Deploy authenticate VPN using LDAP AD (with user group)

Hi,
I'm stucking in configuration of LDAP Server with authenticate for VPN user using group in Windows Domain. I would like to create a group like "vpn-group" in Domain. If someone want to vpn, I just have to add that user in the group "vpn-group" then I can connect to the company.
Here is my configuration
aaa new-model
aaa authentication login userauthen local group ldap
aaa authorization network groupauthor local
ldap attribute-map map1
map type sAMAccountName username
ldap server server1
ipv4 192.168.0.5
attribute map map1
bind authenticate root-dn cn=administrator,cn=users,dc=test,dc=local password 7 0235114B0E144E621518
base-dn cn=vpn-group,cn=users,dc=test,dc=local
Please advice me.

I got it working by including the AD security group in the search-filter
search-filter user-object-type User)(memberOf=CN=vpn-group,OU=Security groups,OU=company,DC=test,DC=local

Similar Messages

Problem about SSO using logon ticket with user mapping

Hi everyone ,
I had done SSO with Portal , BW and R/3 system.
I use logon ticket with user mapping .
When user name is same in Portal as in R/3 system, or user name is same in Portal as in BW , user can access R/3 transactions and BW report without logon.
There are some Portal users name which are different with R/3 user and BW user. And I done the user mapping for these user.
But some user mapping works fine,but most of them can't work,means that most of them need to enter mapped user ID and password.
What's the reason?
When SSO using logon ticket with user mapping, the Portal user which is different with R/3 user and BW user, can they access R/3 transaction iview and BW report iview without logon?

Hi Chen,
What you have done is correct. But the problem lies here.
Since you are using the same system object for accessing the iview, where the ticket method is set to SAPLOGONTICKET in the user Management property of the system object.
To avoid this create another system object like the previous one but set the logon method to UIDPW and select admin, user from the drop down box. Also create a system alias for this system.
Now create another iview like the previous one but link this iview to the new system. Now do the user mapping for the users which are different in portal compared with R/3. Now you should be able to login without any problems.
Another important point is login to portal with Fully qualified domain name. In the ITS property of the system object also give the FQDN.
Hope this helps
Regards
Arun

OIM 10g Event Handler : Integrated with User Groups.User Members

I have created custom event handler and integrated it with User Groups.User Members data object.
here is my code od event handler class:
public class GroupEventHandler extends tcBaseEvent {
     public GroupEventHandler() {
          this.setEventName("Event Handler Sample");
     protected void implementation() throws Exception {
          System.out.println("============@@@@@@@@ IN EVENT HANDLER ");
          try
          String groupKey = this.getDataObject().getString("Groups.Key");
          writeToFile(groupKey);
          catch (Exception e)
               e.printStackTrace();
But I am getting this exception :
ERROR [ACTIVE] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)' XELLERATE.SERVER - Class/Method: tcTableDataObj/getString encounter some problems: Column 'GROUPS.KEY' not found
com.thortech.xl.dataaccess.tcDataSetException: Column 'GROUPS.KEY' not found
     at com.thortech.xl.dataaccess.tcDataSet.getColumnIndex(Unknown Source)
     at com.thortech.xl.dataaccess.tcDataSet.getString(Unknown Source)
     at com.thortech.xl.dataobj.tcTableDataObj.getString(Unknown Source)
     at oim.GroupEventHandler.implementation(GroupEventHandler.java:19)
     at com.thortech.xl.client.events.tcBaseEvent.run(Unknown Source)
     at com.thortech.xl.dataobj.tcDataObj.runEvent(Unknown Source)
     at com.thortech.xl.dataobj.tcDataObj.eventPostInsert(Unknown Source)
     at com.thortech.xl.dataobj.tcUSG.eventPostInsert(Unknown Source)
     at com.thortech.xl.dataobj.tcDataObj.insert(Unknown Source)
     at com.thortech.xl.dataobj.tcDataObj.save(Unknown Source)
     at com.thortech.xl.dataobj.tcTableDataObj.save(Unknown Source)
     at com.thortech.xl.ejb.beansimpl.tcGroupOperationsBean.addMemberUsers(Unknown Source)
     at com.thortech.xl.ejb.beans.tcGroupOperationsSession.addMemberUsers(Unknown Source)
     at com.thortech.xl.ejb.beans.tcGroupOperations_ejm77u_EOImpl.addMemberUsers(tcGroupOperations_ejm77u_EOImpl.java:1671)
     at Thor.API.Operations.tcGroupOperationsClient.addMemberUsers(Unknown Source)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at Thor.API.Base.SecurityInvocationHandler$1.run(Unknown Source)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
     at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
     at weblogic.security.Security.runAs(Security.java:41)
     at Thor.API.Security.LoginHandler.weblogicLoginSession.runAs(Unknown Source)
     at Thor.API.Base.SecurityInvocationHandler.invoke(Unknown Source)
     at $Proxy66.addMemberUsers(Unknown Source)
     at com.thortech.xl.webclient.actions.UserGroupMembersAction.assignMemberUsers(Unknown Source)
     at com.thortech.xl.webclient.actions.UserGroupMembersAction.assignGroupMembers(Unknown Source)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at org.apache.struts.actions.DispatchAction.dispatchMethod(DispatchAction.java:280)
     at com.thortech.xl.webclient.actions.tcLookupDispatchAction.execute(Unknown Source)
     at com.thortech.xl.webclient.actions.tcActionBase.execute(Unknown Source)
     at com.thortech.xl.webclient.actions.tcAction.execute(Unknown Source)
     at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:484)
     at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:274)
     at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1482)
     at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:525)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
     at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
     at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
     at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
     at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26)
     at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
     at com.thortech.xl.webclient.security.SecurityFilter.doFilter(Unknown Source)
     at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56)
     at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3592)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
     at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
     at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2202)
     at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2108)
     at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1432)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)

