Filter AD information from Kerberos logonticket

Hi,
I have recently configured SSO with Kerberos and SPNego for a portal system. And it's working fine. The LDAP configuration is pointing to a location on Active Directory. At this level, below, there are some more subfolders that indicates the usertype: for example there's a subfolder administrators and a subfolder production.
At this moment all users under folders administrators and production are able to logon to the portal by means of their useraccount on LDAP. Is there a possibility to filter on a specific group of users? Let's say, all users from the production folder are allowed to make use of SSO, but all users from folder adminstrators should get a logon screen.
I already did some testing by adding the login module "clientcertloginmodule" and tried to make use of the different rule-filter options but it's not working. I even wonder if it's possible. Has anyone experience or some tips?
thank you

Hello Danny
The kind of login module to be used affects directly the application, not the user. This means that, if webdynpro applications are configured to use the spnego login module, this will be the first authentication mechanism to be checked, independently of the user.
As far as I know, the solution would be to configure a "redirect" application for the users to logon into the portal (removing spnego login module from "ticket" login module stack). This way, most of users will use the "ticket" authentication mechanism (configured, for example, to use basic authentication), and then configure the "redirect" applications to use the spnego login module.
There are several threads which discuss this situation, for example:
/message/5811023#5811023
Regards,
Désiré

Similar Messages

Print information from a row - Report Builder 3.0 - printer button option?

Does Report Builder have any way of printing information from a row selection onto a page, rather than the whole report? I don't think it has a print button option when you create the report?

Hi KittyCat101,
According to your description, you want to select some particular rows when printing the report. Just as you said, there is no such feature in Reporting Services.
To work around this issue, we can create a parameter with the key field value in the report. Then we can print the particular rows based on the selection in the parameter. For more details, please see:
Create a multiple parameter named filter in the report.
Specify Available Values and Default Values from the dataset key field which is acted as filter when printing the report.
Add a filter as below in the tablix:
Expression: [Key field]
Operator: In
Value: [@filter]
When we render the report in report builder, it displays all data. While we can select the particular rows in the drop-down list when we want to print the report.
If there are any other questions, please feel free to ask.
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support

Radius server not returning Filter-id information to access device

I have set up a Radius server (v. 4.15 16 april 2003) on NW65sp2 server
and I'm trying to use it to authenticate to a Watchguard Firebox II
firewall. The authentication functions but apparently the firewall is
not getting (or not parsing) the Filter-Id information to assign access
rights via groups. When I login to the firewall with "user1", the
response is "Authenticationsucceeded, but no access grantedfor user". If
I define "user1" on the firewall and assign it to an access policy, then
everything works. But if I define an access group "group1" and assign
it to an access policy on the firewall and then assign "group1" to the
eDir Access Profile object that is assigned to "user1", (Filter-Id =
group1) I get the above authentication succesful, but no access granted.
Is there a way to identify exactly what information is being sent from
the Radius server to the access device so I can determine if the problem
is on the Novell Radius server side or the Watchguard Firewall side?
I've activated the Radius Debug Log, but that only tells me that it
finds all the relevant objects in eDirectory and that authentication is
successfull, but there is no indication that any other information is
being sent to the access device.
As I understand it, the filer-id's are supposed to allow a link between
the eDir user objects and what access rights are allowed on the access
device (firewall). Essentially this is how I define group memberships on
the firewall using eDir user. Is this assumption correct?
The goal of course is to allow access over the firewall without having
to type in 500 user names on the firewall.
Any ideas or tips on what I could check or configure differently would
be helpful. thanks
bill reading

