from.)
Not to alter the volume of the signal at the Mac end but instead to send a signal down the HDMI cable to tell the end i.e. playback device to alter the volume, this uses a standard called CEC (Consumer Electronics Control), unfortunately at the moment no Macs support this standard - it has to be supported at a hardware level so a simple Apple software upgrade to implement this is not possible. I have previously logged an official enhancement request for this with Apple - the more people who do this the more likely it is to be added, since now all Macs include HDMI it might happen at some point.
As an addendum to option 2 above, see http://www.pulse-eight.com/store/products/104-usb-hdmi-cec-adapter.aspx this would however require software support in whatever application is being used. XBMC for Mac does support it.

How to find out who is locking my database account ?

Hi,
Which dynamic view can help me to find out who is locking my database account ?
Thanks

Yoav wrote:
Hi,
Which dynamic view can help me to find out who is locking my database account ?
Thanksdoes account have PROFILE?
if so, repeated failed logons can result in locked account.
enable AUDIT to see from where logins originate.

I cannot use a website I need to use, with Firefox 5.0. So, I need to uninstall and go back to 3.5 or 3.6. Please advise. Also, my control panel locks up since Windows Explorer has pbms. Which is why I am using Firefox instead. Thanks for any help!

I cannot use a website I need to use, with Firefox 5.0. So, I need to uninstall and go back to 3.5 or 3.6. Please advise. Also, my control panel locks up since Windows Explorer has pbms. Which is why I am using Firefox instead. Thanks for any help!

''I figured it was going to be FAFSA causing your problem.''
Install Portable Firefox 3.6.x to your hard drive for that one website. It won't affect your current Firefox installation at all. <br />
http://portableapps.com/apps/internet/firefox_portable/localization#legacy36

Lock a GL account from use

Is there a way to lock a GL account from use by certain users? Or is there a way to prevent certain GL accounts from being used in certain documents. For example, prevent posting to a cash account when raising a A/R credit memo for a service.
Thanks for your help!

I'm thinking you could potentially do it with the TransactionNotification stored procedure.
Depending on the formatting of your procedure, something along the lines of...
If @object_type = AR Invoice AND (@transaction_type= Add)
Begin
If exists (select docentry from INV1 where INV1.AcctCode IN (Locked GL's) and docentry = @list_of_cols_val_tab_del)
Begin
Select @Error = 1, @error_message = 'The selected GL is locked'
End
End

How to lock the AD Account through OIM

Hi.
I am provisioning AD through OIM 11g using the AD Connector. I have done the create user, modified user provisioning through OIM in AD successfully without any issue.
I would like to lock the OIM account and also lock the respective target accounts when OIM account is locked.
I have done the following task to lock the account in OIM and also in AD through OIM. They are
Process Definition Task
I have created the Change Account Status task in process definition.
This task will populate the OIM Account lock status value to the AD Account is Locked out field in the ADUSER form using the OIM API. The same API is working for all First Name, Last Name etc modification without any issue.
Lookup Definition
I have added the following entry in the Lookup.USR_PROCESS_TRIGGERS Lookup Definition
Code Key : USR_LOCKED and Decode : Change Account Status
OIM Admin Console
I have logged into the OIM admin Console as a Administrator and I have search the user and click the Lock Account button. The OIM Account is locked , but target resource account was not locked and also Change Account Status task was not triggered by OIM.
Do i need to do any special configuration for account lock for the target resource.
Help is greatly appreciated.

