Create admin folders based on OU organizational unit active directory

We have thousands of users to import from our active directory. In my proof of concepts, the active directory integration service 6.3 running on ALUI 6.1 MP1 imports all the users to the same folder - the folder where my remote authentication source object is.<br>
Can the active directory integration service create folders based on the many OU's (organizational units) we have? We'd like our portal admin folder structure to mirror our active directory organizational unit structure, but we don't want to have to recreate it manually for the obvious deployment and ongoing maintenance reasons. Is that possible?

You asked: Can the active directory integration service create folders based on the many OU's (organizational units) we have?
As far as I understand there is not a way to dynamically generate Admin Hierarchy folders based upon this job.
Obviously where there is a will there is a way, and if you have a crew of strong developers you could probably write something custom that would do this for you (maybe), but here are 2 other approaches to consider:
1) use 1 AD Auth source and split the users into multiple folders based upon group association in the "Default Profiles" section under main settings. The problem with this is that if users change groups in AD they will not be resorted in your admin hierarchy.
2) use multiple AD Auth sources, each with an appropriate query filter. I could be wrong, but the downfall to this approach is that the users that change OU's would be entirely deleted and recreated.
Edited by geoffgarcia at 04/24/2008 8:11 AM

Similar Messages

To build the organization's Active Directory permissions are what we need

To build the organization's Active Directory permissions are what we need

what is your actual question? Can you be more specific?
Santhosh Sivarajan | Houston, TX | www.sivarajan.com
ITIL,MCITP,MCTS,MCSE (W2K3/W2K/NT4),MCSA(W2K3/W2K/MSG),Network+,CCNA
Windows Server 2012 Book - Migrating from 2008 to Windows Server 2012
Blogs: Blogs
Twitter: Twitter
LinkedIn: LinkedIn
Facebook: Facebook
Microsoft Virtual Academy:
Microsoft Virtual Academy
This posting is provided AS IS with no warranties, and confers no rights.

Is there a way to export to separate folders based on collection organization?

I am wondering if there is a simple way to export photos from lightroom into seperate folders based on collections.
For example, in LR5, I have collection set "2014". Within "2014", there are sub-collections Jan, Feb, March... and so on. How can I export all the photos, at once, from the "2014" collection set so they end up in a folder structure that mirrors the collection set and sub-collections. My collection is more complex and contains many more sub-collections than the example provided, so I would really like to avoid having to export each sub-collection separately.
In searching for this, I found mention of some sort of plug-in that apparently was capable of this, but I could not get it to work. The GUI was not intuitive and I didn't have time to learn it. Unfortunately, I do not remember the name of the plug-in since I deleted it. But is there any way to do this without having to learn code or install plug-ins?

asbissonnette221 wrote:
is there any way to do this without having to learn code or install plug-ins?
Ordinary hard drive service will export into disk folders in tree structure which mirrors hierarchy of publish collections.
I had always assumed (wrongly) this was NOT the case, otherwise what is the purpose of Jeffrey Friedl's Collection Publisher?
Jim Wilde pointed out my erroneous assumption, and said there are advantages to Jeffrey's plugin, but I don't know what they are (probably the ability to have different settings per collection and dunno what else...). Or maybe jf's collection publisher will export in structure of non-publish collections so you don't have to re-define a matching set of published collections - I really don't know.
Bottom line: if your needs are simple enough, Hard Drive publish service may be all you need.
Rob

How to create batch job based on sales organization?

I am Sending data using RFC function module, within a report program.
Now according to functional requirement I have to create two batch job scheduling scenarios:
1. Provide a batch job to be run towards month end (2X, 1X) to sent a delta record message using Report. This is scheduled on demand or requested on demand. Recommend 1 message per sales org.
Q: What does it mean by scheduled on demand or requested on demand?? Second thing is that like we have 10 sales org. and in variants for job scheduling we can assign only 1 at a time......how can i schedule per sales organization? do i need to create different job for each sales organization??
(2X, 1X) what is the meaning of this notation??
2. Create a new nightly batch job, run after daily billing batch, to send a delta records message of Report. Recommend 1 message per sales org.
Anyone please provide me some details on this issue.......
Regards
Anshul

