EP 6.0 SP2 KM Access control and version problems

Hi,
We have installed EP 6.0 SP2 and have configured KM. We have created a File system repository pointing to a shared folder in the local drive. Now, we are facing the following 2 problems:
1. Access Control for Resources (folders and files) are not working..i.e, even though, we have given 'Read' access to a particular folder for a given portal user, he is still able to delete, rename, etc. How do we tackle this? Is there any property to be set for ACL to work.
ACL Manager Cache : ca_rsrc_acl
Security Manager : AclSecurityManager
are used for this particular file system repository.
2. For the very same file system repository, we are not able to get the option 'versioning' for any of the folders. while for other folders in Content Management (CM) repository, 'versioning' property appears. Why is this so? Is there any setting to be done for the property 'versioning' to appear for a file system repository?
Any help in this regard is highly appreciated.
Thanks in advance,
Pavithra

Hi,
Thanks so much for the quick response. It was quite helpful. The problem is that while trying to set up W2Ksecurity manager, the system component monitor shows the following error:
Startup Error: Exception during start up of sub-manager: The W2kSecurityManager can only be run under Windows 2000 operating systems.
Portal server is installed on Microsoft Windows 2003 server. But the file system repository is mapped to a shared drive whose host machine runs Microsoft windows 2000 professional.
My Questions:
1. Do I have to have Microsoft Windows 2000 ONLY for portal installation.
2. Can I not have a shared folder mapped to another local machine's directory
3. Also, Any ideas on whats the max length of file path for KM..Because, its likely that the file path length may extend to more than 200 characters..
Please help me in this regard.
Thanks in advance.
Pavithra

Similar Messages

Difference between SAP Access Control and IDM

Hi Expert,
I have one question What is the difference between SAP Access Control and SAP Identity Management ?

Ali,
That's a good question, but a tough one.
While both applications can do most of what the other can do, it's a matter of specialization in my opinion.
Access Control is all about managing and controlling access to SAP system roles and has the ability to report on role conflicts for compliance and reporting purposes. (I'm sure I'm leaving a lot out, but maybe a GRC / AC expert can fill in more details)
SAP IDM is about managing the user life cycle with regards to landscape and enterprise systems. It will handle the creation, update and ultimately the removal (or de-provisioning) of users in SAP ABAP, SAP JAVA, LDAP, JDBC, and API based applications. It will also do Role Management through a web based UI (User management is web based as well). and as of the latest Service pack for SAP IDM 7.2, it will do attestation (limited certification) as well. It is a definite upgrade to CUA as it will work with a greater variety of systems, include workflows and approvals.
GRC will do some provisioning, but it's somewhat limited, as is IDM's compliance abilities.
The applications are designed to work together, however it does not have a great track record and the integration is typically heavily modified to work as desired.
If you have specific questions, feel free to post / DM. Obviously I am more knowledgeable about IDM, but I'll be happy to help you in any way possible.
Regards,
Matt

Time Capsule Access Control and Extended Network Question

I have a Time Capsule where I have set up a wireless network access list…and extended the network using an Airport Express unit. The Airport Express unit also has settings for an Access Control list. Do these need to be the same as the those for the network from TC that it is extending…or does that happen automatically…and if not what on earth are they for?
Thanks for any help…this doesn't seem clear from what I've read/seen.
James

I have a Time Capsule where I have set up a wireless network access list…and extended the network using an Airport Express unit. The Airport Express unit also has settings for an Access Control list. Do these need to be the same as the those for the network from TC that it is extending…or does that happen automatically…and if not what on earth are they for?
Unfortunately, they are not automatically applied to each base station in an extended network. You would have to manually enter the exact same list in each base station.

User access control and WebStart

I'm considering tools and utils for a new project and WebStart looks like it could suit our needs just perfect.
Just one little question:
If I have a system with multiple applications controlled by WebStart, is it possible to restrict user access?
I need to be able to present different selections of applications to different types of users, is this possible to configure/code for WebStart?
Thankful for pointers

At what point do you want to treat different users
differently (like allowing access to different apps)?
Possible points could be:
- at the webserver level (different download pages,
that are access protected)
- different Web Start application caches (as far
as I understand under Win32 all users share
one cache - but this seems subject to some
property configuration in WebStart)
- within the application (the app expecting different
license keys, passwords or such)
- within Web Start (Web Start utility asks for password,
this could be achieved by writing a custom jnlp
client - think openjnlp as example
http://openjnlp.nanode.org/)
I think the first two options are not useful, as
users might get the application somewhere else
and just copy it onto their box - this is also
true for the last option.
So I would put access control into the applications
themselves.

