How to extract external directory users from a shared services group from shared services RDBMS repository

Hi,
I have a security group in shared services, which has external directory users. I want to extract the list of users from shared services RDBMS repository using a SQL query. Please let me know if this is possible and from which table(s) I can query such list.
Thanks...

You need to use CSS_Groups, CSS_GROUP_MEMBERS and CSS_USERS tables in your Foundation DB. Something like below will give you these details:
select b.Name ,a.Name from HYPFOUND.CSS_GROUPS b ,
HYPFOUND.CSS_USERS a ,
HYPFOUND.CSS_GROUP_MEMBERS c
WHERE c.MEMBER_IDENTITY = a.IDENTITY_ID and
c.GROUP_IDENTITY = b.IDENTITY_ID
GROUP BY (b.Name,a.name)

Similar Messages

How do I assign a user ID to the purchasing group so it shows up on table..

How do I assign a user ID to the purchasing group so it shows up on table T024? I'm trying to create a STO but am recieving the following error
Configuration of User ID is not set up in purchasing group T024 table
    Message no. 00398
Diagnosis
    Placeholder for batch input error text, this message is not output.
    Configuration of User ID is not set up in   purchasing group T024 table
Thanks in advance

Table T024 has no field for a user-Id in standard SAP
you can only tie a user to a purchsing group via authorization with user roles.
The message 00398 is a generic message that can be used for everything.
I guess this message is triggered in a userexit. Designed by a collegue of you.

How to Authorize external table users in OBIEE 11g

Hi All,
I have created Session System Variables and i am Using External table Data level Authentication and successfully external table Authentication is working.
My question is i want to Authorize this Extrenal table users in presentation services.e.g. I want to assign some dashboards or Reports to users.
In 10g when u login with the external table users automatically users will be created in Answers and used to assign this to webcat group.
In 11g how to achieve this???
Reply ASAP...
Thanks and Regards
Kiran Kumar
07795980891.

Hi Kiran,
Check this link.
http://www.rittmanmead.com/2010/11/oracle-bi-11g-active-directory-security-using-init-blocks-variables-10g-style/

How to display active directory users through weblogic portal Application?

Hi,
Does anyone has faced this situation?
I configured the activedirectory and able to see the users and group in the weblogic console at Security->Realms->Myrealm->users. when I run my portal application,I am able to see only the users that are configured in embedded weblogic LDAP ie, I can see only the users weblogic,portaladmin and yahooadmin that are of defaultauthenticator provider.I need to display the active directory users also in our portal.
I have two doubts on this?
1)Is it I need to write custom code to view the active directory users in our portal?
2)Does I need to use any jars that supports active directory authenticator?
I would appreciate if any one can reply on this with helpfull docs/information.
We are using BEA 8.1 SP4.
Windows 2000.
Surendra