I am Sending data using RFC function module, within a report program.
Now according to functional requirement I have to create two batch job scheduling scenarios:
1. Provide a batch job to be run towards month end (2X, 1X) to sent a delta record message using Report. This is scheduled on demand or requested on demand. Recommend 1 message per sales org.
Q: What does it mean by scheduled on demand or requested on demand?? Second thing is that like we have 10 sales org. and in variants for job scheduling we can assign only 1 at a time......how can i schedule per sales organization? do i need to create different job for each sales organization??
(2X, 1X) what is the meaning of this notation??
2. Create a new nightly batch job, run after daily billing batch, to send a delta records message of Report. Recommend 1 message per sales org.
Anyone please provide me some details on this issue.......
Regards
Anshul

How to get employee no(pernr) based on the organizational unit

HI,
I am using LDB PNP in my program nd have used my own report category with Organizational unit,begin date and end date in the selection screen.
Now I have to get all the active employee of that organizational unit.so tell me how to get this
Explain about GET and PROVIDE statement
Regards,
Kiruthi

Hi !
To get active employees reject separated employees ( action )
i.g
******Data fetch*****
start-of-selection.
get pernr.
if pernr-massn eq '14'.
reject.
else.
it_active-sapid = pernr-pernr.
endif.
ORGEH : Organizational Unit
ORGTX: Organization unit text
********Organization*************
*data text type char30.
SELECT SINGLE ORGEH from pa0001 into IT_ACTIVE-ORGEH where PERNR = IT_ACTIVE-SAPID.
SELECT SINGLE ORGTX from t527x into IT_ACTIVE-ORGTX where ORGEH = IT_ACTIVE-ORGEH and SPRSL = 'EN' .
if sy-subrc eq 0.
write: 160 sy-vline, IT_ACTIVE-ORGTX.
else.
clear: IT_ACTIVE-ORGTX.
write: 160 sy-vline, IT_ACTIVE-ORGTX.
endif.
**************Organizational ID ******************
select single ORGEH from pa0001 into it_active-Org where pernr = it_active-sapid and begda le pn-endda and endda eq '99991231' .
if sy-subrc eq 0.
write: 180 sy-vline, it_active-org .
else.
clear: it_active-org .
select single ORGEH from pa0001 into it_active-org where pernr = it_active-sapid and endda EQ '99991231' .
write: 180 sy-vline, it_active-org.
endif.
Regards
Sheetal

SSO (single sign on) on NetWeaver 7.0 Enterprise Portal based on spnego with Microsoft Active Directory

Hi,
we are using SAP Netweaver Enterprise Portal 7.0 (SP25) based on Windows 2008 R2/Oracle 11g.
When we setup the Portal, we used the UME of the ECC - ABAP.
The portal is used internally only.
Now we want to provide SSO.
User authenticate against Windows Active Directory (Windows 2003).
We thought SSO via spnego would be the best solution.
Any better alternates, we should use?
We are following the SAP documentation:
SAP-Bibliothek - Benutzerauthentifizierung und Single Sign-On
We still want to create users in ABAP and assign them the portal roles. LDAP access should only have read access, to verify the security token from Active Directory.
When we setup the portal from scratch using ABAP as its UME, in the system configuration, LDAP can't be selected/add as data source.
In case we understand the documentation correctly, we would now need to add LDAP via the configtool for read access.
What is not clear to us, when we active now LDAP via config tool, if we would now lose the ABAP connection.
Is there a tutorial for SSO Netweaver 7.0 EP, like for EP 7.3, available?
In 7.3 SSO is pretty simple to get it running, thanks to the many tutorials here and on the internet.
Thanks for your help.
Best regards
Carlos Behlau

Hi,
I was able to generate the key via ktab program.
But when I am enable SSO, nothing is happening when I try to log-on via SSO to the portal.
I installed WebDiag tool on the portal server and ran trace.
The users are located in domain: company.com of activate directory.
The Java AS are located in domain: sap.company.com of activate directory.
The sap.company.com domain acts as child of company.com.
When I check the WebDiag trace, I see for the SPNegoLoginModule - the entry "... no key (etype: 23) for realm sap.company.com available ..."
I would except company.com as realm key, as the keytabs have been generated on the domain controller of company.com.
Is it possible to get SSO with child domain running?
Based on the statement of the network folks, child and father domain having a trust.
Thanks for your help.
Best regards
Carlos

