Group matching from Ace SecureID-server to VPN 3005?

Hi
Is it possible to do group-matching between a Ace Server SecureID and VPN 3005 concentrator?
That is, I want different users to match different group settings in the VPN 3005, based on which group they are in in the Ace Server.
If Yes: how? :-)
Regards
Jimmy

Hello!
Well yes it would work. BUT...you have to change your config a bit. First you need to apply your accesslist to both interfaces, or the ACE will reject it, because it is acting as a firewall by default. And second you have to apply the policymap to both interfaces as well or you put the policymap globally on the ACE.

Similar Messages

Get all groups from an AD Server

Hi everyone,
I'm trying to get all groups from and AD server.
Here's how I'm doing it:
DirContext ctx = new InitialDirContext( (Hashtable<String,String>) env);
          Name n2 = new CompositeName().add(groupsContainer);
          NamingEnumeration<Binding> contentsEnum = ctx.listBindings(n2);
          int i = 1;
          while ( contentsEnum.hasMore() && (i++) < 1000 )
               Binding binding = contentsEnum.next();
               groups.add(binding.getName().substring(3));
          return groups; The problem is, I always get an error if I don't restrict the results number to below 1000.
The error is the following *javax.naming.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit Exceeded];*
After googling, I found it it's due to a field in the AD Server, that restrict the result number.
So there is no way that I can obtain all groups without changing that field?
Regards,
Nuno.

Hi Nuno,
You have to increase the MaxPageSize value at ActiveDirectory level to retrieve results more than 1000. By default the MaxPageSize value is 1000. There is no option other than increasing the MaxPageSize value.
Thanks & Regards,
Murali.
============

SSL VPN IP Address Assignment from IAS radius server

Can I use SSL VPN IP Address Assignment from IAS radius server?it can be done with acs server.are there some differ from the acs and IAS?

Hi,
I will suggest to setup a sniffer capture with ACS and look for the attribute that ACS sends for IP Address Assignment, once you know the attribute apply it on the IAS.
If you have any question do not hesitate to contact me.

Windows 8 and IE10 and 11 not accepting Proxy Settings via Group Policy from windows server 2003

Hi
We are still running Windows Server 2003 with a Win7 and Win8 desktop environment. I can control Win7 IE9 settings,
But Win8 systems are running IE10. We have an internal proxy server.
Is there any way to force the proxy settings to the Win8/IE10 or 11 systems .
i have tried with The IE 10 .adm template and applied gpo,but does not have any proxy settings for ie10 and no changes were applies
please can anyone help me regarding this
i want to apply GPO from windows server 2003 to windows 8 ie10/11
Thanks
KNC

Hi,
I agree with Zanderol24, we can install RSAT on a windows8 client, and then we can use Group Policy Management to manage group policy from the client.
For more information about RSAT, we can refer to the following link:
Remote Server Administration Tools (RSAT) for Windows Client and Windows Server (dsforum2wiki)
http://social.technet.microsoft.com/wiki/contents/articles/2202.remote-server-administration-tools-rsat-for-windows-client-and-windows-server-dsforum2wiki.aspx
For more detailed information about how to use GPP to configure the proxy setting for ie10 and ie11, we can refer to the following link:
How to configure Group Policy Preference settings for Internet Explorer 11 in Windows 8.1 or Windows Server 2012 R2
http://support.microsoft.com/kb/2898604
When we use GPPs you need to be aware of the F5-F8 keys:
Red / Green: GP Preferences doesn’t work even though the policy applied and after gpupdate \force
http://blogs.technet.com/b/grouppolicy/archive/2008/10/13/red-green-gp-preferences-doesn-t-work-even-though-the-policy-applied-and-after-gpupdate-force.aspx
Besides, aside from using group policy to manage IE, IEAK can also be used to do this.
For IEAK, the following article can be referred to for more information.
Internet Explorer Administration Kit (IEAK) Information and Downloads
http://technet.microsoft.com/en-in/ie/bb219517.aspx
Best Regards,
Erin

Can we reconcile secondary group name from unix server

Hi,
Can we reconcile secondary group name from unix server using some own Customise code?