In your System Configuration variables, find the value for "XLUserResource.ProvisionMode". Make sure this is set to Java and not DB.
>
This property determines whether provisioning of the Xellerate User resource to the user's organization occurs in the database layer through stored procedure, or in the Java layer via Event Handlers.
Note: See Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for information about Event Handlers.
This property has the following allowed values:
DB: Provisioning of the Xellerate User resource to the user's organization occurs in the database layer through stored procedure. This in turn does not trigger any further process. Therefore, custom tasks associated with the Xellerate User provisioning process that is associated with the Xellerate User resource does take place.
Java: Provisioning of the Xellerate User resource to the user's organization occurs in the database layer via Event Handlers. Custom tasks associated with the Xellerate User provisioning process that is associated with the Xellerate User resource takes place. This is applicable to the upgrade scenario, where you have your own tasks associated with provisioning processes in earlier releases of Oracle Identity Manager, and you want them to run even after 11g upgrade. In such scenario, set the value of this property value to JAVA.
>
-Kevin

Multiple controlling area with same chart account

Hi Experts,
can we consolidate multiple controlling area with same chart account in SAP BI?
for example, if in R3 I have 4 Controlling Areas with the same chart of accounts, I can get an standard BW reports summarizing them.

Hi
Chart of accounts i.e. 0CHRT_ACCTS is an attribute of Controlling area. This means each Controlling area will have it's own chart of accounts. This chart of accounts could be similar in terms of content values. So it is possible to consolidate and produce a report which provides a summary of the chart of accounts.
Cheers
Umesh

Prevent locking of Administrator account

Hello,
We'd like to expose our portal to the internet. This means everyone will be able to logon to the portal (after creating an UME user account). UME is configured to lock user accounts after 3 invalid login attempts.
Now how can we prevent anonymous internet users to lock the Administrator account or other system accounts like ADSUser?
The first option would be to implement this on the revert proxy, e.g. block requests containing j_user=Administrator either in the URL during a GET request or in the body during a POST request.
However, because of performance reasons, especially because of the need to scan all POST requests, this option doesn't look very attractive.
A second option would be to deploy a new JAAS LoginModule, configured to be always executed as the first one, that checks the username first and halts the login process if the username is Administrator and the request is coming from a certain IP (the reversed proxy), e.g. by throwing a RuntimeException in the login method (will that work? any other possibility besides throwing a RuntimeException?).
This doesn't look as very clean solution either.
What would be the best (safe, clean, easy) way to stop anonymous users from locking the Administrator user account?
Thanks!
Sigiswald

