Dynamic LDAP groups

Hi All,
Weblogic Server 5.1 doesn't support dynamic LDAP groups.
Our experience shows that the same problem is present with WLCS 3.11
Is the problem solved in WS 6 and WLCS 3.5?
Kind Regards,
Panu Harkonen

Hello J.P.,
Note that LDAP realm v2 which is the default realm in WLS 6.1 can only show
group names in the WLS admin console, not the group members (LDAP realm v1,
the same realm in previous versions of WLS servers does show group members
in admin console).
From my understanding of dynamic groups they are still conceptually similar
to a regular group, albeit its members are stored differently. So with this
understanding I don't see why WLS 6.1 LDAP realm wouldn't be able to use
dyanmic groups. You can probably run a quick test yourself to see.
Regards,
BEA WebLogic Support
"Jose Perez" <[email protected]> wrote in message
news:3c838ce2$[email protected]..
>
Hi all,
Does anyone know if weblogic 6.1 supports dynamic LDAP groups?
Thacks in advance,
J.P.

Similar Messages

Dynamic LDAP Groups with WLS5.1

If I am using the Dynamic Groups feature of Netscape Directory Server
V4.1, can I use this to define a group using using the LDAP Realm.
Thanks
Ken
[kyoung.vcf]

Support for dynamic groups is not supported at this time.
Paul Patrick
"Ken Young" <[email protected]> wrote in message
news:[email protected]..
If I am using the Dynamic Groups feature of Netscape Directory Server
V4.1, can I use this to define a group using using the LDAP Realm.
Thanks
Ken

In human task, dynamically assign group doesn't work

Oracle SOA 11.1.1.4
My bpel process invokes a human task.
On the human task Assignment tab, I assigned 3 users (by name), 1 group (by expression).
The group is configured in LDAP
When I tested the bpel process, I entered the group and other data required.
From the worklist app, I see the task listed. It is assigned to the 3 users, but not the dynamically passed-in group.
From the Audit trail, I saw all data I entered (include the group). Everything seems correct, but I still can’t make the dynamically-pass-group work.
If I assign the group by name in human task, it works fine.
The problem is: dynamically assign group doesn't work.
Please kindly advice.

Yes, it is possible assign a group as participant of some human task, passing the group name as parameter.
I have tested just now.
It works pretty well in SOA 11.1.1.4 (BPEL or BPM).
Make sure add a data parameter in your human task definition and pass a valid group name to it.
At the Assignment tab, in the participants' list, add a group, data type by expression, and set the value to the right xpath expression to the corresponding parameter.
For example: /task:task/task:payload/task:group
If it is not working look the SOA log files, probably you'll find some information about the error there. Maybe there is some problem with your jazn.com configuration.
You can also test if there is something wrong related to the group name, trying to transfer some task to the same group by the worklist.

Dynamic Role -- Group Mapping not working in WebLogic 10

I have an installation I am migrating from 9.2 to 10. It uses Dynamic Role Mapping:
From my Weblogic.xml within the deployment:
    <security-role-assignment>
        <role-name>EELSSystemAdministrator</role-name>
        <externally-defined/>
    </security-role-assignment>I am using SPNEGO SSO, and it is working fine, it retrieves the principles from LDAP and adds them to the subject, so everything is fine there. I have defined the deployment constraint "EELSSystemAdministrator" as a Global Role, and then Added a condition "group" and set it to the LDAP Group (SMS EELSSystemAdministrator) which is one of the three principles being returned from LDAP.
When the Role mapper runs, it returns the following in the logs:
<SecurityRoleMap> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users, SMS EELSSystemAdministrator,SMS EELSReportAnalyst]>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(SMS EELSSystemAdministrator ,[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]) -> false>
<SecurityRoleMap> <primary-rule evaluates to NotApplicable because of Condition>
<SecurityRoleMap> <urn:bea:xacml:2.0:entitlement:role:EELSSystemAdministrator:top, 1.0 evaluates to Deny>
<SecurityRoleMap> <XACML RoleMapper: accessing role EELSSystemAdministrator: DENIEDIn my 9.2 Installation that is working I get the following in the logs:
<SecurityRoleMap> <Accessed Subject: Id=urn:oasis:names:tc:xacml:2.0:subject:group, Value=[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:string-is-in(SMS EELSSystemAdministrator,[everyone,users,SMS EELSSystemAdministrator,SMS EELSReportAnalyst]) -> true>
<SecurityRoleMap> <Evaluate urn:oasis:names:tc:xacml:1.0:function:or(true) -> true>
<SecurityRoleMap> <primary-rule evaluates to Permit>
<SecurityRoleMap> <urn:bea:xacml:2.0:entitlement:role:EELSSystemAdministrator:type@E@Furl@G@M@Oapplication@EEELSWeb@[email protected]@O$@S@VDSTAMP@S@W@M@OcontextPath@E@UEELS@M@Ouri@E@U, 1.0 evaluates to Permit>
<SecurityRoleMap> <XACML RoleMapper: accessing role EELSSystemAdministrator: GRANTED> I am not sure why my 9.2 deployment lists the role type as a "url" (which points to the right deployment, and 10 lists it as the word "top". Either way, it is not authenticating to my global role based on the Group returned from LDAP.
I'm pretty much out of troubleshooting idea's, having compared every config file/log file etc to find descrepancies in my setup. Anyone have any suggestions, perhaps something that has to be setup differently in 10 then in 9.2?
Thanks in Advance,
John