Anyone have idea about why "Groups.Key" not found exception thrown here..
I have assigned this event handler at postinsert event of User Groups.User Members Data Object.

Variations issues with User & Group Site Column value

Hi all,
I have created variation sites. e.g. http://mydomain/en-us for english & http://mydomain/de-de for german language. I have created custom page layouts. This page layouts are based on custom content types. I have created a column called "User"
which is type of "User/Groups". I am registering this column to my page layout. http://mydomain/de-de is my default site.
Now I am editing column called "User" on page & save it. It saves data properly. But when I am propagating these changes to another site that is http://mydomain/en-us. It shows me all controls with values filled. but with "User"
column, its showing me blank value.
Any suggestion. ?
Thanks in advance.

http://webcache.googleusercontent.com/search?q=cache:kNlxGIj5f1kJ:sjoere.blogspot.com/2007/11/5-reasons-why-you-should-not-use.html+&cd=2&hl=en&ct=clnk&gl=in
Content types not propagated
Risk
When you add a content type to a page library in the variation source, this type is not automatically propagated to the other labels (see
my previous post). If you then create a page with that content type in the variation source, it does get published to the other labels but loses its content type field values.
Proposed solutions
Set up your site via a site definition that already contains the proper content type bindings to the page libraries. All labels will use the same content types
Put a good governance plan in place to make sure manual changes are done in every label
If this helped you resolve your issue, please mark it Answered

Assignments to collection with user groups seems to be failing

We have a collection with users and a collection with groups. We assign a simple application to a collection with users, that seems to be fine, we can see the app in the application catalog. We then assign the same app to a collection with just a security
group in the collection, the members of that security group cannot see the app in the application catalog.
I am trying to trace what the server does when a the request user policy comes in, to see if there is a disconnect between the assignments and the members of the group.
Any ideas how to debug/troubleshoot this issue?