At the end we decided to write a custom LoginModule anyway.
import java.io.IOException;
import java.net.InetAddress;
import java.net.UnknownHostException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.LoginException;
import com.sap.engine.interfaces.security.auth.AbstractLoginModule;
import com.sap.engine.lib.security.LoginExceptionDetails;
import com.sap.engine.lib.security.http.HttpGetterCallback;
import com.sap.security.api.IUser;
import com.sap.security.api.NoSuchUserException;
import com.sap.security.api.UMException;
* <p>
* <div>This LoginModule either succeeds or fails, but in fact it
* <u>never</u> authenticates the user. What is meant is that even if
* all relevant methods of the LoginModule API - i.e. login and commit
* - return true, indicating success, the Subject is never
* authenticated. Therefore this LoginModule should <u>never</u> be
* configured as SUFFICIENT.</div>
* </p>
* <p>
* <div>The purpose of this LoginModule is to abort the authentication
* process in case an unauthorized user tries to authenticate as
* administrator and thus it stops unauthorized users from locking
* administrator accounts.</div>
* </p>
* <p>
* <div>This LoginModule accepts two optional configuration
* options:<ul>
* <li>ip_allow</li>
* <li>ip_deny</li></ul>
* The value of both options is a comma separated list of IPv4 ranges.
* e.g.
* <code>ip_allow=145.50.76.81,145.50.77.0-145.50.77.255,194.196.236.70-194.196.236.71</code>
* The localhost is added implicitly.</div>
* </p>
* <p>
* <div>If the IP address of the client that sent the HTTP request is
* within the range(s) defined by ip_allow and is not within the
* range(s) defined by ip_deny, authentication succeeds. If this is
* not the case, authentication fails if the user tries to
* authenticate by username (and password) and supplies the username
* of an existing UME user that is assigned the internal_use_only
* role. Otherwise, authentication succeeds.</div>
* </p>
* <p>
* <div>To meet its purpose, i.e. prevent the locking of administrator
* user accounts, this LoginModule <u>should</u> be configured as
* <u>REQUISITE</u> and should be in the login stack <u>before</u> the
* standard BasicPasswordLoginModule.</div>
* </p>
* @author smadou
public final class AdministratorFilterLoginModule extends AbstractLoginModule {
private static final String INTERNAL_USE_ONLY =
    LogonUtil.getRoleid("internal_use_only");
private static final String IP_ALLOW = "ip_allow";
private static final String IP_DENY = "ip_deny";
private static boolean initialized;
private static List IPRANGE_ALLOW = new ArrayList();
private static List IPRANGE_DENY = new ArrayList();
private CallbackHandler callbackHandler;
private boolean succeeded;
public void initialize(
    Subject subject,
    CallbackHandler callbackHandler,
    Map sharedState,
    Map options) {
    super.initialize(subject, callbackHandler, sharedState, options);
    this.callbackHandler = callbackHandler;
    this.succeeded = false;
    AdministratorFilterLoginModule.initialize(options);
public boolean login() throws LoginException {
    try {
      if (ipAllowed()) {
        succeeded = true;
        return true;
    } catch (UnsupportedCallbackException e) {
      throwUserLoginException(e);
    } catch (IOException e) {
      throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION);
    String logonid = null;
    IUser user = null;
    String userid = null;
    try {
      logonid = getLogonid();
      user = logonid == null ? null : LogonUtil.getUser(logonid);
      userid = user == null ? null : user.getUniqueID();
    } catch (UnsupportedCallbackException e) {
      throwUserLoginException(e);
    } catch (IOException e) {
      throwUserLoginException(e, LoginExceptionDetails.IO_EXCEPTION);
    } catch (NoSuchUserException e) {
      // TODO connect to NetWeaver logging API - DEBUG
      e.printStackTrace();
    } catch (UMException e) {
      throwUserLoginException(e);
    if (userid == null) {
      return true;
    if (user.isMemberOfRole(INTERNAL_USE_ONLY, LogonUtil.RECURSIVE)) {
      throwNewLoginException(
        "Access Denied to user with logonid "
          + logonid
          + " having role "
          + INTERNAL_USE_ONLY
          + "!");
    succeeded = true;
    return true;
public boolean commit() throws LoginException {
    return succeeded;
public boolean abort() throws LoginException {
    return succeeded;
public boolean logout() throws LoginException {
    succeeded = false;
    return true;
private static synchronized void initialize(Map options) {
    if (initialized) {
      return;
    IPRANGE_ALLOW.addAll(Arrays.asList(AddressRange.parseRanges("127.0.0.1")));
    try {
      IPRANGE_ALLOW.addAll(
        Arrays.asList(
          AddressRange.parseRanges(