Using JNDI this should not be very hard.
Are you planning to store the secondary groups as a child table to a unix RO?
Int hat case It might actually be easier and quicker to sidestep the recon system entirely and interact directly with the child form.
Best regards
/Martin

Migrating Users and Groups from Windows 2000 server to Windows 2013 Standard.

OK...let me see if I can get this question out the way I need to....
I inherited a Windows 2000 Server that's on it's last legs. We have a new server, a Windows 2013 Standard machine that we just recently purchased. I need to migrate the users and groups over to the new server, but there are two things that are
making it difficult:
The 2000 machine is NOT a Domain Controller
The 2000 machine is NOT running Active Directory
This is a file server that hangs onto another network of which I have no control of. It has its' own IP address and there is NO WAY we can run Active Directory or make it a domain controller.
I have close to 300 users, groups, and printers to bring over to the new server. Rather than kill myself doing manual input, is there any other way to do this?

Hi,
When you import the CSV file to new server, you need to create a new user account then import the CSV.
http://blogs.technet.com/b/heyscriptingguy/archive/2014/10/01/use-powershell-to-create-local-users.aspx
If you have any issue, i suggest you could ask in PowerShell forums:
https://social.technet.microsoft.com/Forums/en-US/home?forum=winserverpowershell
Regards.
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Anyconnect tunnel-group and group-policy from LDAP

Recently we've changed from LOCAL to LDAP authentication and added additional group-policies for different users to increase security.
To prevent users from selecting an incorrect group-policy, the LDAP server provides a IETF-Radius-Class value which matches the different group-policy names.
It is my understanding that the authentication method is provided by the tunnel-group.
tunnel-group DefaultWEBVPNGroup general-attributes
authentication-server-group LDAP_AD
This all works, but for _one_ of the group policies i'd like to enable (external) two factor authentication. Two enable two factor auth a 'secondary-authentication-server-group' needs to be set in the tunnel-group.
Creating a tunnel-group which maches the name of the group-policy doesn't seem to have any effect. When listing the connected users via "show vpn-sessiondb anyconnect", it always states the correct Group Policy but also always DefaultWEBVPNGroup.
When enabling the listing of tunnel-groups for webvpn, thus allowing users to select their own tunnel-group, the two factor auth does work.
To summarize, is it possible to let LDAP decide which tunnel-group is used or is there another way to have different group policies without users being able to choose ?

Fabian,
Your connection lands on a tunnel group and picks a group policy.
A typical way to overcome the problem you're indicating is by using group-url.
a URL is bound to a specific tunnel-group and allows you to land directly on the one you desire.
vide:
http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98580-enable-group-dropdown.html
M.

Deploying via powershell command from AppV Management Server 5.0

Hello All,
Good day!
I am having hard time in deploying an application from AppV Management Server 5.0 using Powershell command.
I have an application which works in Standalone client machine and even from SCCM 2012(AppV Deployment), whereas if I deploy that application from AppV server it is not working
I am using this command line to deploy an application from AppV Mgmt server thru powershell command,
Import-AppvServerPackage -PackagePath "<Path of .appv file>" –DynamicDeploymentConfigurationPath "<Path of DeploymentConfig.xml"> | Publish-AppvServerPackage -Verbose | Grant-AppvServerPackage -Groups "domain\AppV_Users"
-Verbose
is there anything wrong in the command which I used?
When I run, am receiving this error.
Import-AppvServerPackage : A parameter cannot be found that matches parameter name
'DynamicDeploymentConfigurationPath'.
At line:1 char:126
+ ... 1.0.3333.appv" –DynamicDeploymentConfigurationPath '\App_DeploymentConfig.xml' ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Import-AppvServerPackage], ParameterBindingException
+ FullyQualifiedErrorId : NamedParameterNotFound,Microsoft.AppV.Server.Cmdlets.ImportAppvServerPackageCommand
whereas this command works, without DynamicDeploymentConfigurationPath
Import-AppvServerPackage -PackagePath "<Path of .appv file>" | Publish-AppvServerPackage -Verbose | Grant-AppvServerPackage -Groups "domain\AppV_Users" -Verbose
How do I direct my application to take the DeploymentConfig.xml file though powershell.
I even tried to Import this xml from AppV Management console, even it did not work for me.
Kindly help me, your inputs needed.
Any help would be greatly appreciated.
Thanks in Advance!
Regards,
Raj