Hi,
I too have a similar kind of requirement, i use a jsp to do this activity, but i get an exception, i have shown the entire jsp code below,
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<%@ page import="java.util.Set" %>
<%@ page import="javax.naming.Context" %>
<%@ page import="weblogic.jndi.Environment" %>
<%@ page import="weblogic.management.MBeanHome" %>
<%@ page import="weblogic.management.configuration.DomainMBean" %>
<%@ page import="weblogic.management.configuration.SecurityConfigurationMBean" %>
<%@ page import="weblogic.management.security.RealmMBean" %>
<%@ page import="weblogic.management.security.authentication.AuthenticationProviderMBean" %>
<%@ page import="weblogic.management.security.authentication.UserPasswordEditorMBean" %>
<%@ page import="weblogic.security.providers.authentication.LDAPAuthenticatorMBean" %>
<%@ page import="weblogic.management.configuration.EmbeddedLDAPMBean" %>
<%@ page import="weblogic.management.security.authentication.UserEditorMBean" %>
<%@ page import="weblogic.management.security.authentication.UserReaderMBean" %>
<%@ page import="weblogic.management.security.authentication.GroupReaderMBean" %>
<%@ page import="weblogic.management.utils.ListerMBean" %>
<%@ page import="javax.management.MBeanException" %>
<%@ page import="javax.management.modelmbean.RequiredModelMBean" %>
<%@ page import="examples.security.providers.authentication.manageable.*" %>
<%@ page import="weblogic.security.providers.authentication.ActiveDirectoryAuthenticatorMBean" %>
<%@ page import="weblogic.management.utils.InvalidParameterException" %>
<%@ page import="weblogic.management.utils.NotFoundException" %>
<%@ page import="weblogic.security.SimpleCallbackHandler" %>
<%@ page import="weblogic.servlet.security.ServletAuthentication"%>
<%!
private String makeErrorURL(HttpServletResponse response,
String message)
return response.encodeRedirectURL("welcome.jsp?errormsg=" + message);
%>
<html>
<head>
<title>Password Changed</title>
</head>
<body>
<h1>Password Changed</h1>
<%
// Note that even though we are running as a privileged user,
// response.getRemoteUser() still returns the user who authenticated.
// weblogic.security.Security.getCurrentUser() will return the
// run-as user.
System.out.println("------------------------------------------------------------------");
String username = request.getRemoteUser();
System.out.println("User name -->"+username);
// Get the arguments
String currentpassword = request.getParameter("currentpassword");
System.out.println("Current password -->"+currentpassword);
String newpassword = request.getParameter("newpassword");
System.out.println("New password -->"+newpassword);
String confirmpassword = request.getParameter("confirmpassword");
System.out.println("Confirm password -->"+confirmpassword);
// Validate the arguments
if (currentpassword == null || currentpassword.length() == 0 ||
newpassword == null || newpassword.length() == 0 ||
confirmpassword == null || confirmpassword.length() == 0) {
response.sendRedirect(makeErrorURL(response, "Password must not be null."));
return;
if (!newpassword.equals(confirmpassword)) {
response.sendRedirect(makeErrorURL(response, "New passwords did not match."));
return;
if (username == null || username.length() == 0) {
response.sendRedirect(makeErrorURL(response, "Username must not be null."));
return;
// First get the MBeanHome
String url = request.getScheme() + "://" +
request.getServerName() + ":" +
request.getServerPort();
System.out.println("URL -->"+url);
Environment env = new Environment();
env.setProviderUrl(url);
Context ctx = env.getInitialContext();
MBeanHome mbeanHome = (MBeanHome) ctx.lookup(MBeanHome.LOCAL_JNDI_NAME);
System.out.println("MBean home obtained....");
DomainMBean domain = mbeanHome.getActiveDomain();
SecurityConfigurationMBean secConf = domain.getSecurityConfiguration();
// Sar
EmbeddedLDAPMBean eldapBean = domain.getEmbeddedLDAP();
System.out.println("Embedded LDAP Bean obtained...."+eldapBean );
RealmMBean realm = secConf.findDefaultRealm();
System.out.println("RealmMBean obtained....");
AuthenticationProviderMBean authenticators[] = realm.getAuthenticationProviders();
System.out.println("AuthProvMBean obtained....");
// Now get the UserPasswordEditorMBean
// This code will work with any configuration that has a
// UserPasswordEditorMBean.
// The default authenticator implements these interfaces
// but other providers could work as well.
// We try each one looking for the provider that knows about
// this user.
boolean changed=false;
UserPasswordEditorMBean passwordEditorMBean = null;
System.out.println("UserPwdEdtMBean obtained....");
//System.out.println("Creating MSAI....");
//ManageableSampleAuthenticatorImpl msai =
// new ManageableSampleAuthenticatorImpl(new RequiredModelMBean());
//System.out.println("Done....");
for (int i=0; i<authenticators.length; i++) {
System.out.println("### Authenticator --->"+authenticators);
