[eSSO] Profiles in Logon Manager

People!
We have Logon Manager, and are going to make the custom MSI so we can deploy it through ZenWorks. The question is, we have three profiles of users (managers, users and builders). The first uses the entire pool of apps we included in Logon Manager. The second type uses a subset of these, and the third one, only 3 or 4 apps of the set.
We generated several versions of the MSI with the configurations, but although each MSI reflect these profiles of people, when installed ALL users (belonging to the three profiles) have the entire set of apps in their LM app pool.
The LM is using AD for storing credentials. Let me know how this can be done.
Thanks!

Hi Octavion,
I am trying to connect MS AD which is on SSL from eSSO LM Manager.
AD is running on 636 SSL port - this is already tested with Softerra LDAP Browser.
I am getting connected on (SSL checked) 636 if I select "LDAP Compliant Directory" while connecting.
It is ot getting connected if I choose "Microsoft Active Directory" from Drag Drop Repositories list.
I am getting an error Service not Operational,iIf I provide IP Address of AD Server. If I provide Fully Qualified DOmain Name of LDAP Server I am getting an error "Log On Failure-Unknown Username or Bad Passowrd".
- Mangesh

Similar Messages

Esso Agents 11.1.1.2.0 with Legacy Logon manager and PG

Hi
I have many applications that fail on single sign-on.Although the eso services are started I have many pcs having to be re-installed because of esso not working. I have tried the troubleshooting methods on repair and un/re-installation of the esso software with no success
The components I have currently installed are:
1. Esso Server
Logon Manager Console 10.1.410 (unpatched)
Provisioning Gateway server 10.1.410 (unpatched)
Microsoft ADAM repository on windows
2. Windows XP esso Client
Logon Manager Agent 10.1.410 (unpatched)
Provisioning Gateway Client 10.1.410 (unpatched)
My question is can I upgrade the clients to the latest version 11.1.1.2.0 now while having the Esso server version software remain the same. The upgrade of the Esso server will happen only during the latter half of the year.
Will the esso clients still continue to work connecting to the legacy software on the esso server.
We have a few sites that have been upgraded fully ( server and clients) to the 11.1.1.2.0 version and esso has been stable there ever since .
Thanks
Minesh

This is an SSL handshake problem of Websphere - has nothing to do with AM.
Websphere�s JDK does not trust the Signer / Cert of AM�s deployment container.
Either configure a truststore (or use an existing webshpere truststore) where you import the Cert of the Signing CA of your AM DC�s cert.
Other option - import the mentioned cert in cacert file of IBM JDK - but be aware that this might get lost when applying an Websphere fixpack/refreshpack.
BTW what have you configured for server.port,server.host and server.protocol in your AMConfig.properties?
If you have not changed that settings agent will use the port/protocol specified to communicate with AM.
-Bernhard

[eSSO] Logon Manager doesn't autostart on Windows 7.

I have installed the last Logon Manager version for my Windows 7, but I discovered that the application doesn't start automatically as Windows startups. I tried putting it under the Startup folder, but the results are the same. I also installed it in another Windows 7 of the company, and the scenario is the same. In other company's workstations (with XP), LM works fine (it startups with Windows).
Anybody know if this is some bug with Windows 7?

Hi
ESSO-LM is designed to start up at user logon and is initiated in a Windows 7 Logon with the "userinit" registry key located at;
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
The value of this key on a Windows 7 (64bit in this example) machine should have the following in the string somewhere - "C:\Program Files (x86)\Passlogix\v-GO SSO\wts\ssolauncher.exe" /startsso,
If you select Windows v2 authenticator on install tghe installation should put this entry in automatically. If it is not present or is inhibited by a policy, for example, then ESSO will not start in the prescribed manner.
It is possible to launch ESSO via an alternative method however the above is the designed method.
Hope this helps

Problem with the agent console created in the ESSO-Logon Manager 64 bits

Friends,
When I use the installer that I created in the console ESSO-Logon Manager for 32-bit, this I install it on the client side and when I synchronize with the console-Logon Manager ESSO brings me and I can see the agent all the templates I configured.
I have a problem with the agent console created in the Logon Manager ESSO-64bit.
When I use this installer on the client stations and then by the agent does not envision the applications that I have configured in the console.
This causes you can not do single sign on to applications that I have configured in the client stations
To generate this installer use the source name: ESSO-LMx64.msi
Can someone please help me with this problem, this only happens when I use the msi installer on 64-bit client stations.
Thanks.