Hi Falko,
Thanks for your response.
As you said, I tried to import the package and used set-appvserverpackage
PS C:\Users\Administrator.xxxxxxxxxxx> Import-AppvServerPackage "\\appv\Content\Filezilla\Filezilla.appv"
Id : 15
Name : Filezilla
Description :
PackageGuid : e8720679-cc41-4578-98a4-32a382f790ef
VersionGuid : 296708bc-e07d-474a-bb46-1f09d9779a4c
Version : 0.0.0.1
Enabled : False
Applications : {}
Entitlements : {}
ConnectionGroups : {}
PackageUrl : \\appv\Content\Filezilla\Filezilla.appv
import was successful, when I try Set-Appvserverpackage am receiving the following error
PS C:\Users\Administrator.xxxxxxxxxxx> Set-AppvServerPackage -DynamicDeploymentConfigurationPath "\\appv\Conte
nt\Filezilla\Filezilla_DeploymentConfig.xml" | Publish-AppvServerPackage -Global
Set-AppvServerPackage : Parameter set cannot be resolved using the specified named parameters.
At line:1 char:1
+ Set-AppvServerPackage -DynamicDeploymentConfigurationPath "\\appv\Content ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [Set-AppvServerPackage], ParameterBindingException
+ FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.AppV.Server.Cmdlets.SetAppvServerPackageCommand
I am going wrong somewhere...

How to issue print command from report/form server to client printer on web

1) We have a client server application which is to be deployed on the web environment. The reports generated in our application are having a destination type as File. These reports are printed after applying some print format (escape sequences) which are passed on to the printer programmatically at runtime while printing.
Now when this application is shifted on to the Application server (Forms server & Reports Server )in web environment ,the report outputs would be generated in the application server as against the client in client server environment as the report server is on the application server.
Now while printing/accessing the report the output file will not be available to the client unless it is pushed on to the client side from the server . I am able to see reports in pdf/html output but in this case layout of my reports gets changed and I dont want to change my layouts or reformat my report layouts.
How do I redirect the report output from the application server on to the client within the D2k context and then execute print commands?
Note: In this case we want to use both DMT and Laser printing. Also note that we use escape sequences to adjust reports in desired printing papers.
2) We have second set of reports which we call as document because these are printed after capturing data from 'Form' using text_io utility (please note that for these documents we are not using any Report 6i functionality)and we print it from file using printing mechanism as mentioned above. These are working well in client server application. We adopted this methodology for getting better performance (in terms of speed as database server and network traffic is not involved) of printing. But now we are converting our application for web, we are finding it difficult how to capture Form's data from browser to client's machine and then executing printing commands which are stored in our application liabrary.
If you help me out by giving some suggestions, I shall be grateful to you.
null

Hello
I wonder if you ever solved this problem.
I have a very similar problem with Photoshop CS5 on Mac OSX 10.6 + HP Photosmart C7180.
If I choose "Photoshop Manages Colors" the results are lousy.
If I choose "Printer Manages Colors" the results are OK. not necessarily great.
I believe I have all the correct settings after going through books and web advice (and wasted a lot of paper and ink).
As far as I can see, "ColorSync" is the internal Mac management which is the only option available with "Photoshop Manages Colors" and "Vendor Matching" appears to mean the printer vendor (ie HP) will provide the matching. Either can be selected if "Printer Manages Colors" is used. It seems the type of paper can be set in three different places. if That's all a bit academic as the results are poor regardless.
My wife suggests I buy a new printer - Epson's looking good.
Any words of wisdom would be appreciated.