Hi,
Some troubleshooting tips for client communication to the Application Catalog:
Ensure that the Configuration Manager client is successfully assigned to a site and operational by checking LocationServices.log and ClientIDManagerStartup.log.
Verify that the client can communicate with the management point. For example, check out any HTTP errors in the CcmMessaging.log file.
Check the LocationServices.log file for any errors during the time you browsed to the Application Catalog. One typical reason for Application Catalog failures in this log is client communication failures to the management point, indicated by the following
error: “Failed to send web service info Location Request Message.” In this case, verify that the management point is operational and reachable from the client computer.
If you have recently installed the Application Catalog roles, the configuration on the site system server might take some time to complete. If you have a central administration site, make sure that sites are replicating successfully. In this scenario, information
about the Application Catalog roles must replicate to the central administration site and then back to the primary site before the Application Catalog is fully operational. For example, until the replication is complete, users will not be able to request or
install applications from the Application Catalog.
Ensure that the domain and user name that is displayed in the top right corner of the Application Catalog matches the user that is logged in to Windows, especially if Internet Explorer prompts the user for credentials.
Ensure that any required Internet Explorer plugins are enabled and not explicitly blocked in Internet Explorer. For more information, see
Prerequisites for Client Deployment in Configuration Manager on TechNet.
If you have configured client settings to add the URL to the trusted sites and the URL is not added to the trusted sites zone, check whether the client successfully downloads client policy and also check group policy settings in your environment to ensure
that the Configuration Manager client can add the URL to the trusted sites zone.
If the Application Catalog shows an error page, the error will also be displayed in the ConfigMgrSoftwareCatalog.log. You can find the log file by searching the user profile folder. For example, in Windows 7, you can find the log file inside the following
folder:
%systemdrive%\Users\<username>\AppData\LocalLow\Microsoft\Silverlight
For more infomation, please review the link below:
Tips and Tricks for Deploying the Application Catalog in System Center 2012 Configuration Manager
http://blogs.technet.com/b/configmgrteam/archive/2012/07/05/tips-and-tricks-for-deploying-the-application-catalog-in-system-center-2012-configuration-manager.aspx
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Problems with user group

Hi, i created a new user group with some administrative rights:
Access Administration
Advanced Document Submission
Create Communities
Create Community Infrastructure
Create Folders
Create Portlets
Edit Own Profile
Then, i created a user and added to this group.
When i login with the user i created, the Administration Tab doesn't appear.
Somebody can help me please.
IT'S URGENT !!!!
Thanks

I thought access administration was all that was required. Did you get it resolved. Usually these things clear themselves up with time.

Problem with user group querys in transaction Ad-Hoc-Quey

Hello experts.
I have one doubt, i need to know how when I execute transaction S_PH0_48000510 (Ad-Hoc-Quey), like obtaining that by defect appear querys of a certain user group. I have tried with the user's parameters AQB, AQQ, AQW but nothing works. Can help me somebody?
Thank you very much.
Regards.

Hi Marcos,
Your approach is correct. You set the User Parameters AQW for the Query Area (Standard or Global)AQB for the User Group and AQS for the Infoset. This is set for each individual in their own User Parameter tab (System --> User Profile --> Own Data). This will default the infoset and queries you want. The first screen will appear blank as you enter Ad Hoc Query, but if you click on the Open Folder icon you will see the list of saved queries for that User Group and Infoset. AQQ will give you a particular query every time.
You must make sure the User is assigned to the User Group via SQ03.
Paul

[OIM] Cannot use special character in User Group Name

Dear IdM expert,
I have problem creating user group in OIM if user group name contain special character like '&', '<' or '+'.
I read Note 430081.1 : Can a Field Label in an Object Form Contain Special Characters? and change <AppFirewall><SecurityLevel> in xlconfig.xml to 0, (by default SecurityLevel is set to 1). But still no luck.
Could anyone find way to do this? Thank you.
Best Regards,
Satit

I don't think the app fire wall applies to recon events so that is probably how they got in.
You may have to update the database tables directly to solve this. Should not be a big issue as you aren't messing with any table primary keys.
Best regards
/Martin

List of users with user group

Hi,
I wonder why in all existing users lists I know I don't see the user group they are assigned to.
I have no problem to get the users by user group (su10) but what I need is a list of all users (name,adress,...) + user group they are created in.
I have tried RSUSR002 without success.
By the way, what's the difference between "Group for Authorization" and "User Group (General)". My user groups appear in both.
Thanks in advance to help a security officer rookie.
Regards,
Julien

Hi julien,
Please have a look at BAPI_USER_GET_DETAIL. Its a function module so execute it using se37.
i.e., SE37->BAPI_USER_GET_DETAIL->EXECUTE.
Type the userId in the Username field (In Import Parameters), than execute. Expand LogonData (In export parameters), this would display the usergroup as well.
Please award points if it is useful.
Thanks & Regards,
Santosh

HT3231 Problem with User & Group panel

I cannot open the 'User & Group' panel. I get Could not load Users & Groups preference pane." How do I fix this?