thanks for the feedback. I will take a look at the thread you mentioned
and I'll get back to you with the trace as soon as I can arrange it.
Scott Kiester wrote:
> There is a thread titled "RADIUS Group with VASCO Digipass" in this group
> from November where someone else was trying to use the filter-Id attribute
> with their firewall. The customer was able to get this attribute to working
> after tweaking his RADIUS configuration.
>
> Your understanding of the filter-Id attribute is correct. Either the RADIUS
> server is not sending this attribute for some reason, or something on your
> firewall has been misconfigured. A good starting point would be to take a
> sniffer trace to see if the filter-Id attribute is in the access-request
> packet. (You can use Ethereal, which is a free download from
> www.ethereal.com, for the trace.) Post the trace here or send it to me at
> [email protected] and I'll take a look at it.
>
>
>>>>bill reading<[email protected]> 12/07/04 8:36 AM >>>
>
> I have set up a Radius server (v. 4.15 16 april 2003) on NW65sp2 server
> and I'm trying to use it to authenticate to a Watchguard Firebox II
> firewall. The authentication functions but apparently the firewall is
> not getting (or not parsing) the Filter-Id information to assign access
> rights via groups. When I login to the firewall with "user1", the
> response is "Authenticationsucceeded, but no access grantedfor user". If
> I define "user1" on the firewall and assign it to an access policy, then
> everything works. But if I define an access group "group1" and assign
> it to an access policy on the firewall and then assign "group1" to the
> eDir Access Profile object that is assigned to "user1", (Filter-Id =
> group1) I get the above authentication succesful, but no access granted.
> Is there a way to identify exactly what information is being sent from
> the Radius server to the access device so I can determine if the problem
> is on the Novell Radius server side or the Watchguard Firewall side?
> I've activated the Radius Debug Log, but that only tells me that it
> finds all the relevant objects in eDirectory and that authentication is
> successfull, but there is no indication that any other information is
> being sent to the access device.
>
> As I understand it, the filer-id's are supposed to allow a link between
> the eDir user objects and what access rights are allowed on the access
> device (firewall). Essentially this is how I define group memberships on
> the firewall using eDir user. Is this assumption correct?
>
> The goal of course is to allow access over the firewall without having
> to type in 500 user names on the firewall.
>
> Any ideas or tips on what I could check or configure differently would
> be helpful. thanks
>
> bill reading
>
>

How to get information from SOAP header in weblogic without handlers

I need to retrieve information from SOAP header without handlers.
Any ideas how to do that?

Just wondering if Filter can be used here, though I never tried that.

How can I get CDP neighbor information from access point reports in Cisco Prime 2.0

How can I get CDP neighbor information from access point reports in Cisco Prime 2.0? I have looked through all the reports and I cannot find a report that gives me the CDP neighbor information of an access point. I thought that information was in there, however I cannot seem to find it.
Thanks in advance!

Hi
You can get this from an inventory report in PI (Select Report Type AP). Here is an example of PI 2.1 works for me. Once you export this into excel you can sort based on controllers & filter the single controller connected AP you want.
Regards
Rasika
**** Pls rate all useful responses ****

How to retrieve dynamic filter value submitted from control query to .....

How to retrieve dynamic filter value submitted from control query to broadcast query.....
I'm trying to change the hierarchy version determined by a userexit variable in the broadcast query.
The Hierarchy Version should be dependent on the input filter delivered by the bursting query.
But how do I catch the dynamic filter value which has been submitted by the bursting query,
with other words: where does the bursting query store it's out put while sequentially starting the broadcast query value by value?
BTW: the filter value from the bursting query appears under "dynamic filter values" in the information of the broadcast query...
Any thoughts are welcome!
Edited by: Heinrich Krupp on Jun 24, 2009 1:25 PM

Further information,
Report is used via webi only, not Xcelsius or Dashboard.
Report is consuming BI Web Services.
Although we can pass in prompt values to BI Services, I couldn't find if we could pass a variable or dimension object into this field. Anyone knows?

IS Possible to get information from GetUserProfileByName inside of repeat section

IS Possible to get the values from GetUserProfileByName inside of repeat section? by Codeless
and then with this result used to filter DDL
Or GetUserProfileByName is only useful when it is used for FORM LOAD
CRISTINA&amp MICROSOFT Forum

Hi,
According to your description, my understanding is that you want to use the GetUserProfileByName service in InfoPath form.
We can get information from GetUserProfileByName inside of repeating section, however you need to give the name of user so that the service can be used to get the details of the user.
Please refer to the link below:
http://thinketg.com/using-infopath-and-the-web-service-getuserprofilebyname/
You can create rules to query for data using GetUserProfileByName, and it is not only useful for form load.
Thanks,
Victoria
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Victoria Xia
TechNet Community Support

How can I transfer information from one ipad to another?

how can I transfer information from one ipad to another ?

What kind of information? You can sync things like Contacts and Calendars by using iCloud. You can backup one iPad to iTunes on a computer and then sync the backup to the other iPad. You can configure your iTunes content and sync the same content to both iPads.
It is based on what you want to do. Or are you looking for a way to send files from one iPad to another wirelessly? There are apps to do things like that, as well as cloud services, such as DropBox.

How can I move information from one icloud account to a brand new one?

I've shared an icloud account with my sister for years and I want to get one with just my information. However, I'm not sure how to move or copy all of my information from my old icloud account into a brand new one and not lose any. Making a brand new one for my sister and keeping the old one isn't an option because she doesn't want to lose anything either. Help???