Jackson_Bill wrote:
What IDE are you using and what platform?Read first.
Moh Bob wrote:
I'm using J2ME platform SDK 3.0
db

ESSO Logon Manager not working with FireFox 3.5

Hi,
I am using Oracle ESSO Logon Manager (v.10.1.410) but it's not detecting my FireFox 3.5.3 browser.
I am not able to Login using Logon Manager to any of web sites while browsing using FF3.5+
regards,
S.Vasanth Kumar.
Edited by: vasanth.s.kumar on Oct 6, 2009 12:37 PM

Hi,
this is planned for a future release of Logon Manager. Currently 3.0 is the highest version supported.
There is an enhancement request (8652660) logged for support of FF3.5
Regards

Esso logon manager client - Application List Blank

Hi
I have a scenario where the esso logon manager anf provisioning gateway clients are installed on the D drive of a client pc.This is due to the fact that a new batch of HP laptops have their system partition as C drive and their windows partion as the D Drive. So applications are automatically forced to install to the D Drive instead of the C drive as per default.
Upon rebooting the machine after installing the packaged esso msi packaged apps the esso application list is blank ?? However if the packages are installed to the C drive on another machine esso works fine.
Are there any tweaks or hacks or any solution to get this to work.
Your help would be greatly appreciated
Minesh

Check your Global Agent Settings. Specifically, I would check the one related to your synchronizer. This is a setting that exists in the registry of the client that points to the location of the dll file that it uses to do its synchronization with your chosen repository. You can find this setting in the Administrative Console under Synchronization-->[Synchronizer Name]-->Required-->Extension Location
There are some other DLL extension files that could be explicitly defined as well in the Global Agent Settings, I would go through your values and ensure they are set to the correct values, but the specific DLL that is preventing you from seeing templates is the one under your Synchronizer.

How to generate an msi in Logon Manager ESSO

Friends,
How to create a msi in the administrative console logon manager to install it on a pc client to access automatic.
Very grateful

Hi
In version ESSO-LM 11.1.1.5 the agent customised MSI can be created completely in the admin console.
Copy ESSO-LM MSI from the original software, load it into the generate customised MSI wizard. Select the features you want including the correct synchroniser, select next, add the global agent settings set that you know function. Name the new MSI and generate.
Run it with a command similar to this for a silent install:
msiexec.exe /i "<install path>\ESSO-LM_XP_23Sepr11.msi" /qn
Hope this helps
S

Oracle ESSO, Logon Manager Console couldn't connect to repository ORA-01017

I installed Logon Manager Console on my Windows XP SP3 and try to connect to repository (Oracle DB 11g) with instanse name:
Provider=OraOLEDB.Oracle;Data Source=MYDB;User Id=user;Password=password;
Repository type: Oracle Database
And get following error: ORA-01017: invalid username/password; logon denied
But i can connect to database with sql developer. Same DB, user and password
Please help, what i'm doing wrong?
Edited by: LITBe on Sep 2, 2010 4:25 AM

Update:
If I attempt to connect with instanse name:
Provider=OraOLEDB.Oracle;Data Source=myOESSO;User ID=system;Password=oracle;Integrated Security=no;
Repository type: Oracle Database
I get another error: Multiple-step OLE DB operation generated errors. Check each OLE DB status value, if available. No work was done.
If
instanse name: Provider=OraOLEDB.Oracle;Data Source=myOESSO;User ID=system;Password=oracle;
Repository type: Generic Database
I get another error: ORA-00942: table or view does not exist
ORA-00942: table or view does not exist
Maybe this help someone to understand what happening because i don't understand...