            InetAddress.getLocalHost().getHostAddress())));
    } catch (UnknownHostException e) {
      // TODO connect to NetWeaver logging API - INFO
      e.printStackTrace();
    String ipAllow = (String) options.get(IP_ALLOW);
    String ipDeny = (String) options.get(IP_DENY);
    if (ipAllow != null && ipAllow.length() > 0) {
      IPRANGE_ALLOW.addAll(Arrays.asList(AddressRange.parseRanges(ipAllow)));
    if (ipDeny != null && ipDeny.length() > 0) {
      IPRANGE_DENY.addAll(Arrays.asList(AddressRange.parseRanges(ipDeny)));
    initialized = true;
private String getClientIp()
    throws UnsupportedCallbackException, IOException {
    HttpGetterCallback hgc = new HttpGetterCallback();
    hgc.setType(HttpGetterCallback.CLIENT_IP);
    callbackHandler.handle(new Callback[] { hgc });
    return (String) hgc.getValue();
private String getLogonid()
    throws IOException, UnsupportedCallbackException {
    NameCallback nc = new NameCallback("username: ");
    callbackHandler.handle(new Callback[] { nc });
    return nc.getName();
private boolean ipAllowed()
    throws UnsupportedCallbackException, IOException {
    String clientIp = getClientIp();
    return match(IPRANGE_ALLOW, clientIp) && !match(IPRANGE_DENY, clientIp);
private boolean match(List ipRanges, String ip) {
    for (Iterator i = ipRanges.iterator(); i.hasNext();) {
      AddressRange range = (AddressRange) i.next();
      if (range.match(ip)) {
        return true;
    return false;
import com.sap.security.api.IRole;
import com.sap.security.api.IRoleFactory;
import com.sap.security.api.IUser;
import com.sap.security.api.IUserFactory;
import com.sap.security.api.NoSuchRoleException;
import com.sap.security.api.NoSuchUserException;
import com.sap.security.api.UMException;
import com.sap.security.api.UMFactory;
* @author smadou
public final class LogonUtil {
static final boolean RECURSIVE = true;
static String getRoleid(String uniqueName) {
    try {
      IRoleFactory rf = UMFactory.getRoleFactory();
      IRole role = rf.getRoleByUniqueName(uniqueName);
      return role.getUniqueID();
    } catch (NoSuchRoleException e) {
      // TODO connect to NetWeaver logging API - WARN
      e.printStackTrace();
      throw new SecurityException(
        "NoSuchRoleException while getting role with unique name ""
          + uniqueName
          + "": "
          + e.getMessage());
    } catch (UMException e) {
      // TODO connect to NetWeaver logging API - WARN
      e.printStackTrace();
      throw new SecurityException(
        "UMException while getting role with unique name ""
          + uniqueName
          + "": "
          + e.getMessage());
static IUser getUser(String logonid)
    throws NoSuchUserException, UMException {
    IUserFactory uf = UMFactory.getUserFactory();
    return uf.getUserByLogonID(logonid);
* This code is based on
* http: //drc-dev.ohiolink.edu/browser/fedora-core/tags/2.0/src/java/fedora/server/security/IPRestriction.java
* @author smadou
public final class AddressRange {
private static final int IP_OCTETS = 4;
private static final int OCTET_MIN = 0;
private static final int OCTET_MAX = (int) Math.pow(2, 8) - 1;
private long start;
private long end;
private AddressRange(long start, long end) {
    this.start = start;
    this.end = end;
public boolean match(String address) {
    return match(parseAddress(address));
private boolean match(long address) {
    return address >= start && address <= end;
private static long parseAddress(String address) {
    String[] octets = address.split("\.");
    if (octets.length != IP_OCTETS) {
      throw new IllegalArgumentException("invalid adress: "" + address + """);
    long lAddress = 0;
    for (int i = 0, n = octets.length; i < n; i++) {
      lAddress += parseOctet(octets[ i ], n - i - 1);
    return lAddress;
private static long parseOctet(String octet, int byteNum)
    throws NumberFormatException {
    long lOctet = Long.parseLong(octet);
    if (lOctet < OCTET_MIN || lOctet > OCTET_MAX) {
      throw new IllegalArgumentException("invalid octet: "" + octet + """);
    return lOctet * (long) Math.pow(Math.pow(2, 8), byteNum);
private static AddressRange parseRange(String range) {
    String[] parts = range.split("-");
    if (parts.length > 2) {
      throw new IllegalArgumentException("invalid range: "" + range + """);
    long start = parseAddress(parts[0].trim());
    long end = parts.length == 1 ? start : parseAddress(parts[1].trim());
    return new AddressRange(start, end);
public static AddressRange[] parseRanges(String ranges) {
    String[] parts = ranges.split(",");
    AddressRange[] addressRanges = new AddressRange[parts.length];
    for (int i = 0, n = parts.length; i < n; i++) {
      addressRanges[ i ] = parseRange(parts[ i ].trim());
    return addressRanges;