if (authenticators[i] instanceof ActiveDirectoryAuthenticatorMBean)
ActiveDirectoryAuthenticatorMBean adamb =
(ActiveDirectoryAuthenticatorMBean)authenticators[i];
System.out.println("### ActiveDirectoryAuthenticatorMBean .....");
String listers = adamb.listUsers("*",0);
while(adamb.haveCurrent(listers))
System.out.println("### ActiveDirectoryAuthenticatorMBean user advancement.....");
adamb.advance(listers);
if (authenticators[i] instanceof UserPasswordEditorMBean) {
passwordEditorMBean = (UserPasswordEditorMBean) authenticators[i];
System.out.println("Auth match ...."+passwordEditorMBean);
try {
// Now we change the password
// Sar comment
System.out.println("Password changed....");
//passwordEditorMBean.changeUserPassword(username,
// currentpassword, newpassword);
changed=true;
// Sar Comment
catch (InvalidParameterException e) {
response.sendRedirect(makeErrorURL(response, "Caught exception " + e));
return;
catch (NotFoundException e) {
catch (Exception e) {
response.sendRedirect(makeErrorURL(response, "Caught exception " + e));
return;
// Sar code
LDAPAuthenticatorMBean ldapBean = null;
UserReaderMBean urMBean = null;
UserEditorMBean ueMBean = null;
GroupReaderMBean gMBean = null;
//ListerMBean lBean = null;
try
if (authenticators[i] instanceof LDAPAuthenticatorMBean)
ldapBean = (LDAPAuthenticatorMBean) authenticators[i];
String userFilter = ldapBean.getAllUsersFilter();
System.out.println("userFilter ="+userFilter);
if (authenticators[i] instanceof UserEditorMBean)
try
System.out.println("UserEditorMBean...");
ueMBean = (UserEditorMBean) authenticators[i];
System.out.println("List users..."+ueMBean);
boolean b = ueMBean.userExists("webuser");
System.out.println("User Exists->>>"+b);
String cursor = ueMBean.listUsers("webuser", 2);
System.out.println("List User ----->"+cursor);
catch(InvalidParameterException e)
response.sendRedirect(makeErrorURL(response, "ERROR InvalidParameterException:" + e));
catch(java.lang.reflect.UndeclaredThrowableException e)
response.sendRedirect(makeErrorURL(response, "ERROR UndeclaredThrowableException :" + e));
e.printStackTrace();
catch(Exception e)
response.sendRedirect(makeErrorURL(response, "ERROR LBean:" + e));
catch(Exception ex)
ex.printStackTrace();
response.sendRedirect(makeErrorURL(response, "ERROR:" + ex));
return;
if (passwordEditorMBean == null) {
response.sendRedirect(makeErrorURL(response, "Internal error: Can't get UserPasswordEditorMBean."));
return;
System.out.println("pwd changed ->"+changed);
if (!changed) {
// This happens when the current user is not known to any providers
// that implement UserPasswordEditorMBean
response.sendRedirect(makeErrorURL(response,
"No password editors know about user " + username + "."));
return;
%>
User <%= username %>'s password has been changed!
<br>
<br>
</body>
</html>
Here is the console log
User name -->webuser
Current password -->i
New password -->u
Confirm password -->u
URL -->http://localhost:7011
MBean home obtained....
Embedded LDAP Bean obtained....[Caching Stub]Proxy for mydomain:Name=mydomain,Type=EmbeddedLDAP
RealmMBean obtained....
AuthProvMBean obtained....
UserPwdEdtMBean obtained....
### Authenticator --->Security:Name=myrealmDefaultAuthenticator
Auth match ....Security:Name=myrealmDefaultAuthenticator
Password changed....
UserEditorMBean...
List users...Security:Name=myrealmDefaultAuthenticator
User Exists->>>true
java.lang.reflect.UndeclaredThrowableException
at $Proxy1.listUsers(Unknown Source)
at jsp_servlet.__updatepassword._jspService(__updatepassword.java:411)
at weblogic.servlet.jsp.JspBase.service(JspBase.java:33)
at weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run(ServletStubImpl.jav
a:1006)
at weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java:419)
at weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java:463)
at weblogic.servlet.internal.ServletStubImpl.invokeServlet(ServletStubImpl.java:315)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletC
ontext.java:6718)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:121)
at weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:37
64)
at weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2644)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:219)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:178)
Caused by: javax.management.MBeanException
at weblogic.management.commo.CommoModelMBean.invoke(CommoModelMBean.java:551)
at com.sun.management.jmx.MBeanServerImpl.invoke(MBeanServerImpl.java:1560)
at com.sun.management.jmx.MBeanServerImpl.invoke(MBeanServerImpl.java:1528)
at weblogic.management.internal.RemoteMBeanServerImpl.private_invoke(RemoteMBeanServerImpl.j
ava:988)
at weblogic.management.internal.RemoteMBeanServerImpl.invoke(RemoteMBeanServerImpl.java:946)
at weblogic.management.commo.CommoProxy.invoke(CommoProxy.java:365)
... 14 more
### Authenticator --->Security:Name=myrealmDefaultIdentityAsserter
pwd changed ->true
Can u pls let me know how to get all the entries from LDAP.
Thanx
Sar