ESSO - Logon Manager Wizard Failed

From any workstation, when we try to install LM, the last step of the wizard remains freezed for a long while and doesn´t return back (in the last step, we press the finish button and when we expect the AD Auth screen, is where the wizard crash). The LM is never installed but the weird thing is that we can see in AD, below the user, the container with the LM objects (and without the credentials objects).
Help me!
thanks!

Hi,
this is planned for a future release of Logon Manager. Currently 3.0 is the highest version supported.
There is an enhancement request (8652660) logged for support of FF3.5
Regards

The Ultimate Guide to Resolving Profile and Device Manager Issues

The following article also applies to issues after re-setting the severs' hostname. It also applies to situations where re-setting the Code Signing Certifictateas described by Apple has not resolved the issue.
Hello,
I have been plagued with Profile Manager and Device Manager issues since day one.
I would like to share my experience and to suggest a way how to resolve issues such as device cannot be enrolled or Code Signing Certificate not accepted.
I shall try to be as brief as possible, just giving an overview of the steps that resolved my issues. The individual steps have been described elsewhere in this forum. For users who have purchased commercial SSL certs the following may not apply.
In my view many of these issues are caused by missing or faulty certificates. So let us first touch on the very complex matter of certificates.
Certificates come in many flavours such as CA (Certificate Authority), Code Signing Certificate, S/MIME and Server Identification.
(Mountain?) Lion Server creates a so-called Intermediate CA certificate (IntermediateCA_hostname_1") and Server Identification Certificate ("hostname") when it installs first. This is critical for the operation of many server functionalities, including Open Direcory. These certs together with the private/public keys can be found in your Keychain. Profile and Device Manager may need a Code Signing Certificate.
The most straightforward way to resolve the Profile Manaher issues is in my view to reset the server created certicates.
The bad news is that this procedure involves quite a few steps and at least 2 hours of your precious time because it means creating a fresh Direcory Master.
I hope that I have not forgotten to mention an important step. Readers' comments and addenda are welcome.
I shall outline a sensible strategy:
1. Clone your dysfunctional server to an external harddrive (SuperDuper does a reliable job)
2. Start the server fom the clone and shut down ALL services.
3. It may be sensible to set up a root user access.
4. Back-up all user data such as addess book, calendar and other data that you *may* need to set up your server.
5. Open Workgroup Manager and export all user and workgroup accounts to the drive that you using to re-build your server (it may cause problems if you back-up to an external drive).
6. Just in case you may also want to back-up the Profile Manager database and erase user profiles:
In Terminal (this applies to Lion Server - paths may be diferent in Mountain Lion !)
Backup: sudo pg_dump -U _postgres -c device_management > $HOME/device_management.sql
Erase database:
sudo /usr/share/devicemgr/backend/wipeDB.sh
7. Note your Directory (diradmin) password for later if you want to re-use it.
8. Open Open Server Admin and demote OD Master to Standalone Directory.
9. In Terminal delete the old Certificate Authority
sudo rm -R /var/root/Library/Application\ Support/Certificate\ Authority/
This step is crucial because else re-building you OD Master will fail.
9. Go back to Server Admin and promote the Standalone Directory to OD Master. You may want to use the same hostname.
10. When the OD Master is ready click on Overview and check that the LDAP and Keberos Realm reflect your server's hostname.
11. Go back to Workgroup Manager and re-import users and groups.
NOTE: passwords are not being exported. I do not know how to salvage user passwords. (Maybe passwords can be recovered by re-mporting an OD archive - comments welcome! ).
12. Go to Server App and reset passwords and (not to forget) user homefolder locations, in particular if you want to login from a network account!
If the home directory has not been defined you cannot login from a network account.
13. You may now want to restore Profile Manager user profiles in Terminal. Issue the following commands:
sudo serveradmin stop devicemgr
sudo serveradmin start postgres
sudo psql -U _postgres -d device_management -f $HOME/device_management.sql
sudo serveradmin start devicemgr
14. You can now switch back on your services, including Profile Manager.
In Profile Manager you may have to configure Device Management. This creates a correct Code Signng Certicate.
15. Check the certificate settings in Server App -> Hadware -> Settings-> SSL Certificates.
16. Check that Apple Push Notifications are set.(you easily check if they are working later)
17. You may want to re-boot OS Server from the clone now.
18. After re-boot open Server App and check that your server is running well.
19. Delete all profiles in System Preferences -> Profiles.
19. Login to Profile Manager. You should have all users and profiles back. In my experience devices have to be re-enrolled before profiles can be pushed and/or devices be enrolled. You may just as well delete the displayed devices now.
20. Grab one of your (portable) Macs that you want to enrol and go to (yourhostname)/mydevices and install the server's trust profile. The profile's name should read "Trust Profile for...) and underneath in green font "Verified".
21. Re-enrol that device. At this stage keep your finger's crossed and take a deep breath.
22. If the device has been successfully enrolled you may at last want to test if pushing profiles really works. Login to Profile Manager as admin, select the newly enrolled device. Check that Automatic Push is enabled (-> Profile -> General). Create a harmless management profile such as defining the dock's position on the target machine. (Do not forget to click SAVE at the end - this is easily missed here). If all is well Profile Manager will display an active task (sending) and the dock's position on the target will have changed in a few seconds if you are on a LAN (Note: If sending seems to take forever: check on the server machine and/or on your router that the proper ports are open and that incoming data is not intercepted by Little Snitch or similar software).
Note: if you intend to enrol an Apple iPhone you may first need to install the proper Apple Configuration software.
Now enjoy Profile and Device Manager !
Regards,
Twistan