How to create User in the specific group in Microsoft Active Directory

Hi,
I am using Nestcape LDAP, and want to create user in the user defined group. I have created a new user group "TestUsers" in the "Users" container of Active Directory, I want to add the new user to Test Users group But my problem is that whenever I create a new user
it get added to Domain Users group.
I tried adding memberOf attribute with value "TestUsers"
attr = new LDAPAttribute("memberOf", "TestUsers");
attrs.add(attr);
It gives me following error :
code= 53 Exception 0000209A: SvcErr: DSID-031A0D6F, problem 5003 (WILL_NOT_PERFORM), data 0
Following is the code I am using.
public LDAPResult createUserID(
String userId,
String pwd,
String pId,
boolean resetonLogOn,
LDAPConnection ldCon) {
boolean flag = false;
int code=0;
try {
String pwdLastSetVal;
String desName;
String desc;
/* Specify the DN of the new entry. */
String dn =
"CN=" + userId + ",CN=" + this.container + "," + this.baseDN; // container = "Users"
/* Create and add attributes to the attribute set. */
String objectclass_values[] =
{ "top", "person", "organizationalPerson", "user" };
// LDAPEntry findEntry=null;
/* Create a new attribute set for the entry. */
LDAPAttributeSet attrs = new LDAPAttributeSet();
/* Attribute sAMAccountName */
LDAPAttribute attr = new LDAPAttribute(LDAP_SAM_KEY, userId);
attrs.add(attr);
/* Attribute unicodePwd */ // LDAP_PASSWORD_KEY = "unicodePwd"
attr =
new LDAPAttribute(
LDAP_PASSWORD_KEY,
(byte[]) this.encodePassword(pwd));
attrs.add(attr);
/* Attribute Display Name */
desName = userId + ":" + pId;
//desName = userId ;
attr = new LDAPAttribute(LDAP_DIS_NAME_KEY, desName);
attrs.add(attr);
/** Attribute userAccountControl to enable the userid.
attr = new LDAPAttribute(LDAP_ACCOUNT_KEY, LDAP_ACCOUNT_EN_VAL); // LDAP_ACCOUNT_EN_VAL= "548"
attrs.add(attr);
/* Attribute pwdLastSet to reset the password on first logon*/
if (resetonLogOn == true) {
pwdLastSetVal = "0";
} else {
pwdLastSetVal = "-1";
attr = new LDAPAttribute(LDAP_RESET_KEY, pwdLastSetVal);
attrs.add(attr);
/* Attribute Description */
desc = " Account Created by HelpNow App";
attr = new LDAPAttribute(LDAP_DESC_KEY, desc);
attrs.add(attr);
/* Attribute objectclass */
attr = new LDAPAttribute("objectclass", objectclass_values);
attrs.add(attr);
attr = new LDAPAttribute("memberOf", "TestUsers");
attrs.add(attr);
/* Create an entry with this DN and these attributes . */
LDAPEntry myEntry = new LDAPEntry(dn, attrs);
/* Add the entry to the directory. */
ldCon.add(myEntry);
flag = true;
}catch (LDAPException e) {
flag = false;
code=e.getLDAPResultCode();
}catch (Exception e) {
flag = false;
code=LDAPException.OTHER;
}finally {
ldaprs.flag=flag;
ldaprs.code=code;
return ldaprs;
}

Refer to the post titled "JNDI, Active Directory and Group Memberships" available at http://forum.java.sun.com/thread.jspa?threadID=581444&tstart=150

How to create user in specific user group in Microsoft Active Directory ?