Launch the Console application in any of the following ways:
☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)
☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.
☞ Open LaunchPad. Click Utilities, then Console in the icon grid.
Make sure the title of the Console window is All Messages. If it isn't, select All Messages from the SYSTEM LOG QUERIES menu on the left. If you don't see that menu, select
View ▹ Show Log List
from the menu bar.
Click the Clear Display icon in the toolbar. Then try the action that you're having trouble with again. Select any messages that appear in the Console window. Copy them to the Clipboard (command-C). Paste into a reply to this message (command-V).
When posting a log extract, be selective. In most cases, a few dozen lines are more than enough.
Please do not indiscriminately dump thousands of lines from the log into this discussion.
Important: Some private information, such as your name, may appear in the log. Anonymize before posting.

Using nested tables with User Defıned Types.....

Hi All,
I defined TEST_1 User Defined Type where VALUE_PART field is a VARCHAR2 type.
CREATE TYPE TEST_1 AS OBJECT (
               x NUMBER,
               y NUMBER,
     VALUE_PART VARCHAR2(50)
This TEST_1 object type will be used as nested tables in the EMPLOYEE table where each attribute might require different bytes of VARCHAR2’s in the VALUE_PART field.
CREATE TYPE NAME AS TABLE OF TEST_1;
CREATE TYPE ADDRESS AS TABLE OF TEST_1;
CREATE TYPE DEPARTMENT AS TABLE OF TEST_1;
CREATE TABLE EMPLOYEE (
SSN NUMBER,
NAME TEST_1,
ADDRESS TEST_1,
DEPARTMENT TEST_1,
SALARY NUMBER
NESTED TABLE NAME STORE AS NAME_TABLE;
NESTED TABLE ADDRESS STORE AS ADDRESS_TABLE;
NESTED TABLE DEPARTMENT STORE AS DEPARTMENT_TABLE;
Is it possible to specify VALUE_PART(50) in the TABLE OF statement?
Is there any way to do that throught methods or some other ways that I may not be aware of?
For Example:
/*This should allocate 10 bytes of VARCHAR2. */
CREATE TYPE NAME AS TABLE OF TEST_1(10);
/* and 30 bytes of VARCHAR2. */
CREATE TYPE ADDRESS AS TABLE OF TEST_1(30);
/*and 10 bytes of VARCHAR2. */
CREATE TYPE DEPARTMENT AS TABLE OF TEST_1(10);
Any help is appreciated.
Thanks a lot.

Hi,
We can not specify VALUE_PART(50) in the TABLE OF statement.
Regards,
Sailaja

Calling report using Mapping File with user parameters

Please provide an example of Key mapping file that provides user parameters to an Oracle Reports report, where paramform=no.
I call an Oracle Reports report via APEX, and can't get the URL to work. If I don't use the mapping file, the call works. But I can't seem to get it to work using the mapping file to hide all the other params like userid etc.

Please provide an example of Key mapping file that provides user parameters to an Oracle Reports report, where paramform=no.
I call an Oracle Reports report via APEX, and can't get the URL to work. If I don't use the mapping file, the call works. But I can't seem to get it to work using the mapping file to hide all the other params like userid etc.

Using share function with Site Groups

Hi,
When we share a file with someone in SharePoint 2013, the user will receive an email generally.
I have observed that when we put a sharepoint group rather than a single user in the sharing pane, the email doesn't go to everyone in the group.
Can we configure it so that an email is sent out to everyone in the group. In other words to entire group.
Thanks.

Hi Prajk11,
In SharePoint 2013, the ‘Share With’ function cannot send emails to groups, can only send to individuals. It is by design. The only workaround I found is that we use Share With function for each people in this group instead of the group.
Best Regards,
Wendy
Wendy Li
TechNet Community Support

How to Use Switch Statement with Exclusion Group (radio buttons)?