HI
1. In Action profiles, logon to system and recheck correcion are available in action definition as well in condition configuration and the schedule condition is also maintained. but the display is not coming(i.e in the worklist this action is not getting displayed).
You can check the schedule condition for the action and match the status values...or try recreating the action with schedule condition again....for customer specific ....copy the standard aciton with ur zname and make a schedule condition and check the same.
2, In suppport team of incident when i give individual processor it throwing a warning that u r not the processor. but when i give org unit it is working perfectly. Could anyone guide on this.
You need to have the empolyee role for BP ..goto BP and got here dropdown for ur bp and choose role Employee and then enter ur userid
also make sure that u have the message processing role
Hope it clarifies ur doubt and resolve ur prob
Regards
Prakhar

Multiple logons using same Logon Manager Splash Screen

I have an web application set up in Logon Manager where the user profile is set to login as a simple user with matching credentials. I also want the person to login to the same web page at the same login splash screen using different credentials as administrator. Can this be done. I am new to this so all help id welcomed.

Many questions, many answers. :-)
Yes, Rich, they would need to install the multiserver version
for you to see that Enterprise Manager option in the CF Admin. But
no, they would not need to uninstall the Server deployment (what
you did) to add the Multiserver deployment. They can co-exist
(though it's not something most would typically do).
The best news for you is that, yes, they can indeed just
setup a second site on their web server, and have that also point
to the one CF Server deployment you have installed. That is, of
course, assuming they run a web server that supports multiple
sites. If it's Apache, you're good. If it's Windows, then as long
as its Windows Server 2003 (or 2008, or Vista), you're good, too.
(Just for completeness, for other readers, XP does not let you run
more than one site at a time.)
If during the installation of CF you told it to have ALL
sites in the web server run with CF, you need do nothing more than
create the new site. It should immediately be able to run CF pages.
If instead you told it to only link CF to one site, then you'll
need to run the web server configuration tool again. You can do
that manually, even after the installation. See the CF Admin and
Config docs for more on that, as well as on this very question. (I
realize many like to just run stuff and hope that the interface is
clear enough, but as this question shows, for some things anyone
installing CF will be well-served by looking over that often-missed
manual.)
Hope that helps, Rich. It's not an RTFM answer. :-) Just
saying that if you need more than what I've said, it is in the
manual. Still, I'll be happy to answer follow ups if I can.