MS Access 2010 and TFS problem when I try to "create form team foundaition"

I am using MS Access 2010 and trying to use TFS for source control.
I installed MSSCCI for 2010 and the "Access Developer Extensions"
I am able to create a project in TFS and check in and check out access objects.
My only problem is when I click on "Create from Team Foundation" it asks me to specify the server and when I click OK it gives me the following error message:
"Cannot create a new Microsoft Access database from this source code control project. It contains neither a Data and Misc. objects file nor a database name file."
I have tried different ways and could not get it to work.
Thanks for your help

Did you figure out a solution for this!>?
I am having the same issue. I can issue a GET and bring down all the objects (including the very files that it says it can't find) - then when "creating from team foundation" I get the same problem.
https://social.msdn.microsoft.com/Forums/en-US/704a18d7-6687-49c2-8830-a24aa794303e/tfs-2013-with-access-20072010-cant-create-a-local-tfs-copy?forum=tfsgeneral

Role Based Access Control and FIM

Hi,
Would these statements about RBAC and FIM (not BHOLD) be true:
RBAC in FIM Sync is essentially governed by the built-in FIM Groups (e.g. FIMSyncAdmins, etc)
RBAC in FIM Portal is essentially governed by FIM Portal Sets & MPRs
Thanks,
SK
PS. not looking at BHOLD above, just FIM

This can be true in a narrow sense. If we are just thinking of access to FIM and not on the managed organizational resources.
FIM Synch:-
Through FIM Synch groups, we are just controlling the access to FIM Synch service. We are not separating access based on roles(say organizational role).
For FIM Portal, again it can be true if we are thinking of access to FIM Portal only and not the managed organizational resources.
Thanks,
Mann

Online file storage with access control and file manager integrated to APEX website

I have APEX 4.2 website with few user accounts. I would like to share approximately 100 GB of documents to users. Some documents will be public (in some public folder) and everyone with account in my website will be able to download that public files. And some files/folders will be with restricted access and only user with appropriate credentials will be able to download it.
I would like to find some cheap cloud file storage.
Some storage that offers plugin/component = file manager that will be integrated to my APEX website and authentication will be transparent to my users (authentication with some API or URL). Every user will see only his files. I want some ready to use component and call only minimum API.
I would like to integrate that storage to my website or call some user specific URL and redirect my user to some page with file manager.
All files will be read only for all users.
Thanks for some tips

what will you be using for your file manager? Or do you even know yet?
I do not have tons of experience but if I had to come up with a solution I would build the interface with APEX and use the database to store the files inside so you can control access.
You can create a procedure that takes in parameters like username, session id, encrypted session id from the browser cookie and either return the file or give the user an error message letting them know they arent authorized. You could use plugins to give the users a better file managing experience like the 'multiple file upload' plugin that allows AJAX based multiple file uploading.
Id put this on an amazon EC2 cloud micro instance. It's uber cheap.

MS ACCESS, ColdFusion and Image Problems

I have done this before using PHP and Mysql and it was pretty
simple. I now need to do this in ColdFusion and MS Access 2003.
I want to store logos in a database. After reading up on it,
I found that you store images in Access using the OLE Object
Datatype - done. Now the real fun part starts.
I am trying now to display these logos from the MS Access
2003 database onto a webpage using Coldfusion. I have looked into
it, and one article suggested using the BLOB type - which is what
you do in MySQL, but in MS Access that option is not available. So
I looked into it somemore, and it seems that there are three
functions that you need to use, and they are in Visual Basic -
provided in part by Microsoft, but it seems EXTREMELY way too
complicated for simply displaying an image staored in a Database.
Has anyone been able to store and display images using MS
Access and Coldfusion before? If so, could you guide me?

The reason for storing the image in the database is that our
company wants it that way for portability reasons. Filenames
change, directories get lost when moving from one system to
another. Databases are easier to backup and are more efficient when
it comes to searching metadata. We have over 300 logos we must
store for our different organizations - having a directory for each
is complicated.
Has anyone had issues like this with Coldfusion and MS
Access? If so could you guide me?
-Thanks

Quick control and Autoreview problems

Hi all,
I have been loving my rebel t5i for the past several months, but have just started having a weird problem with the quick control screen and the autoreview features. It's strange, but when I push the Q button while in viewfinder mode, it doesn't pull up the quick control screen any more. However, the Q button works fine on image review and while in live view mode. Also, after taking a photo, the image no longer pops up for view automatically, though it pops up just fine when I push the review button.
Anyone else dealt with this problem? Since the button appears to be fine and the LCD is fine, I can only think of the accelerometer as a problem since I think this controls both of these. Any other thoughts or advice? The camera is only 3 months old and I got it through the ritz camera amazon store.
Thanks

