Default Roles or Group

Hi there,
i am trying to assigned default ESS roles automatically in EP for new users that have been created in EP database.
I remember that under EP5.0, there was a parameter which i could set to point to a default group, and all new or existing users would be assigned to this group.
Anyone knows is there a similar feature in EP6?
Thanks
Fred

Hi Frederick,
it's the built-in group "Everyone".
Just go to User Administration -- Roles -- Search for "Everyone" -- Edit -- Search for the Roles you want to add to everyone -- Add them.
Hope it helps
Detlev
PS: For helping answers, please remember to award points (yo have been reminded also in Additional Application Node)...

Similar Messages

To set a default role according to the user.

Hi,
I would like to set different default roles according to users. For example, we have the following prerequisites:
1) 3 roles: roleA | roleB | roleC (in this order).
2) 3 differents users: user1, user2, user3.
So, if I log-in with the user1, the default role should be the roleA; if I log-in with the user2, the default role should be the roleB; and so on.
But I don't want to change the order of the roles using "sort priority" property.
How can I do this?
Thanks,
Samantha.

Hello Samantha,
Does each of the users need to have each of the roles? If not you could just not assign the other roles except the one you want to display as default role (a assume you mean the role that is displayed first after logon).
If each of your users need every role, I am afraid your requirement is not realizable unless you use the sort priority property. Why don't you want to use it in the first place?
On possible yet circuitous way to meet your requirements would be the following:
Create another role for each of your user(-group)s. Say in your case Role 1, Role 2 and Role 3 which are not defined as entry points.
Assign roleA, roleB and roleC to Role 1 where roleA has the lowest sort priority; and assign user1 to role 1.
Assign roleA, roleB, roleC to Role 2 where roleB has the lowest sort priority; and assign user 2 to Role 2
and so on.
Of course you need to use sort priority for that and I think thats hard to maintain. (probably not even what you are looking for)
Maybe you can get a litle more concrete what you are trying to achieve.
best regards
Stefan

Clustered role 'Cluster Group' has exceeded its failover threshold.

Hello.
I’m hoping to get some help with a cluster issue I’m having using Windows Storage Server 2012.
When the cluster is created my Cluster Core Resources are all happy and online.
I can more the Cluster Name using “move Core Cluster Resources” between the two nodes without any problems.
If I select ‘Simulate Failure’ on the IP Address resource, it works the first time
If I do it again shortly after it fails and I get an Event ID 1254, 1205 and 1069.
Event ID 1254
Clustered role 'Cluster Group' has exceeded its failover threshold.
It has exhausted the configured number of failover attempts within the failover period of time allotted to it and will be left in a failed state.
No additional attempts will be made to bring the role online or fail it over to another node in the cluster.
Please check the events associated with the failure. After the issues causing the failure are resolved the role can be brought online manually or the cluster may attempt to bring it online again after the restart delay period.
Event ID 1205
The Cluster service failed to bring clustered service or application 'Cluster Group' completely online or offline. One or more resources may be in a failed state. This may impact the availability of the clustered service or application.
Event ID 1069
Cluster resource 'Cluster IP Address' of type 'IP Address' in clustered role 'Cluster Group' failed.
Based on the failure policies for the resource and role, the cluster service may try to bring the resource online on this node or move the group to another node of the cluster and then restart it.
Check the resource and group state using Failover Cluster Manager or the Get-ClusterResource Windows PowerShell cmdlet.
Basically I’m trying to simulate a network failure to make sure the failover kicks in.
If I click on it and ‘Bring Online’ it comes up fine.
Where do I find this Threshold Policy and set it to initiate failover if the IP Address resources fails?
Thank you in advance for your help.

Hi,
The failover threshold is the number of times the group can fail over within the number of hours specified by the failover period. For example, if a group failover threshold is set to "5" and its failover period to "3," the clustering software stops attempting
to bring the group online and leaves the resources within the group in their current state. For example, if the IP Address resource is brought online but the Network Name resource fails, the group is left offline, but the IP Address resource is left online.
To configure thresholds for a resource:
Right-click the cluster resource and then select 'Propereties'
Click 'Advanced'
Select 'Do not restart' if the cluster service should not attempt to restart. Restart is the default
If 'Restart' is selected:
Affect the Group: uncheck to prevent a failure of the selected resource from causing the Server group to failover
Threshold: number of times the cluster service will attempt to restart the resource, and period is the amount of time in seconds between retries
Do not modify the 'LooksAlive' and 'IsAlive' settings
Unless necessary, do not alter the 'Pending Timeout'. This is the amount of time the resource is either in the online or pending or offline pending states before the the cluster service puts it in either offline or failed state
For more information please refer to following MS articles:
Windows Failover Clustering Overview
http://blogs.technet.com/b/rob/archive/2008/05/07/failover-clustering.aspx
Tuning Failover Cluster Network Thresholds
http://blogs.msdn.com/b/clustering/archive/2012/11/21/10370765.aspx
Failover cluster (group) maximum failures limit
http://blogs.msdn.com/b/arvindsh/archive/2012/03/09/failover-cluster-group-maximum-failures-limit.aspx
Lawrence
TechNet Community Support