Extend AD Schema and configure Logon Manager

Hi,
i tried to extend schema and configure the logon manager but with no success.
When i extend schema in ESSO Admin Console a successful message appear, but when i check the Active Directory for the objects that should appear, non of them are in there.
Can someone please explain me what im doing wrong, or give me a link where the steps to extend and configure logon manager are explained?
thanks

I,
thanks for the answer.
now the AD is extended successfully.
But i have one more problem, in the agent installed in the server machine de apps appear correctly and the users are synchronized correctly, although in other machine that the agent is installed i cant connect to AD (i think) the apps not appear..
When the window "Connect to Active Diretory" of the agent appear i introduce de credentials : Administrator and pass of the AD administrator. Am i right?
I think theres a problem with the connection with the AD and the machine.
Thanks..

Logon Manager - Rebel App

Hi there! I have a Logon Manager with several applications. But, although all applications are running right, one of the apps (an applet) is not being recognized by the LM. What can we do when we have an app like this? Is there some extension that can be programmed or some scripting there to extend LM functionality?

I have more information about the application in question. Is a java desktop app. When we lounch the app, first a small window appears with only username and password fields, then after the OK click, this windows closes and the app begins.
We have these files in the jre bin and lib directories:
\bin\ssojho.dll
\bin\accessibility.properties
\lib\ext\jaccess.jar
\lib\ext\jho.jar
It seems that the eSSO works fine in the 40% of the tests we did. Also, the developers of the app have helped us (in devel environment), and show in the screen the user and password we have entered, after click in the OK button. In this test, 100% of the time the app writes the user and password in the correct way. So, somehow, the 60% of the time that the eSSO logon fails, is about some conflict with the application.
Helpppp

Need help understanding profiles and color management

I made the big leap from inexpensive inkjets to:
1 Epson 3800 Standard
2 Spyder3Studio
I have a Mac Pro Quad, Aperture, PS3, etc.
I have a steep learning curve ahead, here's what I've done:
1 Read a lot of books, watched tutorials, etc.
2 Calibrated the monitor
3 Calibrated the printer several times and created .icc profiles
What I've found:
1 The sample print produced by Spyder3Print, using the profile I created with color management turned off in the print dialog, looks very good.
2 When I get into Aperture, and apply the .icc profile I created in the proofing profile with onscreen proofing, the onscreen image does not change appreciably compared with the no proof setting. It gets slightly darker
3 When I select File>Print image, select the profile I created, turn off color management and look a the resulting preview image it looks much lighter and washed out than the onscreen image with onscreen proofing turned on.
4 When I print the image, it looks the same as was shown in the print preview...light and washed out, which is much different than what is shown in edit mode.
5 When I open PS3 with onscreen soft-proofing, the onscreen image is light and washed out...just like displayed in PS3 preview. If I re-edit the image to look OK onscreen, and print with the profile and color management turned off, the printed image looks OK.
So, why am I confused?
1 In the back of my simplistic and naive mind, I anticipated that in creating a custom printer profile I would only need to edit a photo once, so it looks good on the calibrated screen, and then a custom printer profile will handle the work to print a good looking photo. Different profiles do different translations for different printers/papers. However, judging by the PS work, it appears I need to re-edit a photo for each printer/paper I encounter...just doesn't seem right.
2 In Aperture, I'm confused by the onscreen proofing does not present the same image as what I see in the print preview. I'm selecting the same .icc profile in both locations.
I tried visiting with Spyder support, but am not able to explain myself well enough to help them understand what I'm doing wrong.
Any help is greatly appreciated.