One last thought.
On some cameras, there is a little sensor near/above the eye cup called the Display Off Sensor. Yours has one. It senses when you have the camera up to your face. It shuts the LCD off. Sometimes the little thing gets dirt, makeup over it, or padded eyecup slips and covers it, or the camera strap covers it while on tripod sideways, and it thinks you have the camera up to your face, and the LCD shuts off.
See if maybe that could be it? Clean the little sensor, then enable (un disable? Re-enable?) the display shutoff you disabled. It might work.
Scott
Canon 6D, Canon T3i, EF 70-200mm L f/2.8 IS mk2; EF 24-105 f/4 L; EF-S 17-55mm f/2.8 IS; EF 85mm f/1.8; Sigma 35mm f/1.4 "Art"; EF 1.4x extender mk. 3; 3x Phottix Mitros+ speedlites
Why do so many people say "fer-tographer"? Do they take "fertographs"?

Mission Control and Expose Problems

All of a sudden my mission control gestures have stopped working. Three fingers up did expose all the windows, but not all the desktops. After restarting my computer, the three fingers up or down doesn't work at all, and the launchpad doesn't make the background disappear as it used to. I tried multiple ways of fixing the issue, including turning all the gestures off and restarting and turning them all back on. Can anyone help me fix this? It is a real pain. Also, three fingers side to side still switches between the desktops.

Four fingers does bring me to mission control, but there is no bar at the top that shows the desktops that I have made. Also, sometimes it glitches and all the windows disappear for a few seconds until I go back and forth across all the desktops a few times. I remember when I went into launchpad before the windows I was working on would fade away, and they don't do that anymore either.

How to access autosave and versions

i have upgraded to lion but when i acess pages and click the title bar the options for autosave and verisons arent there how do i get them?

Autosave is automatic, if the app supports it. What version of iWork are you using? Mine is '09 and it works. As for versions, here is a post with a very good explanation. Essentially, you click on the name of the document at the top of the title bar and a triangle appears that puts you into a time machine-like interface.
https://discussions.apple.com/thread/3192820?start=0&tstart=0

Weblogic SAAJ implementation and version problem

I have a problem with Weblogic 9.0 using its own implementation over the one i provide.
          I have tried putting the saaj-api.jar and saaj-impl.jar in my domains lib/ catalog as well as the domains config/lib/ catalog.
          I also tried PRE_CLASSPATH in setDomainEnv.cmd but it seems the weblogic implementation is being used anyway!
          Any ideas how to solve this?
          Here are a couple of exceptions i get after a context lookup and getConnection of the resource adapter:
          Caused by: javax.xml.soap.SOAPException: Unable to create SOAP connection factory: com.sun.xml.messaging.saaj.client.p2p.HttpSOAPConnectionFactory
               at javax.xml.soap.SOAPConnectionFactory.newInstance(Unknown Source)
                              I also tried adding a property value:
                    System.setProperty("javax.xml.soap.SOAPConnectionFactory", "com.sun.xml.messaging.saaj.client.p2p.HttpSOAPConnectionFactory");
                    in the web app before doing the context lookup, and then i get this exception:
                    java.lang.UnsupportedOperationException: This class does not support SAAJ 1.1
          at weblogic.webservice.core.soap.SOAPElementImpl.getElementsByTagNameNS(SOAPElementImpl.java:527)