Content area should be a white area/page with the first/default role

Hi All,
Pealse help me
When user logs in to the Portal, content area should be a white area/page with the first/default role
Thanks,
Jyothi.

hi,
simple way, create a static HTML page with your company logo (or empty page) and upload to KM, assign it to existing Home role as a KM document iview that loads first.(make entry point - yes).
assign the role to everyone group with property -sort priority 10 for role (low compared to all other roles)
regards,
mahesh.

Setting a particular value as default for the Grouping Range at BP Creation

Hi,
I am trying to set certain default for the Grouping Range when I create a new Bp using Tcode BP. For this i have changed the PBC fucntion for the view BUP020 ( TCode : BUS3). The Z function module attached is Z_FBSBP_SET_DEFAULT_GROUPING
FUNCTION z_fbsbp_set_default_grouping.
""Local interface:
*" IMPORTING
*"     REFERENCE(IV_ACTION) LIKE BUS000FLDS-CHAR1
*"     REFERENCE(IV_SICHT) TYPE BU_SICHT
DATA: lv_bu_group TYPE bu_group VALUE 'GR01'.
Set the Grouping Range with a default value for all roles, each time
when transaction BP is called
SET PARAMETER ID 'BPP' FIELD lv_bu_group.
Call the standard PBC fucntion module for BP Creation
CALL FUNCTION 'BUP_BUPA_PBC_MISC'
    EXPORTING
      i_action = iv_action
      i_sicht = iv_sicht.
ENDFUNCTION.
As per my notion this fucntion module should get triggered once I open the transaction BP and try to create a new BP, but such a thing is not happening.
Can someone help me in this?
Regards
Priyanka

Yes we did,
But its not a very good solution though it serves the purpose.
See what I did was:
1. Read the authorization object's values for the logged on user using SUSR_USER_AUTH_FOR_OBJ_GET. From here I retrieve the Grouping Range required for the user.
2. Keep this value in a variable say gv_grouping_range.
3. SET PARAMETER ID 'BPP' FIELD gv_grouping_range.
4. CALL TRANSACTION 'BP'.
The four steps above have been enclosed in a report which has been attached to a new transaction code. We from now on allow user an access to this new transaction and not the standard BP transaction(which of course calls for a major change in roles).
Secondly, the first three steps which have been enclosed in a subroutine set_default_grouping are also called from the BDT view BUP050, where the PBO has been changed to ZBUP_BUPA_PBO_MISC
FUNCTION zbup_bupa_pbo_misc .
""Local interface:
*" IMPORTING
*"     VALUE(I_SICHT) TYPE BU_SICHT
PERFORM get_set_def_grouping IN PROGRAM zrpbsbp_create_businesspartner.
CALL FUNCTION 'BUP_BUPA_PBO_MISC'
    EXPORTING
      i_sicht = i_sicht.
ENDFUNCTION.
Hope this helps.
Regards
Priyanka