Calibrated the printer several times and created .icc profiles
You have understand that maintaining the colour is done by morphing the colourants, and you have understood that matching the digital graphic display (which is emissive) to the print from the digital graphic printer (which is reflective) presupposes a studio lighting situation that simulates the conditions presupposed in the mathematical illuminant model for media independent matching. Basically, for a display-to-print match you need to calibrate and characterise the display to something like 5000-55000 kelvin. There are all sorts of arguments surrounding this, and you will find your way through them in time, but you now have the gist of the thing.
So far so good, but what of the problem posed by the digital graphic printer? If you are a professional photographer, you are dependent on your printer for contract proofing. Your prints you can pass to clients and to printers, but your display you cannot. So this is critical.
The ICC Specification was published at DRUPA Druck und Papier in Düsseldorf in May 1995 and ColorSync 2 Golden Master is on the WWDC CD for May 1995. Between 1995 and 2000 die reine Lehre said to render your colour patch chart in the raw condition of the colour device.
The problem with this is that in a separation the reflectance of the paper (which is how you get to see the colours of the colourants laid down on top of the paper) and the amount of colourant (solid and combinations of tints) gives you the gamut.
By this argument, you would want to render the colour patch chart with the most colourant, but what if the most colourant produces artifacts? A safer solution is to have primary ink limiting as part of the calibration process prior to rendering of the colour patch chart.
You can see the progression e.g. in the BEST RIP which since 2002 has been owned by EFI Electronics for Imaging. BEST started by allowing access to the raw colour device, with pooling problems and whatnot, but then introduced a primary ink limiting and linearisation.
The next thing you need to know is what colour test chart to send to the colour device, depending on whether the colour device is considered an RGB device or a CMYK device. By convention, if the device is not driven by a PostScript RIP it is considered an RGB device.
The colour patch chart is not tagged, meaning that it is deviceColor and neither CIEBased colour or ICCBased colour. You need to keep your colour patch chart deviceColor or you will have a colour characterisation of a colour managed conversion. Which is not what you want.
If the operating system is colour managed through and through, how do you render a colour test chart without automatically assigning a source ICC profile for the colourant model (Generic RGB Profile for three component, Generic CMYK Profile for four component)?
The convention is that no colour conversion occurs if the source ICC device profile and the destination ICC device profile are identical. So if you are targetting your inkjet in RGB mode, you open an RGB colourant patch chart, set the source ICC profile for the working space to the same as the destination ICC profile for the device, and render as deviceColor.
You then leave the rendered colourant test chart to dry for one hour. If you measure a colourant test chart every ten minutes through the first hour, you may find that the soluble inkjet inks in drying change colour. If you wait, you avoid this cause of error in your characterisation.
As you will mainly want to work with loose photographs, and not with photographs placed in pages, when you produce a contract proof using Absolute Colorimetric rendering from the ICC profile for the printing condition to the ICC profile for your studio printer, here's a tip.
Your eyes, the eyes of your client, and the eyes of the prepress production manager will see the white white of the surrounding unprinted margins of the paper, and will judge the printed area of the paper relative to that.
If, therefore, your untrimmed contract proof and the contract proof from Adobe InDesign or QuarkPress, or a EFI or other proofing RIP, are placed side by side in the viewing box your untrimmed contract proof will work as the visual reference for the media white.
The measured reference for the media white is in the ICC profile for the printing condition, to be precise in the WTPT White Point tag that you can see by doubleclicking the ICC profile in the Apple ColorSync Utility. This is the lightness and tint laid down on proof prints.
You, your client and your chosen printer will get on well if you remember to set up your studio lighting, and trim the blank borders of your proof prints. (Another tip: set your Finder to neutral gray and avoid a clutter of white windows, icons and so forth in the Finder when viewing.)
So far, so good. This leaves the nittygritty of specific ICC profiling packages and specific ICC-enabled applications. As for Aperture, do not apply a gamma correction to your colourant patch chart, or to colour managed printing.
As for Adobe applications, which you say you will be comparing with, you should probably be aware that Adobe InDesign CS3 has problems. When targetting an RGB printing device, the prints are not correctly colour managed, but basically bypass colour management.
There's been a discussion on the Apple ColorSync Users List and on Adobe's fora, see the two threads below.
Hope this helps,
Henrik Holmegaard
technical writer
References:
http://www.adobeforums.com/webx?14@@.59b52c9b/0
http://lists.apple.com/archives/colorsync-users/2007/Nov/msg00143.html

Remove device and profile from call manager

Is there any documentation on how to remove phones and EM, RDP, CSF profiles from call manager in order to free up some licensing??

EM does not take any licenses, but the way you want to do this (assuming all associations are correct and dependencies would prevent you from doing it anyway):
delete UDP
delete CSF device
delete RDP
delete desk phone

[eSSO] Profiles in Logon Manager

Similar Messages

Maybe you are looking for