How i configure external directory and email

hi every one
i have just installed and login to oracle beekeeper successfully. now i want to intergate the external directory to my active directory so that all users in it will be mapped in oracle beehive secondly i can use them for email purpose.
i am really new to oracle beehive , i have read the administration manuals. but still confusing how to start , the parameters in external directory creation for active directory cannot understandable for me, what does authectic attributes means.
kindly guide me in this regard and secondly if any image base document avaible so that i configure it through that.
regards
Oraclebeehive new user

Hello,
The primary Authentication Attribute, is just the LDAP attribute you will use to be able to log on Beehive
That can be an UID, the email address, the cn or with AD the sAMAccount
eg: uid: 123455667
mail: [email protected]
cn: firstname.lastname
these attributes and their associated values are on AD and must be available for ALL employees as well as UNIQUE.
Often the email address, the UID or the sAMAccount have unique value.
Hope that help
However, You may want to take some days of expertise to help you on this setting. That will simplify and speed up your learning curve and Beehive implementation.
Regards,
Fred

How to Add Active Directory user to Admin Role

Hi All,
I am trying to figure out how to add a AD user to the Admin Role..
I am connected to AD and can see the user (myself), however, when I try to add myself to the admin role, it says user not found.
I go to Security Realms > myreals > Roles and Policies > Global Roles > Roles > Admin > View Role Condition.
I see that the Administrators Group is already added. Now I click "add Conditions" and select "User" from the Predicate List and type in the user " Doe' John".
On the next screen I get "user: John or Dow" does not exist.
Another option could be to add the user to the Administrator group, but I couldnt figure out how to do that as well. When I navigate to the user under Users or Groups, I dont see an option to add that user to the Administrator group.
Is it that you can only add users created in Weblogic to the Admin group?
Any help on this will be very appreciated.
Thanks in advance.

I think I got it. I had to add the AD group the user is part of to the Admin role.

How do I allow other users on my wifi to print from their computers?

How do I allow other users on my network (wifi) to print on my printers?

Hi there,
You may find the article below helpful.
iTunes: How to share music between different accounts on a single computer
http://support.apple.com/kb/HT1203
-Griff W.