My iphone is locked with icloud account how to resolve it

my iphone is locked with icloud account how to resolve

Hey sumedhfrommapusa,
Thanks for the question. I understand that your iPhone is locked with iCloud Activation Lock. The following resources may provide a solution:
iCloud: Find My iPhone Activation Lock in iOS 7
http://support.apple.com/kb/HT5818
iCloud: Activation Lock
http://support.apple.com/kb/PH13695
Find My iPhone Activation Lock: Removing a device from a previous owner’s account
http://support.apple.com/kb/TS4515
Thanks,
Matt M.

Control file lock time in rac

Hi all,
Database version 11.2.0.2
Os version Red hat 5.3
Two node RAC
What is the default control file lock time in rac environment i am getting error after 120 seconds.
The default lock time in single instance is 900 seconds.
Does in rac this time lowered to 120 seconds.
error in alert log file
Errors in file /u01/app/oracle/diag/rdbms/lfgoimdb/LFGoimdb2/trace/LFGoimdb2_arc2_27691.trc (incident=15905):
ORA-00240: control file enqueue held for more than 120 seconds
After hitting this error I have observed that another node evicts this node.

The above link state that it is a bug in previous versions but i am in recent version 11.2.0.2.5 and this bug is resolved in this version.

Control Busniess Area Field in Account ***..

hello Friends,
    I have to control business area field in account assignment is needs to invisible when i select custom account assignment category..
     Can you please help me out how can i do this requirement..
    I know there is a control badi available but nothing is working for me..
   if you already done this control badi please help me out to implemented the logic to invisible business area field when i choose custom account assignment..
Thanks,
John.

Hi
Have you tried the BADI
<b> BBP_CUF_BADI_2 </b>. this BADI si basically for Custom fields.
Please try out this code Inside Method modify_screen ....
given below on the standard field name available in the Table type of the BADI.
I am not sure, whether this will help.
METHOD if_ex_bbp_cuf_badi_2~modify_screen.
LOOP AT et_fields INTO ls_et_fields.
    CASE ls_et_fields-fieldname.
*--- Custom field Number is displayed & input enabled
      WHEN 'ZZFIELD'.
        ls_et_fields-xdisplay = 'X'.
        ls_et_fields-xinput   = 'X'.
        MODIFY et_fields FROM ls_et_fields
               TRANSPORTING xdisplay xinput.
        CLEAR ls_et_fields.
    ENDCASE.
ENDLOOP.
ENDMETHOD.
Hope this will help.
Please reward suitable points.
Regards
- Atul

Two iPhone is locked on my account and I can not open it and show me the following message

Please help me
Two iPhone is locked on my account and I can not open it and show me the following message

iPhone4,1
imei :013176008193701
serial No :C8PJ5T72DTC0

Can the external volume control be lock on model Md128c

can the external volume control be locked and accidental adjustments

I only just spotted this myself... by accident! fantastic feature- maybe should try and make more people aware of it though.

Lock a user account

1.can I use weblogic API in websphere?
2.if not how can i lock a user account for 3 unsuccessful login attempts?
Thanks in advance

can u help me out in writing code for populating one
combobox depending on selection in another combo box
in java or javascript
like country,state,city in address
by selecting particular country in country combo box
,states belongs to that country should be populated
in state combo box.Go on.......this way the next question would be about the neighbour's dog.
Is it so difficult to post a new topic if your question/doubt is entirely different from what you set out asking initially ?
That way, it would be easier for others who come here seeking answers to quickly browse through the questions or do a effective search. It would also help those who wish to help you.
Viki and AngryCat ::: You both are regular respected members of this forum. While this is a free and unmoderated forum, IMO, you people should really put your foot down and politely ask the OP to post another thread if he/she goes of on a tangent posting totally unrelated questions in a single thread. As I said, this is my humble opinion and feel free to do or state otherwise.
cheers,
ram.

"Controls" on locking G/L accounts

Similar Messages

Maybe you are looking for