File name structure for picking up X12/EDIFACT documents from an FTP Server

According to some documents, and posts in this forum, the file name for a document retreived from an FTP server by B2B has to be in the following format: %TPName%_%X12 Doc Type%_%X12 Version_1_12345.dat
Why is this format required? Is it possible to obtain all this information for the Header Envelopes of each X12 or even EDIFACT EDI Document?

Thanks Ramesh.
I did specify the propery oracle.tip.adapter.b2b.edi.identifyFromTP=Group, but I was still not getting the expected results. Now I played around for a while and now I identified the problem . When I specify the property oracle.tip.adapter.b2b.edi.identifyFromTP=Group, I should use the Group ID when I create the agreement so that the agreement would be identified by using group id. I think I got that working now.
I have one question on the trading partner end point URL in FILE/FTP. When I specify the endpoint URL for a trading partner would that be used to pull the document from the trading partner or push the documents to trading partner?
In my testing even though I specified the end point URL for the trading partner using FILE protocol, when I put the message in that URL ( folder), it did not pull the message from that URL ( this trading partner is the initiator for that EDI 204 message). But when I put the messages into the host partner's end point URL, it got pulled and processed successfully. I am little confused on the usage of trading partner end point URL for the FILE/FTP protocols . Could you explain me little bit or point me to a documnet where it is expalined in detail?
Bala

File transfer from a FTP server to another External FTP server

Hi,
I have one FTP server , I need to transfer a file from this FTP server to aother external FTP server. Could any one please help me how to write a batch file on FTP server so that my file is transfered to another FTP server by executing the Batch file. I don't want to use SAP server for this.
best regards
bobby

CREATE CONTROLFILE
Caution:
Oracle recommends that you perform a full backup of all files in the database before using this statement. For more information, see Oracle9i User-Managed Backup and Recovery Guide.
Purpose
Use the CREATE CONTROLFILE statement to re-create a control file in one of the following cases:
All copies of your existing control files have been lost through media failure.
You want to change the name of the database.
You want to change the maximum number of redo log file groups, redo log file members, archived redo log files, datafiles, or instances that can concurrently have the database mounted and open.
Note:
If it is necessary to use the CREATE CONTROLFILE statement, do not include in the DATAFILE clause any datafiles in temporary or read-only tablespaces. You can add these types of files to the database later.
An alternative to the CREATE CONTROLFILE statement is ALTER DATABASE BACKUP CONTROLFILE TO TRACE, which generates a SQL script in the trace file to re-create the controlfile. If your database contains any read-only or temporary tablespaces, that SQL script will also contain all the necessary SQL statements to add those files back into the database.
http://download-west.oracle.com/docs/cd/B10501_01/server.920/a96540/statements_54a.htm#SQLRF01203

How can I use LDAP searching from OSX Lion Server to Mozilla Thunderbird?

How can I use LDAP searching from OSX Lion Server to Mozilla Thunderbird? We have a super awesome contacts server that works great for our Mac users. About 30% of our company are on PCs, and I would like to use the Mozilla Thunderbird mail client for them. I see that in Thunderbird I can set up LDAP searching, and would like to have this feature point to our contacts server. I've tried several different settings, and looked all over the web, but could not find the proper way to configure this. Does anyone know if this can be done, or if not, would have a better suggestion? Thank you for your time!!

try double clicking keychain acces should launch and ask if you want to install login, system, System roots
A dialog box will launch asking where to install the cert since your configuring a vpn I would put the certificate it in system.

Can iDSIE (Meta-directory) be used as a single authentication point from iPlanet Web Server for multiple databases using direct "or" indirect connectors?

Basically, the latest release of iPlanet Web Server forces the user/group information source to be an LDAP database. Currently, the user accounts are in Active Directory, NT, Oracle and NetWare Directory Service in this heterogeneous environment.
What I am looking for is a meta-directory product which can do two things:
1-Single authentiation point for users in mulitple databases from iPlanet Web Server.
2-Single administration point for all of the databases listed above.
For example, can I add/modify/delete a user account at the meta-directory level and have this propagate to all of the databases listed above reducing the administration to one meta-directory product?