Map security roles to group within LDAP using external 3rd Party LDAP

I'm haveing a problem mapping my logical role defined in my web.xml to a role within Active Directory. I'm currently authenticating using Active Directory succsfully, however after the user is authenticated I get a message from the OC4J container that my role can not be found. Can you map a logical role to group within Active Directory? Below are details about my configuration.
Any help would be greatly appreciated.
Log.xml log entry that confirms webtA is communicating successfully with AD.
SG_TEXT>JAAS-LDAPLoginModule: authenticating user wmgraham</MSG_TEXT>
</PAYLOAD>
</MESSAGE>
<MESSAGE>
<HEADER>
</CORRELATION_DATA>
<PAYLOAD>
<MSG_TEXT>JAAS-LDAPLoginModule: DN for user wmgraham is cn=wmgraham,ou=endusers,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi</MSG_TEXT>
</PAYLOAD>
</MESSAGE>
<MESSAGE>
<HEADER>
Error reported in the log
<MESSAGE>
<HEADER>
<TSTZ_ORIGINATING>2008-08-27T11:38:05.991-04:00</TSTZ_ORIGINATING>
<COMPONENT_ID>j2ee</COMPONENT_ID>
<MSG_TYPE TYPE="TRACE"></MSG_TYPE>
<MSG_LEVEL>16</MSG_LEVEL>
<HOST_ID>F2287032-W</HOST_ID>
<HOST_NWADDR>30.30.16.14</HOST_NWADDR>
<MODULE_ID>security</MODULE_ID>
<THREAD_ID>14</THREAD_ID>
<USER_ID>wmgraham</USER_ID>
</HEADER>
<CORRELATION_DATA>
<EXEC_CONTEXT_ID><UNIQUE_ID>30.30.16.14:59560:1219851485804:6</UNIQUE_ID><SEQ>0</SEQ></EXEC_CONTEXT_ID>
</CORRELATION_DATA>
<PAYLOAD>
<MSG_TEXT>for group=[JAZNGroupAdaptor: webta] there's no matching role found.</MSG_TEXT>
</PAYLOAD>
</MESSAGE>
Web.xml Logical Role definition
<security-constraint>
<web-resource-collection>
<web-resource-name>allpages</web-resource-name>
<url-pattern>/servlet/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>WEBTA_J2EE_USER</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<role-name>WEBTA_J2EE_USER</role-name>
</security-role>
Orion-web.xml This file maps the logical role defined in webxml to a group within Active Directory.
<security-role-mapping name="WEBTA_J2EE_USER">
<group name="webta"/> <-- Group defined in AD -->
</security-role-mapping>

What is the name of the group in AD (provide the DN) that you want to map the j2ee logical role WEBTA_J2EE_USER? What are the group search base and group mapping attribute?
When wmgraham logs into the app, the 3rd party ldap login module will attempt to query for the groups wmgraham is a member of - this is done using the group search base configuration for the provider.
In this example, the DN is "cn=wmgraham,ou=endusers,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi" and likely user search base is set to "ou=endusers,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi".
Assuming group search base is (say) "ou=groups,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi" and and group mapping attr is "cn", then the role mapping you mention should work for group DN "cn=webta,ou=groups,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi"

Creation of BP with default role

Hi ,
   I have a requiement where in I want a Business Partner to be created with a default role ,i.e CRM006. I can do this in GUI with the help of authorizations.
But the same does not work in PCUI.
My requirement is whenever a user creates a Business Partner, Role CRM006 automatically gets assigned to it.
please sugest something.
Help will be apreciated.
Regards
Sourabh Verma

Hi PREMKUMAR LNS,
you can easily implement BADI: BADI_CRM_BP_UIU_DEFAULTS
IF_UIU_BP_DEFAULTS~GET_DEFAULT_VALUES
and write something like this:
assign cr_me->('TYPED_CONTEXT') to <typed_context>.
if sy-subrc = 0.
    lr_typed_context ?= <typed_context>.
    if lr_typed_context is bound.
      assign lr_typed_context->('HEADER') to <context_node>.
      if sy-subrc = 0.
        try.
            lr_node            ?= <context_node>.
          catch cx_sy_move_cast_error. "EC_NOHANDLER
        endtry.
        if lr_node is bound.
          lr_coll_wrapper ?= lr_node->collection_wrapper.
          if lr_coll_wrapper is bound.
            try.
                lr_current ?= lr_coll_wrapper->get_current( ).
                check lr_current is bound.
controllo la tipologia di account
                zbp_category = lr_current->get_property_as_string( 'BP_CATEGORY' ).
               zbp_group    = lr_current->get_property_as_string( 'BP_GROUP' ).
                if zbp_category = '1'.
                elseif zbp_category = '2'.
              Set default role at creation to "Relation"
                   break domino.
                    zobp_category = lr_current->get_property_as_string( 'BP_ROLE' ).
                    if zobp_category is initial.
Here you are setting the default role
                  lr_current->set_property( iv_attr_name = 'BP_ROLE'
                                   iv_value = 'BUP002' ).
                    endif.
                else.
                endif.
              catch cx_sy_move_cast_error.
            endtry.
          endif.
        endif.
      endif.
    endif.
endif.