Was this problem solved in the latest version of Bea Weblogic 9.2?
          I have an issue on soap 1.2 support activation (through Binding.Type.SOAP12):
          java.lang.RuntimeException: weblogic.testclient.WsdlParseFailedException: SOAP 1.2 is not supported by the Test Client
          at weblogic.testclient.ConnectionState.createWsdl(ConnectionState.java:63)
          at Controller.refreshWsdl(Controller.java:437)
          at Controller.begin(Controller.java:285)
          at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
          at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
          at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
          at java.lang.reflect.Method.invoke(Method.java:585)
          at org.apache.beehive.netui.pageflow.FlowController.invokeActionMethod(FlowController.java:878)
          at org.apache.beehive.netui.pageflow.FlowController.getActionMethodForward(FlowController.java:808)
          at org.apache.beehive.netui.pageflow.FlowController.internalExecute(FlowController.java:477)
          at org.apache.beehive.netui.pageflow.PageFlowController.internalExecute(PageFlowController.java:305)
          at org.apache.beehive.netui.pageflow.FlowController.execute(FlowController.java:335)
          at org.apache.beehive.netui.pageflow.internal.FlowControllerAction.execute(FlowControllerAction.java:51)
          at org.apache.struts.action.RequestProcessor.processActionPerform(RequestProcessor.java:419)
          at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor.access$201(PageFlowRequestProcessor.java:95)
          at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor$ActionRunner.execute(PageFlowRequestProcessor.java:2042)
          at org.apache.beehive.netui.pageflow.interceptor.action.internal.ActionInterceptors.wrapAction(ActionInterceptors.java:90)
          at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor.processActionPerform(PageFlowRequestProcessor.java:2114)
          at org.apache.struts.action.RequestProcessor.process(RequestProcessor.java:224)
          at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor.processInternal(PageFlowRequestProcessor.java:554)
          at org.apache.beehive.netui.pageflow.PageFlowRequestProcessor.process(PageFlowRequestProcessor.java:851)
          at org.apache.beehive.netui.pageflow.AutoRegisterActionServlet.process(AutoRegisterActionServlet.java:630)
          at org.apache.beehive.netui.pageflow.PageFlowActionServlet.process(PageFlowActionServlet.java:157)
          at org.apache.struts.action.ActionServlet.doGet(ActionServlet.java:414)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:743)
          at javax.servlet.http.HttpServlet.service(HttpServlet.java:856)
          at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
          at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
          at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:283)
          at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
          at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3241)
          at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
          at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
          at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2010)
          at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:1916)
          at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1366)
          at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209)
          at weblogic.work.ExecuteThread.run(ExecuteThread.java:181)
          Caused by: weblogic.testclient.WsdlParseFailedException: SOAP 1.2 is not supported by the Test Client
          at weblogic.testclient.WsdlOperationParser.createOperation(WsdlOperationParser.java:38)
          at weblogic.testclient.WebService.createOperation(WebService.java:251)
          at weblogic.testclient.WebService.<init>(WebService.java:88)
          at weblogic.testclient.Wsdl.parseWsdl(Wsdl.java:135)
          at weblogic.testclient.Wsdl.<init>(Wsdl.java:60)
          at weblogic.testclient.ConnectionState.createWsdlFromHttpUrl(ConnectionState.java:120)
          at weblogic.testclient.ConnectionState.createWsdl(ConnectionState.java:54)
          ... 37 more

Archive and versioning problem OES11

I'm trying to set up archiving versioning on our OES11 server and for some reason i can not get the jobs to run ..
I only want it to check a users folder for .doc and .xls files but it does not really seem to do anything .. the only file it managed to do so far is /._NETWARE/VOLDATA.TDF .. somehow.
The filter I have is as follows (from xml)
<source>
<volume><![CDATA[VOL1]]></volume>
<filter overrideDefault="false">
<include><path><![CDATA[\users]]></path></include>
<include><extension><![CDATA[.xls]]></extension></include>
<include><extension><![CDATA[.doc]]></extension></include>
</filter>
</source>
Any ideas what I am doing wrong ?

Conz,
It appears that in the past few days you have not received a response to your
posting. That concerns us, and has triggered this automated reply.
Has your problem been resolved? If not, you might try one of the following options:
- Visit http://www.novell.com/support and search the knowledgebase and/or check all
the other self support options and support programs available.
- You could also try posting your message again. Make sure it is posted in the
correct newsgroup. (http://forums.novell.com)
Be sure to read the forum FAQ about what to expect in the way of responses:
http://forums.novell.com/faq.php
If this is a reply to a duplicate posting, please ignore and accept our apologies
and rest assured we will issue a stern reprimand to our posting bot.
Good luck!
Your Novell Forums Team
http://forums.novell.com

User management and Access Control in HCM Cloud

Hello,
Information is scarce about User management and Access Control in Oracle Cloud generally. Today, I have two questions :
- How can I bridge HCM Cloud user store with my on-premise IDM or security repository in order to allow identty governance to flow to HCM Cloud service ?
The only information I got was that you can declare manually and by bulk import through files my users. This is not really interresting as I have an automatic IDM with workflows and identity control on provisioning and de-provisioning.
Is there a SPML or proprietary endpoint to do it automatically ? What are the prerequisites ? Do I have to implement OIM on my side ?
- Once my users are created, how can I do webSSO from my internal security repositories to the HCM Cloud service ?
I do not want to distribute new set of login / passwords to my users. Is it possible to do Identity Federation (SAML 2.0 or WS-Fed) with HCM Cloud service ? What are the prerequisites ? Do I have to implement OAM on my side ?
I accept all pieces of information you can give me on this topic to help me understand the funcitonalites, limits and options offered by Oracle Cloud and more precisely by HCM Cloud service.
Best regards,

OIDDAS has limited capability of access control and information hiding. Presently, the permissions and privileges can be set at a realm level, and fine grained access control / information hiding cannot be done.
At present, the only way to restrict view and access control is by appplying ACLs (which is not the safest bet).