With an Virtual Directory solution, you can authenticate Iplanet Web Server against nearly anything including any LDAPv3 Directory Server, Microsoft Active Directory, Windows NT Domains, Oracle RDBMS, IBM DB2 RDBMS, Microsoft SQL, and others.
All of this is done dynamically and doesn't require any heavyweight synchronization process. The Virtual Directory acts as a dynamic schema / DIT / data translation engine for different types of repositories.
OctetString's Virtual Directory Engine is one such example. You can download a 30 day evaluation copy at:
http://www.octetstring.com
It will take you all of 30 minutes to get iPlanet Web Server authenticated against and using groups from things like Oracle RDBMS, Windows NT Domains, or Active Directory.

How do I move mail from an old server to a new server?

I am rebuilding my server. The new server runs on OS X 10.9.4 with Server 3.1.2. The old server ran OS X 10.9.x and Server 3.x (the exact versions are not known).
Within the folder /Library/Server/Mail, I found the email stores for both systems. I have gone through each folder and identified the 36 character string that serves to identify the user's mailbox and paired each one to a user id on both systems. On the old system, there are multiple mailboxes for some users, and I think it is a result of the users being deleted and recreated: perhaps the system identified the identical name and assumed that the user might be different and therefore created a unique 36 character id for the mail system.
The trick is, I am trying to recover the mail from the old server.
I have attempted to copy the files which are human readable and formatted for SMTP transmission to the new server under the correct mailbox corresponding to the owning user (see screen shots below). The simple act of copying the files has not made these files visible via the IMAP protocol. I have tried restarting the mail service hoping that the Server app would rebuild whatever indexes need to be built so that the mail can be served via IMAP, and that has not worked either.
The question is, how do I get the mail from the old server mail boxes into the new server mailboxes?
This screen shot shows the location of one mail collection at /Library/Server/Mail/Data/mail/[userid]. Mail sits in the "new" folder only for a moment before being processed and put into the "cur" folder. Copying mail from the old server into the "new" folder produces an empty "new" folder, but one can see the files populate briefly before they are moved into the "cur" folder.
The next screen shot shows one email opened in TextEdit. The format should look very familiar. This is the same format that one would use to send SMTP requests to an SMTP server. This particular example happens to be an email from a Gmail account to the PediatricHeartCenter.org domain to test the mail system when the old server was set up. It was sent on 24 Jan 2014 and had text reading "Intended for Mavericks1. -Jared".