Default role missing options in new gallery

I am new to JDeveloper 11g. When accessing the software, I am selecting the "Default role" from the intial roles dialog. When selecting File / New, I get the following options only:
General
- Applications
- Connections
- Deployment Descriptors
- Projects
Business Tier
- Web Services
Client Tier
- Extension Development
Database Tier
- Offline Database Objects
All Items
The help for New Gallery suggests I should be seeing much more than this (UML, XML, TopLink etc.) when logged in under the default role. Can anyone suggest what might be wrong? Is there a config file I can look at or update?
I am running JDeveloper 11g on Windows XP SP3. The version of 11g is:
Oracle JDeveloper 11g 11.1.1.0.1
Studio Edition Version 11.1.1.0.1
Build JDEVADF_MAIN.BOXER_GENERIC_081203.1854.5188
Copyright © 1997, 2008 Oracle. All Rights Reserved.
IDE Version: 11.1.1.0.31.51.88
Product ID: oracle.jdeveloper
Product Version: 11.1.1.0.31.51.88
Any help gratefully received.

User,
All of the things you mention require a project; so, first create an application and a project; then, ensure the Technology Scope for the project matches what you want to do (right-click, properties, technology scope). Then, you should see all of the things you mention.
John

Default Pay scale group and Level in infotype-0008

Hi,
While hiring should display the default Pay scale group and Level in infotype-0008 or the pay scale group and level can default from the Job or position. Itu2019s possible? Thanks in advance.
Regards

No there is no standard Feature to default PSG and PSL. TARIFF is for PSA and PST.
Wait for some body may have some information.
Afrasyab

GRC 10.0 - Auto Approve default roles

Hello All,
Could you please help out me in the below scenarios.
     1) We have maintained default roles in NBWC- Access Management - Default roles.
     Also set the parameter 2038 to Yes- Auto approve roles without approver.
In MSMP we have maintained Escape path if approver is not found at the role level.
As default roles have no approver maintained request is taking the Escape Path which should not happen.
We just want to auto approve the defualt roles and other than defualt roles request should take escape path if no approver found.
     2) In other action its quite same as the above one.
     When we are using provisioning type REMOVE for role removal. Request also takes the Escape path as Defualt roles has no approver.
Once the ,Manager at first stage is approved, request should close for the removal type access.
Please advise. Thanks in advance.

In your custom initiator, you need to have mapped out all the scenarios of which path each line item in your request goes to.
The condition columns can be an array of attributes, i.e. Request Type, Role name, Role Connector (System the Role is in), Functional area etc.
In your case, if you want "default roles" auto approved, easiest thing to so is create an empty path (i.e. No stages) and have the initiator set so that if the "Role Name" is "X" (i.e. your default role), go to the path with no stages.
BRF plus Flate Rule - GRC Integration - Governance, Risk and Compliance - SCN Wiki

ARQ: Default Role Provisioning Problem in Access Request???

Hi,
This Business Scenario is very common to have default role(s) assigned to a User at the back end system. So I have the same requirement. In achieving this, I followed below thread here:
MSMP Issue - GRC 10
I have also followed the note#1616092 for configuring the Default Roles.
I have performed below activities:
1. Param#2009 = YES
2. Param#2010 = 001
3. Param#2011 = REQUEST
4. Param#2013 = SYSTEM
5. Param#2038 = YES
6. Imported a test role and NO ROLE OWNER is maintained.
7.In NWBC->-AM->RM, I maintained a test role as a default.
Now when I raise a request, application is successfully adding the default role to the request. However, the problem I am facing is that, one Manager approves the request, it is getting failed.
The Audit Log says that, the STAGE is "Completed" but I could also see "No Agent Found, Cancelling path XYZ (in stage no. 002- GRAC_ROLEOWNER)
May I know what I am missing here? Why I am getting error and how can I resolve it?
Please advise.
Regards,
Faisal