Query: Best practice SAN switch (network) access control rules?

Dear SAN experts,
Are there generic SAN (MDS) switch access control rules that should always be applied within the SAN environment?
I have a specific interest in network-based access control rules/CLI-commands with respect to traffic flowing through the switch rather than switch management traffic (controls for traffic flowing to the switch).
Presumably one would want to provide SAN switch demarcation between initiators and targets using VSAN, Zoning (and LUN Zoning for fine grained access control and defense in depth with storage device LUN masking), IP ACL, Read-Only Zone (or LUN).
In a LAN environment controlled by a (gateway) firewall, there are (best practice) generic firewall access control rules that should be instantiated regardless of enterprise network IP range, TCP services, topology etc.
For example, the blocking of malformed TCP flags or the blocking of inbound and outbound IP ranges outlined in RFC 3330 (and RFC 1918).
These firewall access control rules can be deployed regardless of the IP range or TCP service traffic used within the enterprise. Of course there are firewall access control rules that should also be implemented as best practice that require specific IP addresses and ports that suit the network in which they are deployed. For example, rate limiting as a DoS preventative, may require knowledge of server IP and port number of the hosted service that is being DoS protected.
So my question is, are there generic best practice SAN switch (network) access control rules that should also be instantiated?
regards,
Will.

Hi William,
That's a pretty wide net you're casting there, but i'll do my best to give you some insight in the matter.
Speaking pure fibre channel, your only real way of controlling which nodes can access which other nodes is Zones.
for zones there are a few best practices:
* Default Zone: Don't use it. unless you're running Ficon.
* Single Initiator zones: One host, many storage targets. Don't put 2 initiators in one zone or they'll try logging into each other which at best will give you a performance hit, at worst will bring down your systems.
* Don't mix zoning types: You can zone on wwn, on port, and Cisco NX-OS will give you a plethora of other options, like on device alias or LUN Zoning. Don't use different types of these in one zone.
* Device alias zoning is definately recommended with Enhanced Zoning and Enhanced DA enabled, since it will make replacing hba's a heck of a lot less painful in your fabric.
* LUN zoning is being deprecated, so avoid. You can achieve the same effect on any modern array by doing lun masking.
* Read-Only exists, but again any modern array should be able to make a lun read-only.
* QoS on Zoning: Isn't really an ACL method, more of a congestion control.
VSANs are a way to separate your physical fabric into several logical fabrics. There's one huge distinction here with VLANs, that is that as a rule of thumb, you should put things that you want to talk to each other in the same VSANs. There's no such concept as a broadcast domain the way it exists in Ethernet in FC, so VSANs don't serve as isolation for that. Routing on Fibre Channel (IVR or Inter-VSAN Routing) is possible, but quickly becomes a pain if you use it a lot/structurally. Keep IVR for exceptions, use VSANs for logical units of hosts and storage that belong to each other. A good example would be to put each of 2 remote datacenters in their own VSAN, create a third VSAN for the ports on the array that provide replication between DC and use IVR to make management hosts have inband access to all arrays.
When using IVR, maintain a manual and minimal topology. IVR tends to become very complex very fast and auto topology isn't helping this.
Traditional IP acls (permit this proto to that dest on such a port and deny other combinations) are very rare on management interfaces, since they're usually connected to already separated segments. Same goes for Fibre Channel over IP links (that connect to ethernet interfaces in your storage switch).
They are quite logical to use and work just the same on an MDS as on a traditional Ethernetswitch when you want to use IP over FC (not to be confused with FC over IP). But then you'll logically use your switch as an L2/L3 device.
I'm personally not an IP guy, but here's a quite good guide to setting up IP services in a FC fabric:
http://www.cisco.com/en/US/partner/docs/switches/datacenter/mds9000/sw/4_1/configuration/guides/cli_4_1/ipsvc.html
To protect your san from devices that are 'slow-draining' and can cause congestion, I highly recommend enabling slow-drain policy monitors, as described in this document:
http://www.cisco.com/en/US/partner/docs/switches/datacenter/mds9000/sw/5_0/configuration/guides/int/nxos/intf.html#wp1743661
That's a very brief summary of the most important access-control-related Best Practices that come to mind. If any of this isn't clear to you or you require more detail, let me know. HTH!

EP 6.0 SP2 KM Access control and version problems

Similar Messages

Maybe you are looking for