On further research, I have learned that OS X Server sets Dovecot to use the MailDir format. The email messages can be removed from the folders and put back, and as long as they were present in the folder to begin with (received by Dovecot originally), they reflect in the Mail.app on client computers. Deleting a file in the "cur" folder causes the file to disappear in Mail.app. Copying the file back into the "cur" folder will cause the file to reappear without any modification of an index file or any other system component, as long as the file was properly formatted by Dovecot to be identifiable to that folder.
According to Dovecot.org's review of MailDir found here (http://wiki2.dovecot.org/Ma,ilboxFormat/Maildir), the file name can be broken into simple pieces: " [unixtimestamp].[process id].[hostName],S=<message size>,W=<virtual message size>/2,[status tags]". The original MailDir++ specification requires the string ":2," to appear after the virtual size, but this file naming format is not legal in Mac OS X, so Dovecot is modified by Apple to use "/2," instead.
The Dovecot's wiki describes inserting new messages as follows:
Mail delivery
Qmail's how a message is delivered page suggests to deliver the mail like this:
Create a unique filename (only "time.pid.host" here, later Maildir spec has been updated to allow more uniqueness identifiers)
Do stat(tmp/<filename>). If the stat() found a file, wait 2 seconds and go back to step 1.
Create and write the message to the tmp/<filename>.
link() it into new/ directory. Although not mentioned here, the link() could again fail if the mail existed in new/ dir. In that case you should probably go back to step 1.
All this trouble is rather pointless. Only the first step is what really guarantees that the mails won't get overwritten, the rest just sounds nice. Even though they might catch a problem once in a while, they give no guaranteed protection and will just as easily pass duplicate filenames through and overwrite existing mails.
Step 2 is pointless because there's a race condition between steps 2 and 3. PID/host combination by itself should already guarantee that it never finds such a file. If it does, something's broken and the stat() check won't help since another process might be doing the same thing at the same time, and you end up writing to the same file in tmp/, causing the mail to get corrupted.
In step 4 the link() would fail if an identical file already existed in the maildir, right? Wrong. The file may already have been moved to cur/ directory, and since it may contain any number of flags by then you can't check with a simple stat() anymore if it exists or not.
Step 2 was pointed out to be useful if clock had moved backwards. However again this doesn't give any actual safety guarantees, because an identical base filename could already exist in cur/. Besides if the system was just rebooted, the file in tmp/ could probably be even overwritten safely (assuming it wasn't already link()ed to new/).
So really, all that's important in not getting mails overwritten in your maildir is the step 1: Always create filenames that are guaranteed to be unique. Forget about the 2 second waits and such that the Qmail's man page talks about.
The process described by the QMail man page referenced above suggests that as long as a file is placed in the "new" folder, that a mail reader can access it. The mail reader then moves the file to the "cur" folder and "cleans up" the "new" folder. This is clearly happening in OS X, because the messages are moving from "new" to "cur", but IMAP is still not serving these foreign messages to the remote readers.
The thought crossed my mind that perhaps it is the fact that the host name does not match, which would cause the failure, however changing the "host" portion of the name from the old-server to the new-server did not fix the issue. Even with the new server name in the file name, the inserted message fails to appear in client Mail applications.
Within the file their is header information that still references the old machine. I'd like to not have to change the email files, because this will violate the integrity of the message. Also, this might take a lot of time or incur risks associated with poor automated processing. The header information should not be referenced by Dovecot, because the wiki page describing MailDir notes that neither Dovecot nor Dovecot's implementation of IMAP refers to the messages header information when moving and serving these mail files.
Unlike when using mbox as mailbox format, where mail headers (for example Status, X-UID, etc.) are used to determine and store meta-data, the mail headers within maildir files are (usually) notused for this purpose by dovecot; neither when mails are created/moved/etc. via IMAP nor when maildirs are placed (e.g. copied or moved in the filesystem) in a mail location (and then "imported" by dovecot). Therefore, it is (usually) not necessary, to strip any such mail headers at the MTA, MDA or LDA (as it is recommended with mbox).
This paragraph leads me to believe that after the mail box is identified that the content of the file becomes irrelevant to the system which manages. This suggests that we should be able to inject messages into a mailbox and have the system serve them as though they had belonged in that mailbox all along. Yet I have not found a way to do this.

How can I back up Contacts synced from an Exchange server into iCloud?

Hi everybody. I would like to back up into iCloud my Contact (and Calendars too) which I have previously synced to the device ( that is an iPad air running iOS 8.2.1) from an Exchange server. The green flags in Settings / ICloud are duly switched on but no contact will appear under Groups/all iCloud. Is this feature feasible at all or is there something missing in the procedure I follow ? I'll appreciate any clues. Piero

Hi Brendan. Thanks for your clue but unfortunately that did not solve the problem. Prior to posting my query I had already checked out the article you're referring me to (whose URL is http://support.apple.com/kb/PH3605). It may well be that I'm not being crystal clear owing to my far from perfect English but the whole point is precisely that I'm not able to import contacts which ALREADY appear on my iPad - being the outcome of syncing my remote MS Exchange account with the device - into iCloud. The procedure described in the quoted article simply doesn't work (for that matter, no such Setting sign pops up under ICloud contacts). In fact, it appears that the only contacts which I'm able to keep under iCloud are those which I directly create from scratch within iCloud Group itself. Since I'm likely to have my MS outlook account ( which is mirrored into a MS Exchange one for remote usage) forcibly deleted in one month time or so, I started worrying about how to keep my contacts alive/ intact after that deletion. Hope the issue got clearer now ... Cheers, Piero.

Group matching from Ace SecureID-server to VPN 3005?

Similar Messages

Maybe you are looking for