Hi Faisal,
sorry for late resposne I was away traveling.
default roles are being added by default to access request
Yes, these roles are added to the access request.
FN: OK
and this roles are following your normal paths which I guess assumes manager and role owner.
How such roles (not having role owner) will follow the normal path Manager->Role Owner if we are enabling routing (Rule ID: GRAC_MSMP_ROUTE_NO_ROLEOWNER) at manager stage level? Can you please help me understand this?
FN: OK If you enable routing it will go to routing path. I have understood your post as you put in question the behavior of default roles and my point was - they act exacly the same like regular roles.
- request is going to detour path
Does it answer my question?
FN: My point was default roles like all other will go to detur path (assuming you setup it globaly)
Deafault roles can have separate path (in my case) where only supervisor is approving it.
Instead of "GRAC_MSMP_ROUTE_NO_ROLEOWNER" I believe we can have our own rule to have a separate path for such default roles based upon business requirement. Correct me, if required.
FN; correct
It was design in way that initiator rule based on role crtivality is sending this rule to separate path without role owner.
Again, I believe you have enabled your custom rule here to achieve your business requirement instead standard rule id.
correct
If you do not have separate path - this role like any other will follow standard path you have.
Here, I had used a stage called "ZNO_STAGE_PATH" for routing the system line item, which does not have any owner. I used the same path ID for "GRAC_MSMP_ROUTE_NO_ROLEOWNER"Rule ID and it is working fine as of now.
FN: good
My question is that, do you think if I don't use "ZNO_STAGE_PATH" as Path ID for "GRAC_MSMP_ROUTE_NO_ROLEOWNER" Rule ID, should it follow the standard Manager->Role Owner path and these default roles get approved and assigned automatically?
FN: You should use the path ZNO_STAGE_PATH as path ID for routing rule.
If the role does not have role owner it will not allow you the even get to Role Onwer stage - request will be detured.
My point from the begining was - instead of using the routing rule - in our case we used separate path for default roles without role owner:) only consisted with manager stage. Again your approach is different but also will work.
Then which Path ID should I use for "GRAC_MSMP_ROUTE_NO_ROLEOWNER" Rule ID, as it is mandatory?
Should I use my current path for New/Change Account where at Manager level this was routed due to non availability of role owner?
Are you asking for default roles?
Please advise.
Regards,
Faisal

Defaults Roles Doubt - GRC 10.0

Hi All,
I have a query regarding default roles in GRC. In the role search screen when the user selects a role, there will be a defaults roles column which shows all existing defaults roles for different systems maintained in GRC.
Actually our client requirement is that when a user selects role for ECC only defaults roles defined for ECC should show up. But currently default roles column shows all defaults roles defined in GRC.
Is it possible to achieve our scenario? Anyone came across same issue?
Regards,
Sai.

Dear Sai,
the behaviour is standard as you have defined parameter 2011 as ROLE. To change the output you might need help of an ABAPler.
Alternatively you can change parameter 2012 to REQUEST and then the requestor won't see the default roles as they are added to the request after submission. Only the approvers can see the added default roles.
Best regards,
Alessandro

DEFAULT ROLE FOR USER

I swich to Oracle11g express and create user
CREATE USER LEO
IDENTIFIED BY xy
DEFAULT TABLESPACE USERS
TEMPORARY TABLESPACE TEMP
PROFILE DEFAULT
ACCOUNT UNLOCK;
-- 3 Roles for LEO
GRANT AUTHENTICATEDUSER TO LEO;
GRANT CONNECT TO LEO;
GRANT FER_ADMIN TO LEO WITH ADMIN OPTION;
ALTER USER LEO DEFAULT ROLE FER_ADMIN;
-- 1 System Privilege for LEO
GRANT CREATE SESSION TO LEO;
-- 1 Tablespace Quota for LEO
ALTER USER LEO QUOTA UNLIMITED ON USERS;
and after login i check
select * from SESSION_ROLES
and i have none role
if I set role all works fine.
Why I doesn't have DEFAULT ROLE after login.
Pleas for help .

here is the solution
default roles and grants
Edited by: Leo Lakota on 4.10.2012 5:52

How to get Default Role fron the EmployeeInfo

How i can get the default role from the EmployeeInfo object ?

When you search for "default role" in the SDK Helpcenter you will find that the Type property keeps this information...
I have to admit though that this is far from being intuitive
I only found it through checking the SQLs in MS SQL Profiler though.

RE: Default role config in CUP

Dear Experts,
I got a problem with default role configuration. Please help me in resolving the issue.
I want to configure defaults for all request types like new account and change account as well. Also I what the option "Create if user does not exist" to YES.
This means when ever change account workflow is executed for the existing users, default roles are getting assigned redundantly. is there any way to fix this problem.
My solution is to schedule "PRGN_COMPRESS_TIMES" job so that system will delete all redundant roles. Please advise if there is any other alternative. Client is insisting to have the option "Create if user does not exist"in Auto provisioning enabled.
I appreciate your help.
Thanks,
Raj

Hi
Set the below parameters it never assign the role for change request.
it is working in our system.
CUP---->Configuration->Roles>Default Roles-->Request type = New Hire

Default Roles or Group

Similar Messages

Maybe you are looking for