Update:
I checked a bunch of settings, and it seems to be working now, very odd.

RSA authentication with LDAP group mapping

Greetings,
I'm trying to set up RSA authentication with LDAP group mapping with ACS Release 4.2(1) Build 15 Patch 3.
The problem I'm having is that my users are in multiple OU's on our AD tree. When I only put our base DN in for User Directory Subtree on ACS, it fails with a "External DB reports about an error condition" error. If I add an OU in front of it, then it will work fine.
As far as I know, you can only use one LDAP configuration with RSA.
Any thoughts on this?

@Tarik
I believe your suggestion is the only way i'm going to get this to work. I ran across a similar method just this week that I have been working on.
I was hoping for dynamic mapping with the original method, but I haven't found any way to make it happen. I have resorted to creating a Radius profile on the RSA appliance for each access group I need. Using the Class attribute, I then pass the desired Group name to the ACS, i.e. OU=Admins, and that seems to work.
Thankfully, I have a small group of users that I am attempting to map. I will only map those who need elevated priviliges to narrow down how many profiles I will have to manually create. Likewise, our Account Admin will have to determine who gets assigned a particular access group.
I would still prefer to do this dynamically.
Scott

Dynamic Distribution Group set conditions by importing text file?

Exchange 2010 SP2.
I created a dynamic distribution group via the EMC. We have populated AD with ExtenstionAttribute1 and ExtensionAttribute2. I have created the ddg with custom attribute1 value = employee. What I need to do now is populate custom attribute
2 = 00-0001, 00-0002, and so on. There are about 300 of these numbers I need to add. I have them in a text file or csv file. Instead of adding them one by one in the EMC, is there a way to import them via powershell to the existing ddg?
The ddg is called All Management Employees.

If they go from 00-0001 to 00-0300, you could just add them as follows:
Set-DynamicDistributionGroup <group name> -RecipientFilter "(CustomAttribute1 -eq 'employee') -and (CustomAttribute2 -like '00-0*')"
However, if you have additional items like this (such as 00-0350, etc), you may need to use the following:
Set-DynamicDistributionGroup <group name> -RecipientFilter "(CustomAttribute1 -eq 'employee') -and ((CustomAttribute2 -like '00-00*') -or (CustomAttribute2 -like '00-01*') -or (CustomAttribute2 -like '00-02*') -or (CustomAttribute2 -eq '00-00300')"
Now, if your numbering isn't sequential and it can't be, you would need to add them individually - which may make your search filter unusable, in which case, you may need to create several dynamic groups and add them to a parent group.

Error while adding LDAP group

Hi, I configured LDAP authentication on BOXI R2 SP3 on IIS. The settings are as given below.
To change a setting, click on the value to start the LDAP Configuration Wizard. I have replaced few entries with XXXX and YYYY due to security.
LDAP Hosts: nccXXX.XXX.YYYY.XX.YY:636
LDAP Server Type: Novell eDirectory
Base LDAP Distinguished Name: ou=XXXXX,dc=YY
LDAP Server Administration Distinguished Name: cn=XXX,o=YYYYY
LDAP Referral Distinguished Name: ""
Maximum Referral Hops: 0
SSL Type: Server Authentication
Server Side SSL Strength: Always accept server certificate
Single Sign On Type: None
When I add any new group then its not added and I get below error message in the Logging directory for WCA.
Error: 2009-08-24 14:56:30, Thread:161, WriteData::_Flush catch unexcepted exception, source: System.Web, message: Specified argument was out of the range of valid values.
Parameter name: offset, stack: at System.Web.HttpResponseStream.Write(Byte[] buffer, Int32 offset, Int32 count)
at BusinessObjects.Enterprise.WebComponentAdapter.WriteData._Flush(IntPtr handle)
Can anyone help to find if LDAP is configured correctly before adding group?
Thanks,

Resolved. It was due to wrong LDAP group given to me.
Thanks,

Can an email address be a member of an LDAP group even if it isn't associated with an object in the Directory Server?