Hi,
I am using Nestcape LDAP, and want to create user in the user defined group. I have created a new user group "TestUsers" in the "Users" container of Active Directory, I want to add the new user to Test Users group But my problem is that whenever I create a new user
it get added to Domain Users group.
Following is the code I am using which adds user to default group Domain Users.
public LDAPResult createUserID(
String userId,
String pwd,
String pId,
boolean resetonLogOn,
LDAPConnection ldCon) {
boolean flag = false;
int code=0;
try {
String pwdLastSetVal;
String desName;
String desc;
/* Specify the DN of the new entry. */
String dn =
"CN=" + userId + ",CN=" + this.container + "," + this.baseDN; // container = "Users"
/* Create and add attributes to the attribute set. */
String objectclass_values[] =
{ "top", "person", "organizationalPerson", "user" };
// LDAPEntry findEntry=null;
/* Create a new attribute set for the entry. */
LDAPAttributeSet attrs = new LDAPAttributeSet();
/* Attribute sAMAccountName */
LDAPAttribute attr = new LDAPAttribute(LDAP_SAM_KEY, userId);
attrs.add(attr);
/* Attribute unicodePwd */ // LDAP_PASSWORD_KEY = "unicodePwd"
attr =
new LDAPAttribute(
LDAP_PASSWORD_KEY,
(byte[]) this.encodePassword(pwd));
attrs.add(attr);
/* Attribute Display Name */
desName = userId + ":" + pId;
//desName = userId ;
attr = new LDAPAttribute(LDAP_DIS_NAME_KEY, desName);
attrs.add(attr);
/** Attribute userAccountControl to enable the userid.
attr = new LDAPAttribute(LDAP_ACCOUNT_KEY, LDAP_ACCOUNT_EN_VAL); // LDAP_ACCOUNT_EN_VAL= "548"
attrs.add(attr);
/* Attribute pwdLastSet to reset the password on first logon*/
if (resetonLogOn == true) {
pwdLastSetVal = "0";
} else {
pwdLastSetVal = "-1";
attr = new LDAPAttribute(LDAP_RESET_KEY, pwdLastSetVal);
attrs.add(attr);
/* Attribute Description */
desc = " Account Created by HelpNow App";
attr = new LDAPAttribute(LDAP_DESC_KEY, desc);
attrs.add(attr);
/* Attribute objectclass */
attr = new LDAPAttribute("objectclass", objectclass_values);
attrs.add(attr);
/* Create an entry with this DN and these attributes . */
LDAPEntry myEntry = new LDAPEntry(dn, attrs);
/* Add the entry to the directory. */
ldCon.add(myEntry);
flag = true;
}catch (LDAPException e) {
flag = false;
code=e.getLDAPResultCode();
}catch (Exception e) {
flag = false;
code=LDAPException.OTHER;
}finally {
ldaprs.flag=flag;
ldaprs.code=code;
return ldaprs;
}

Refer to the post titled "JNDI, Active Directory and Group Memberships" available at http://forum.java.sun.com/thread.jspa?threadID=581444&tstart=150

Users created in SBS Console don't show in Active Directory Users & Computers

SBS 2011 - created users in SBS Console, but they don't show in ADUC. The newly created accounts seem to work as expected (user can login, Outlook account setup works). Have ADUC 'Advanced Features' enabled, tried searching for a user, right-click
on domain name, Find, user - doesn't find anything. Any suggestions appreciated.

SBS Users are not in the typical location in the ADUC Console, here is where they should be:
Open ADUC
-Domain
     -My Business
            -Users
                 -SBS Users

Create a BP type BUP004 (Organizational Unit)

Hello,
I've created an Organizational Unit in CRM but there is no Business Partner created and assigned. When I try to create a service order for a customer with the attributes of the OUnit, system says that I heve no BP associated to the OU. I've seen in tx BP but the role BUP004 is not visible.
How can I create a BP associated to the organizational unit? Should I create the BP first? But I can not see this role?
Can anyone help me?
Thanks
Teresa

Hi Teresa,
For a BP to be generated for your OU you need to maintain the following settings
1. Transaction code     SPRO
SAP CRM IMG menu     CRM --> Master Data --> Business Partner --> Integration Business Partner u2013> Organizational Management ->Set Up Integration with Organizational Management
2.Enter the following values for the existing combination of Group and Sem.abbr.:
Group     Sem. Abbr.     Value abbr.     Description
HRALX     HRAC     X     Activate HR Integration
HRALX     OBPON     ON     Integration O-BP Activated
HRALX     ONUMB     2     Business Partner Number Assignment (Org. Unit)
HRALX     OSUBG     Y4     Business Partner Subgroup (Organizational Unit)
-> Number Range
Now when you carete an OU, a BP no. will get generated
Incase it does not happen run   report, CRM_OM_BP_INTEGRATE
This will give you inforamtion as to wahat is missing in your OU
Regards
Itty