To migrate to a new account, start by saving any photo stream photos that you want to keep to your camera roll (unless already there) by opening your my photo stream album, tapping Select, tapping the photos, tap the share icon (box with upward facing arrow), then tapping Save to Camera Roll. If you are syncing notes with iCloud that you want to keep, you'll need to open each of your notes and email them to yourself so you can later copy and paste the text into new notes created in your new account. Then go to Settings>iCloud, tap Delete Account (which only deletes it from this device, not from iCloud), provide the password to turn off Find My iPhone and choose Keep on My iDevice when prompted. Then sign back in with a different Apple ID to create your new account and choose Merge to upload your data.
Once you are on separate accounts, you can each go to iCloud.com and delete the other person's data from your account.

How do I remove credit card information from iTunes account?

How do I remove credit card information from iTunes account?

If you have an unpaid balance or payment due, you can't select None as your payment type.
To see which order you need to pay for, view your purchase history.
When you sign in to the store, you may see a message that there was a billing issue with your last order.
Click the Billing Info button to see the order.

When I connect my iTouch to my PC (windows 7) an error message is displayed reading "iTunes was unable to load dataclass information from sync services. Reconnect or try again later".

When I connect my iTouch to my PC (windows 7) an error message is displayed reading "iTunes was unable to load dataclass information from sync services. Reconnect or try again later". I have completely uninstalled and then reinstalled iTunes. I have also completely reset my iTouch to factory defaults. I have even followed all the advice provided previously to other forum member with the same problem. Nothing seems to work. Please help me someone.

I'm getting the same problem with both my IPad 4 and iPhone 5
Just started a few weeks back, Since then I have had two Itunes updates.
Is this something Apple is aware of and trying to fix?

I connected my external hard drive to my new imac to put all of the information from my macbook onto it. i have been working on the macbook now and want to reconnect the external hard drive so my imac is updated with the work. How is that done?

I connected my external hard drive to my new imac to put all of the information from my macbook onto it. I have been working on the macbook now and want to reconnect the external hard drive so my imac is updated with the work. How is that done? or is it possible?

As I said, I don't use Time Machine, so it'd be best to wait for an "expert" answer, but, with my very limited knowledge, I'd say: probably not - so, for now, I'd suggest you read up on Time Machine:
http://web.me.com/pondini/Time_Machine/Home.html
http://support.apple.com/kb/index?page=search&src=support_site.home.search&local e=en_US&q=time%20machine
And, you might be attracting more knowledgeable answers if you were to post this question in the Time Machine Forum (part of the Snow Leopard forums).

Error on Desktop: iTunes unable to load data class information from sync services.

Error on Desktop; iTunes unable to load data class information from sync services.

Hi there Randall112,
You may find the troubleshooting steps in the article below helpful.
iTunes for Windows: "Unable to load data class" or "Unable to load provider data" sync services alert
http://support.apple.com/kb/ts2690
-Griff W.

HT201335 I started playing games on my iPhone 5 and bought the iPad air wand to link phone with iPad so all the information from the game is on my iPad so I don't have to start the game over I should be able to start from the same place in the game on ei

I need to link all of my games on my iPhone 5 to my iPad air so I don't have to start all my games over. In the Game Center all the information from my games are there but it's like I have to start the game over on my iPad. I should be able to resume the game from the same place on either device with the same trophies $ coins help help help PLEASE I have a lot of money invested in one game and don't want to start completely over

Transferring from old to new
http://support.apple.com/kb/HT2109

How to get user information from ldap - bpm11g

hi all,
i need know how to do get information from ldap, but using adf bean for show user data in adf form.
anyone knows about this ?
tks.

Neal wrote:
>
Hi,
I am using WLS default authentication to protect my JSP pages. Can someone tell
me if it is possible to add more fields to the default login box (in addition
to login and password boxes, I want to ask user the department name). In additional,
can WLS propogate this information (department name) along with other security
credentails to other J2EE components such as EJBs? In my EJBs I want to be able
to get the department name that user provided during login and then use that for
conditional business logic.
Any insights on this subject will be greatly appreciated.
TIA,
-NealYou can't do this with the default simple authentication. That can only handle a
username / password combination.
You should be able to do this with JAAS. You could write a LoginModule that
populates the department as a Principal or public Credential on the Subject in
addition to the normal authentication. You would have to do a callback handler
that passed through the department info to it.
This link has more on WLS's stab at JAAS:
http://e-docs.bea.com/wls/docs61/security/prog.html#1039659
Once you have associated the Subject with the access control context by invoking
a doAs() you should be able to get it back at any point with
Subject.getSubject(AccessController.getContext()) to get access to the
department info.
It will all be a bit of a chore, mind.

Filter AD information from Kerberos logonticket

Similar Messages

Maybe you are looking for