How to add a new user property and then retrieve it from a portlet

Trying to add a user property and then retrieve it form a remote web service?
Add a user property and map it
1. Create a property2. Go to Global Object Property Map3. Go to users, edit and select the new property.4. Go to User Profile Manager5. For portlets, go to the "Position Information" section and add it. (for the purpose of this test, add it to the profile section as well)6. Under the "User Profile Manager" go to the "User Information - Property Map" step in the wizard and 7. Go to the "User Information Attribute" and add the property.8. Click on the pencil to the right of it and give it a name (The name is what's going to appear in the list of user information under the portlet web service)9. Click finish10. Now create/edit the web service for the portlet from which you want to displays user properties. 11. Under the "User Information", click "add existing user Info" and select the property you want.12. From the portal toolbar, edit the user profile under "My Account" and then "Edit user Profile" and give the new property a value. 13. Test code below: ================================in C# IPortletContext context = PortletContextFactory.CreatePortletContext(Request,Response);IPortletRequest portletRequest = context.GetRequest();System.Collections.IDictionary UserInfoVariables = portletRequest.GetSettingCollection(SettingType.UserInfo);System.Collections.IDictionaryEnumerator UserInfo = UserInfoVariables.GetEnumerator();
while(UserInfo.MoveNext()){ //to display in a listbox ListBox1.ClearSelection(); ListBox1.Items.Add(UserInfo.Key.ToString() + ": " + UserInfo.Value);}===========================in ASP: <%Dim objSettings, dUserInfo, sEmpIDSet objSettings = Server.CreateObject("GSServices.Settings") ' get the user info settings, get employee ID from user infoSet dUserInfo = objSettings.GetUserInfoSettings
for each item in dUserInfo response.Write "<BR>" & item & ": " & dUserInfo(item)next%>

IPortletContext portletContext = PortletContextFactory.createPortletContext(req, res);
IPortletRequest portletReq = portletContext.getRequest();
String value = portletReq.getSettingValue(SettingType.Portlet,settingName);

How to populate active directory users in to drop down list items dynamically in Share point 2010 ?

Hi My self Arun in my current project i have a task on that active directory user need to automatically populate in share point list drop down please help me. is that any out of box feature in share point 2010 ?
Thanking You
Arun

Arun,
If you plan to implement the "Querying the Active Directory" based on my code snippet,
and if you do not have permission [your account must be the part of domain admin] to do so,
Then still you can do it in least effort through code,
string usersInXml = SPContext.Current.Web.AllUsers.Xml;your xml string look like this.
<Users><User ID="2" Sid="" Name="Administrator"
LoginName="i:0#.w|murugesan\administrator" Email="" Notes="" IsSiteAdmin="True" IsDomainGroup="False" Flags="0" /><User ID="1" Sid="" Name="Murugesa Pandian" LoginName="i:0#.w|murugesan\murugesan" Email="" Notes="" IsSiteAdmin="True" IsDomainGroup="False" Flags="0" /><User ID="1073741823" Sid="S-1-0-0" Name="System Account" LoginName="SHAREPOINT\system" Email="" Notes="" IsSiteAdmin="False" IsDomainGroup="False" Flags="0" /></Users>
You can user Linq to XML to filter the "LoginName,Name and Email and then populate your drop down list.
* User must be logged into the site at least once.
Murugesa Pandian.,MCTS|App.Devleopment|Configure

How to extract,list of users linked as contact person to which customer?

Hi
Is it possible to extract from CRM production system a complete list showing which users are
linked as contact persons to which customers?
As you can imagine it is top critical that customer users are never linked to any other customer accounts than their own, so we need to implement a regular validation of these relationships. With our number of customers and users it is impossible to check one-by-one in CRM, but with following information in a regularly provided list, it would be reasonably easy:
Customer BP
Customer name
Customer Sales Office
Contact person BP
Contact person name
Contact person user ID
Date of relationship creation
Please advice.
Regards
Pravin Babu

Hi Pravin,
The information you need is available in three tables/visions:
- BUT000 - For BP numbers and names
- BUT050 - For BP relationships (BUR001 is the one for contact person)
- CRMV_BP_FRG0140 - For sales office (you have to use partner_guid field)
I don't know any standard report that will delivery this information as this. But based on this tables, you can build your own, or make a sap query/quickviewer to get this information.
Hope that helps!
Kind regards,

How to integrate active directory users(credentials) to Open Directory LDAPv3?