Can an email address be a member of an LDAP group even if it isn't
associated with an object in the Directory Server?
<P>
General members of a group are the members defined in the
Directory Server. They are full-fledged members of the group who
may have a set of permissions associated with their membership,
a title, or other attributes. Mail-specific users are users who
are not full-fledged members of the group, but who receive mail
sent to the group. Mail-specific users need not be identified as
a user in the Directory Server--an email address is sufficient.
An example of this is a group of salespeople, all of whom are in
the group "North American Sales Team." They have access to a
sales-tracking database, on-line quota information, and
competitive information. The mail-specific users of this group
are the admins who support the members of the sales team, who need
to get the mail that goes out to the group, but don't need access
to the applications and information that the salespeople do.

Hey EllyK,
Welcome to the BlackBerry Support Community Forums.
Thanks for the question.
I would suggest performing this workaround and then try to login to BlackBerry Link:
Open BlackBerry World on the BlackBerry smartphone and sign in using the BlackBerry ID.
Connect the BlackBerry 10 smartphone to the computer.
Open BlackBerry Link
Sign in using the BlackBerry ID.
Let me know if the issue still persists.
Cheers.
-ViciousFerret
Come follow your BlackBerry Technical Team on Twitter! @BlackBerryHelp
Be sure to click Like! for those who have helped you.
Click Accept as Solution for posts that have solved your issue(s)!

Mapping LDAP Groups to SAP Roles

Hi there,
i am trying to build up a synchron usermanagement with a LDAP-Server between EP, Web AS Java and Web AS ABAP.
My thought is to administrate the users in the LDAP-Directory. The users will be assigned to groups.
In EP and Web AS Java its no problem to assign these groups to roles and then just change the Users in the LDAP-Group and reach a synchron usermanagement.
In Web AS ABAP it seems impossible to assign roles to groups.
<b>The question is, is it possible to map ldap groups with the ldap connector of the web AS ABAP to Roles in an ABAP System?</b>
Or is there another way to administrate users in different systems?
Thanks alot for your answers,
stefan

Hi
in this case u have to use the concept of central user administration. use the following links
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/events/asug-biti-03/cua with sap webas, ldap and third party software
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/events/sap-teched-04/user management and authorizations overview.pdf
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/library/nw/dotnet/integration of sap central user administration into microsoft active directory.pdf
hope this helps u to get fair bit of idea
don,t forget to give points
With regards
subrato kundu

LDAP groups and WebLogic Roles - Urgent ( weblogic 6.1 sp1, iPLanet 5.1)

I have 2 questions and these are very urgent :-
1. Where the mapping can be defined between LDAP groups and WebLogic Roles. I have
2 groups in iPLanet :- Contarctors and employees and I have 2 security roles in weblogic:-
contractactors and employess. How do I map LDAP group contractors to weblogic security
Role contractors? Similarly for employees ?
2. I have not defined contarctors and employeees under People container in IPlanet.
e.g. The RDN for contractor is
uid=1234,ou=dir,dc=orams,dc=com
Can I still use the defualt security realm of weblogic (the WebLogic Security Realm
under People ) OR I have to write my own custom code ?
3. I am planning to use Roles insetad of groups to manage the logical grouping in
iPLant. Can I still use the groups in WebLogic security realm ( in the configuratin
parameters ?)
This is very urgent ....so if any of you can throw any hints that will be greatly
appreciated.
--Sunita

Hi Ariel,
The driver is bundled with the product in WLS 6.1sp1. you don't have to
download any additional driver. Use it as you normally would only thing to
remember is if you are trying to write standalone java code then you have to
have weblogic.jar in your classpath. For the rest of the info follow the wls
docs for 6.1
HTH
sree
"Ariel" <[email protected]> wrote in message
news:3bb4a643$[email protected]..
We want to connect our Weblogic 6.1 sp1 server to a SQLServer 2000 db. We
downloaded the JDriver from bea.com, but all the istructions that camewith
it are for WLserver 5.1.
What has to be done to do this with 6.1 sp1?
Thanks,
Ariel

Dynamic Distribution Group via csv file and Recipient Filter

Hello,
I am trying to create powershell command that will read a CSV file for "Name" and "Dept" and create a Dynamic Distribution Group based on the following Recipient Filter.
Import-CSV Dist.csv | ForEach-Object {New-DynamicDistributionGroup -Name $_.Name -RecipientFilter {((((((Department -like $_.Dept) -and (RecipientType -eq 'UserMailbox'))) -and (UserAccountControl -ne 'AccountDisabled, NormalAccount'))) -and (-not(Name -like
'SystemMailbox{*')) -and (-not(Name -like 'CAS_{*')))}
I keep getting an error that "Missing closing '}" in statement block Char:314. I added a "}" at the end of the command but then the command fails to read the .csv file.
Assistance would be greatly appreciated to determine what I am missing. I have over 100 Dynamic Distribution list to create.
Cheers

You're definitely missing a closing curly bracket.
You have a lot of superfluous parentheses in that expression. You could certainly simplify it.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

Dynamic Distribution Groups question

Can I create a dynamic distribution group based on Exchange Custom Attributes, specifically extensionAttribute6? I haven't used dynamic distribution groups yet, but now we have a need.