Wouldn't you know, just when I though I'd really be making progress, I've come across another problem I can't solve. In a homeowners insurance application I am building, there is an exclusion group that needs to set the value of several variables
I have setup in the form properties/variables. These variables take on different values depending on the users choice. For the exclusion group, in the object pallet, I have set the binding to normal, and have checked the "Specify Item Values" check box. Also the values for the choices have been assigned 1,2,3,4,5.
Here is my code for the change event fir the exclusion group (This is exactly what I have tried). For now, the values for the variables to take on in the different cases, are completely arbitrary.
switch (this.change.rawValue)              // I have tried so many things here
    case "1":                                        // I have tried the caption, single quotes in all combinations
        addLivingExp = "1";
        damageOthersProperty = "2";
        liabilityIncl = "3";
        maxCoverage = "4";
        minCoverage = "5";
        persProperty = "6";
        relatedPrivateStruct = "7";
        break;
    case "2":
        addLivingExp = "10";
        damageOthersProperty = "20";
        liabilityIncl = "30";
        maxCoverage = "40";
        minCoverage = "50";
        persProperty = "60"
        relatedPrivateStruct = "70";
        break;
    case "3":
        addLivingExp = "100";
        damageOthersProperty = "200";
        liabilityIncl = "300";
        maxCoverage = "400";
        minCoverage = "500";
        persProperty = "600"
        relatedPrivateStruct = "700";
        break;
    case "4":
        addLivingExp = "1000";
        damageOthersProperty = "2000";
        liabilityIncl = "3000";
        maxCoverage = "4000";
        minCoverage = "5000";
        persProperty = "6000"
        relatedPrivateStruct = "7000";
        break;
    case "5":
        addLivingExp = "10000";
        damageOthersProperty = "20000";
        liabilityIncl = "30000";
        maxCoverage = "40000";
        minCoverage = "50000";
        persProperty = "60000"
        relatedPrivateStruct = "70000";
        break;
    default:
        minCoverage= 5;
        break;
There must be something obvious I am missing? Eternally grateful for advice on this.
Stephen

There are two issues in this script:
1. You are not using the accessor 'value' to set form variables
2. You are not correctly getting the value of the radio button list in the switch clause
Please see the working script below.
Ben Walsh
www.avoka.com
switch (this.rawValue)
    case "1":
        addLivingExp.value                  = "1";
        damageOthersProperty.value   = "2";
        liabilityIncl.value                      = "3";
        maxCoverage.value                 = "4";
        minCoverage.value                  = "5";
        persProperty.value                  = "6";
        relatedPrivateStruct.value        = "7";
        break;
    case "2":
        addLivingExp.value                  = "10";
        damageOthersProperty.value   = "20";
        liabilityIncl.value                     = "30";
        maxCoverage.value                 = "40";
        minCoverage.value                  = "50";
        persProperty.value                  = "60"
        relatedPrivateStruct.value        = "70";
        break;
    case "3":
        addLivingExp.value                 = "100";
        damageOthersProperty.value   = "200";
        liabilityIncl.value                     = "300";
        maxCoverage.value                 = "400";
        minCoverage.value                  = "500";
        persProperty.value                  = "600"
        relatedPrivateStruct.value        = "700";
        break;
    case "4":
        addLivingExp.value                  = "1000";
        damageOthersProperty.value   = "2000";
        liabilityIncl.value                      = "3000";
        maxCoverage.value                 = "4000";
        minCoverage.value                  = "5000";
        persProperty.value                  = "6000"
        relatedPrivateStruct.value        = "7000";
        break;
    case "5":
        addLivingExp.value                  = "10000";
        damageOthersProperty.value   = "20000";
        liabilityIncl.value                      = "30000";
        maxCoverage.value                 = "40000";
        minCoverage.value                  = "50000";
        persProperty.value                  = "60000"
        relatedPrivateStruct.value        = "70000";
        break;
    default:
        minCoverage.value                 = 5;
        break;

[solved] Bash shell... does not start with user name, but used to...!

when I start a console, logged in as user, it always used to start with
user@hostname ~$
Suddenly, and I cannot recall having done anything that could lead to the issue, konsole will always start as
bash3.2$
even after many reboots, this is still the case.
whoami shows my user name. I can su to root, and from there to my username, but never directly from bash.
Occasionally, starting a program like KDE partition manager fails with the error message the program su could not be found. but it is as I said occasional.
I am quite a newbie to Linux, so I am clueless. Can someone help me..? I tried googling, but I seem to be the only one in the WWW that goofed up to such an extent..! and searches are quite unrevealing.
I am installing Linux From scratch using arch linux as base system, but I am just following The Book to the letter and don't think that caused the problem.
Last edited by jaydoc (2009-01-26 09:12:56)

@weasel8...
That is THE trouble. And I take back my words, it was during the linux from scratch install that I botched that file...! I was supposed to make a new bashrc file in the LFS directory, but I went wrong on the commands and I think I ended up removing the Arch Linux file...!
If it is to be found, it should be in the etc directory, right..? I looked there and could not find it. Did I look in the right place...?
What can I do...?
Last edited by jaydoc (2009-01-26 07:33:14)

Deploy authenticate VPN using LDAP AD (with user group)

Similar Messages

Maybe you are looking for