CRM: PFCG Roles restricted based on Sales Organization

Hi,
I have a requirement in SAP CRM 7.0 to create roles restricted based on Sales Organization(locations). We have two Sales Organization XXX and YYY, for which users need to be restricted. I have used the following objects for this regard.
CRM_ORD_OP, CRM_ORD_LP, CRM_ORD_PR, CRM_ORD_OE, CRM_BP_SA
Every user has assigned a sales role in which the above objects are deactivated and separate roles with values to the objects, with respective Sales Org values for the objects CRM_ORD_OE, CRM_BP_SA been provided. I have assigned these roles to respective users (User A with XXX, User B with YYY) based on their sales org locations. These users are positioned in the Organizational Model (PPOMA_CRM) under their respective Sales groups as per the requirement for the object CRM_ORD_LP, and authorization to this object is restricted to A for CHECK_LEV (Your Own Sales Organization). We use * for the objects CRM_ORD_OP and CRM_ORD_PR, as we do not control these.
After restricting all these, we do not find that the result not appearing as we expect, that is, restricting the sales organization data. We need all accounts, all activities, all opportunities, all leads, all campaigns etc. should be restricted by Sales Org, but when we search for accounts, activities, opportunities, leads, campaigns, we get result list with all data without any restrictions. I even checked the following forum, http://forums.sdn.sap.com/thread.jspa?threadID=1579211, which talks about the same kind of issue, but as I have already using the same objects for the restriction, it didnt help me much. I tried deactivating object CRM_BP_SA as it is not discussed on the forum, also tried CHECK_LEV=A,B,C,D,E for object CRM_ORD_LP, but all results the same.
Additional Info: When tried to create a project, with user A who is authorized for XXX, normally it would pick up the Sales Area Data for the project from the user (meaning User A from the XXX Sales Org.), but I get an error message: Enter a sales org, enter a dist. channel and enter an org unit etc. Even when I search for leads, it displays a list of data, when I click on any, it issues the error message: Enter a sales org, enter a dist. channel and enter an org unit (Sales) etc
Is that we miss any object restriction that is not restricting these objects properly or is it any customization missing? Please advice.
Thanks in advance.
Regards,
Shahul Hameed M
BASIS Consultant

Hi Shahul,
I have a similar requirement as of yours. I have maintained auth values, in role as below:
CRM_ORD_LP
03       ACTVT
A        CHECK_LEV
*         PR_TYPE
CRM_ORD_OE
03       ACTVT
11       DIS_CHANNE   ( the user is assigned to this dstrbtion channel in org structure)
          SALES_GROU
          SALES_OFFI
SO1   SALES_ORG
          SERVICE_OR   ( the user is assigned to this sales org in org structure)
And, when I try to display the LEADs in CRM UI ...I still get the display of LEADs belonging to all sales orgs.
And my trace record for CRM_ORD_LP is....
CHECK_LEV    ' blank '
PR_TYPE          LEAD
ACTVT               03
that means, it is not considering the auth value ' A ' for auth field CHECK_LEV
Could you please let me know ...how you have achieved this restriction . Is there anything , i m missing here?
Thank You

Have to diplay all the active employees in an Organizational unit n HR ABAP

HI,
I am new to HR ABAP.
In my selection screen I have to get the Organizational unit from the user and based on that organizational unit value i have to display the details like pernr,fname and other fields of all the active employee in that OU.
I have to use logical database in the program .
so it would be helpful if anyone of you can give some idea or send some sample programs or materials for reference.
Regards,
Kiruthi

HI,
I am new to HR ABAP.
In my selection screen I have to get the Organizational unit from the user and based on that organizational unit value i have to display the details like pernr,fname and other fields of all the active employee in that OU.
I have to use logical database in the program .
so it would be helpful if anyone of you can give some idea or send some sample programs or materials for reference.
Regards,
Kiruthi