Hello,
Yes, it is possible. You can create dynamic distribution group using ConditionalCustomAttribute6 parameter: http://technet.microsoft.com/en-us/library/bb125127(v=exchg.150).aspx.

LDAP Groups Authorization

Hi,
I have read some of the forum threads about LDAP Group Authorization - I remain confused. Here's the problem I am trying to solve.
I was successfull in setting my Authentication to "Based on authentication scheme from gallery:Existing Login Page: Use LDAP Directory Credentials" -
That works fine, But I would not like all users in my OID LDAP directory to log into my application- Which is why I have created a group for the user I want to include in my OID directory.
Now at the " Builder->Application...->Security->Authorization Schemes->
I have created an Authorization Scheme as "PL/SQL Function returing a booloean" .
My Scheme Source(Identify Query or PL/SQL) is as follows and is set to "once Per session"
return wwv_flow_ldap.is_member
(:APP_USER,
null,
'cn=users,dc=wellesley,dc=edu',
'jadeland.wellesley.edu',
'389',
'wcd_HTMLDB',
'cn=portal.040323.1220,cn=Groups, dc=wellesley,dc=edu');
where in my LDAP directory, 'wcd_HTMLDB' is the subgroup under group "portal.040323.1220" -
I have included 3 users in the group 'wcd_HTMLDB' .
Still the login page allows all LDAP user ( and not just the 3 from the 'wcd_HTMLDB' group.
Where did I go wrong -?
What 's the proper way to authorise only LDAP users in a group ?
Any help would be really appreciated.
Thanks .

Indira,
The public synonym (and grant execute) must be created after that package is compiled which can happen after catldap is run in your database. This is only a problem if catldap has not been run before HTML DB is installed. That's described in the flows/doc/ldap.html file in the distribution directory (not very prominently, we know).
When you initially attached the authorization scheme to your login page and it wouldn't let you in, the reason is that it was using the value of APP_USER to drive your lookup function. But when the login page is rendered, APP_USER is null because you haven't logged in yet. So a user-based authorization scheme on a login page can never work.
When you changed the ldap username edit function the way you did, you achieved the goal of preventing an unauthorized user from using the login page to authenticate. Looks like the way it's set up is to give unauthorized users an authentication error, which is a little misleading (saying their credentials are invalid when in fact they are valid but they aren't authorized to use your application), but if it suits your purpose, great. You should consider that if you change the authentication method to, say Single Sign-On, you'll then want to use authorization schemes to keep unauthorized users out. So the authorization scheme that you first set about using would be fine in that case, so long as you adjust the code to allow for visits to public pages prior to authentication (v('APP_USER') = 'HTMLDB_PUBLIC_USER'). However, you'd want to attach that scheme to the application itself (Edit Application Attributes->Authorization) so it fires on every page. Evaluating a scheme like that on every page view rather that once per session probably works best, even better if you cache the result of the evaluation yourself for performance reasons, e.g., set an application item to some value the first time the authenticated user passes the ldap membership test, then using that item as an 'already passed' flag for subsequent invocations.
Finally, I assume you are using the built-in ldap_dnprep function because you need to replace '.' with '_' in the username value entered by the user. If that is not your requirement, let's talk.
Scott

Dynamically update grouping of store items - Sencha Touch

how can I dynamically update grouping of store items? Please help

Please follow the steps:
set gouper again,
store.setGrouper({
groupFn : function(record) {
return record.get('fieldname');
Gracie

Cannot Add user to CMC Group when they are a member of LDAP group

On PreProduction Server CMC
Softerra LDAP browser used to verify user is a member of LDAP group
User does not show as a member of that group in the CMC
Cannot add user to LDAP group showing in CMC, the same group shows the member in LDAP browser
On Production Server CMC
For kicks I logged into the CMC on Production and I found the user is correctly showing as a member of the Group
Why doesn't the groups in CMC show what is actually showing in the LDAP browser?

Hi,
Check if you have also mapped in both servers the same groups. It might be that there are some groups missing in the Pre-prod.
Also, try restarting the CMS. I have seen similar issues that are solved after forcing the recreation of the graph.
If after the restart you still can't see the groups, check the mapping on the LDAP server. It might be that both servers do not use the same attribute mappings.
Regards,
Julian

Dynamic LDAP groups

Similar Messages

Maybe you are looking for