-I don't want to have a separate directory anymore.

Hi RM,
It would require that you setup your Portal in such a way being able to handle Windows Integrated Authentication via Kerberos. This is already very well explained in the following blogs:
/people/wai-hon.lam/blog/2006/04/20/windows-integrated-authentication-via-kerberos-on-an-ldap-data-source
http://wiki.sdn.sap.com/wiki/display/EP/SingleSignOntotheJ2EEEnginefromWindows
After setting up your datasource, in your case the ADS, you will need to run SPNego Wizard in NWA to have it integrated with SSO.
Best regards,
Andre

How do I get another user's music onto my ITunes (from the same computer)?

Hey everyone.. I'm new to Macs and definitely new to iPods. I just got an iPod nano, but my husband has had an iPod for a while. He has built up a really great music collection and I'd like to get his music onto my iTunes (without erasing his of course). We have separate accounts and I'm not sure how to go about getting his muisc.
Please help! Thanks in advance!

Kirstin, this document should be of some help with that:
iTunes: How to share music between different accounts on a single computer

External LDAP user only has search priviledge in UCM

After I have configed external LDAP successfully in weblogic console, I can see all user from external LDAP. And external LDAP user can login UCM successfully, but these users only has search priviledge. I want external LDAP user has Admin priviledge as weblogic(Default in embed LDAP). How to solve it. Any help will be appreciated greatly! Otherwise, I refer to Oracle's ducument,
51.1.14 LDAP Users Not Receiving Some Administrator Privileges
UCM inspects for the group "Administrators" on each user's login to grant UCM roles. If a user should have access to the UCM admin server, the UCM server requires that the user be a member in a group named "Administrators."
How to add external LDAP user to the group of Administrators.

Hi ,
You can use Credential Maps to be achieve the requirement:
Steps for the same are :
1. Login to UCM - Administration - Credential Maps .
2. Create the map name and the following mapping :
<ldap role> , admin
3. Save the changes
4. Navigate to <domain_home>/ucm/cs/data/providers/jpsuserprovider/provider.hda
add the following variable there :
ProviderCredentialsMap=<map name created in step 2>
5. Save the changes and restart ucm server .
After that login with the user who has the ldap role that is mapped in stpe 2 , this user will have the ucm admin role .
Hope this helps .
Thanks
Srinath

Remove Active Directory User Discovery

We're looking at enabling Active Directory User Discovery in our Config Mgr 2012 instance as as part of testing Intune. If we decide to not implement Intune, will we be able to disable Active Directory User Discovery, and remove that information from
the database?
If so, is there good documentation on how to do this?
Thanks

The easiest is to disable the Active Directory User Discovery
and than delete all the users from the All Users collection.
My Blog: http://www.petervanderwoude.nl/
Follow me on twitter: pvanderwoude

Not able to open active directory user and computer in windows server 2008r2

Hi All techies,
i would like to know one issue which i am facing mostly, i have created 5 virtual machine all with window server2008r2 and one windows 7 on vm-ware now when ever i start my virtual machines everything going rite but when i try to open active directory user/
computer or domain and trust i get a following error "data from active directory user and computers is not available from dc(null) bcoz unspecified error" even when i chk in events log its give me no help, and after 15-30 min everything works good
Please let me know the cause of it and really appreciate it .
Thanks
Atul

You need to ensure that
1. group policy that says "wait for network before logon" is applied to all computers including servers and workstations is applied
2. DNS record exists for all DCs in DNS
3. If there are multiple Domain Controllers in Forests, then they point them as secondary DNS server. This way they will be able to resolve IPs if local DNS server service takes time to start.
As Chris mentioned, you need to start all DCs first, give a time of 5 minutes and then start member servers and workstations for successful logon.
- Sarvesh Goel - Enterprise Messaging Administrator

How to extract external directory users from a shared services group from shared services RDBMS repository

Similar Messages

Maybe you are looking for