Move files into folders based on EXIF Creation Date

Hi all,
Being a novice with Applescript I have read what I can find on this forum, but are not able to find exactly what I'm looking for. I think that the posting "Using AppleScript to create folders and place files in them" is the closest I get to what I want but I want to create the folders based on EXIF creation date.
Let me explain.
I have a folder that contains thousands of jpg, mp4, mov and avi files; all created by different cameras. I want to bring some order to this and place files in folders based on year, month and date that the file was created (the photo taken or the video captured). This date is stored in the EXIF creation date.
     Take all files in folder A
      foreach file find the EXIF creation date
      move each file into directory tree (at same location is ok) where toplevel is YEAR, next directory level is named accoring to EXIF creation date as MMDDYY
      if no EXIF creation date can be found, fallback to creation date (file property?)
      if no good date is found, leave file alone in folder A for manual sorting; do not use modification date as this may have been altered
     this would create a structure as
     2002
            011602
                    File 1 taken Jan 16 2002
                    File 2 taken Jan 16 2002
            082002
                    File 1 taken Aug 20 2002
                    File 2 taken Aug 20 2002
      2003
             etc
     2004
         |   etc
     2014
             010114
                    File 1 taken Jan 1 2014
etc etc

Well, technically that's correct, Frank, but the same could be said of much of AppleScript - the core functionality is limited, but there's a lot you can do.
For example, it's actually trivial to use Image Events get any given EXIF tag of an image:
set theFile to (choose file)
tell application "Image Events"
          set f to open theFile
          set cD to value of metadata tag "CreationDate" of f
close f
end tell
Now, cD will have the value of the CreationDate tag (assuming it exists, of course - you'll need to wrap this in a try/end try statement). Once you have that it shouldn't be too hard to extract the date components, work out the target directory name and move the file.

Account for organizational unit - translation of BP names possible?

Hello,
we created accounts for BP-Role BUP004 - organizational unit.
We need to have different translations of the name of this BP depending on the login language.
e.g.:
german BP-name = Einsatzplanung Lagern
english BP-name = WFM stroage systems
Is there a way to maintain different names per language?
Kind regards
Manfred

Hi Manfred,
You can maintain multiple language version of the bp name & address using International address version.
For more info, [http://help.sap.com/saphelp_sm40/helpdata/en/18/c042ffda4811d3b571006094192fe3/content.htm]
Cheers, Satish

Creating active directory users with dscl

Our mac workstations (OSX 10.8) are bound to a 2008 Active Directory server. We are attempting to use some existing dscl scripts on the mac client computer to create Active directory users. We can successfully read and change AD attributes of an existing user with dscl, but creating new users or new attributes for an existing user gives us an error. Here are some examples.
SUCCESSFUL READ OF AD USER ATTRIBUTE:
root# dscl -u administrator "/Active Directory/CXAD/All Domains" -read /Users/jholmes SMBHomeDrive
Password:
SMBHomeDrive: H:
root#
SUCCESSFUL DELETE OF ABOVE USER ATTRIBUTE
root# dscl -u administrator "/Active Directory/CXAD/All Domains" -delete /Users/jholmes SMBHomeDrive
Password:
root#
FAILED ATTEMPT AT RE-CREATING THE DELETED ATTRIBUTE
root# dscl -u administrator "/Active Directory/CXAD/All Domains" -create /Users/jholmes SMBHomeDrive
Password:
<main> attribute status: eDSInvalidRecordType
<dscl_cmd> DS Error: -14130 (eDSInvalidRecordType)
root#
The same error occurs when attempting to create a new user. Any ideas? Thanks in advance for any suggestions.

In the end I could not find them; account info is ONLY stored locally in Open Directory when they have mobile accounts.
However, I found I could migrate their user directories in Terminal via ditto ( I connected the old macs via Firewire Target mode) , and when they log in all their stuff and settings are there.
the command is: ditto /Volumes/<old mac hard drive>/Users/<username> /Users/<username>

Create admin folders based on OU organizational unit active directory

Similar Messages

Maybe you are looking for