Identity Server - orcladmin access rights

Hi,
I have created the identity server which points to the directory server and have marked orcladmin as the master administrator. When I login into the Identity Server using the orcladmin user and try to create users, the message Insufficient Access Rights is displayed in red. Any idea why this might be happening.
TIA
Rgds..VJ

Thanks..Working now
Just one basic question - Are these workflows configured as per the role given e.g. create user basic profile is tagged to the identity administrator role ? So can we configure only a predefined set of workflows which automatically get mapped to the roles available ?
Tks...VJ

Similar Messages

  • Problem with orcladmin access rights

    We've successfully installed an OAM/OIM platform with Identity Server & Access Server running on one box; WebPass, Policy Manager and WebGate running on Tomcat-2.0 on another box. All screens are coming up but we get access rights errors when trying to add a user or group. The exact error message is 'You do not have sufficient access rights'.
    How can we reconfigure orcladmin so it has rights to add users and groups in Identity Administration?

    You would need to use the 'Create User' Workflow to create a user from Identity System.
    Refer:
    http://download.oracle.com/docs/cd/B28196_01/idmanage.1014/b25343/workflow.htm

  • Getting error in starting identity server and access server in OAM

    Hi all,
    Am new to OAM . now am try to do sso for two different resources . i completed installations but now the error is the while starting the identity server the error is "*oracle access manager identity server services on local computer started and then stopped .some services stop automatically if they have no work to do , for example, the performance logs and alters service* ". and while starting access server the error is "*could not start the oracle access manager access server service on local computer. error 1067: the process terminated unexpectedly* " any one please give me solution for this error

    Hi Pokuri,
    Perhaps the Identity Server's oblog.log file has some helpful information in it. One possibility: is the ldap server that the Identity Server uses up and running (and visible on the network)?
    Regards,
    Colin

  • Orcladmin: "Insufficient access right to perform action" using oidadmin

    After sucessfully installing OID from 8.1.7 CD on Sun Solaris 8
    (SPARC) I can start the monitor and the oidldap. After
    sucessfully connecting with orcladmin using oidadmin I always get
    the same error (either using oidadmin on windows or solaris) when
    accessing "entry management", "schema management" or "audit log
    management":
    Insufficient access right to perform action.
    but the default ACP allows everyone (browse add delete)
    anyone else had the same problem?
    I tried to create the name server with OID with netca which
    obviously does not work either.

    Hi Christian:
    You say that you conencted to OID as "oidadmin". Since OID does
    not have any user account called "oidadmin" you were probably
    conencted as an anonymous user. If you are trying to connect as
    the administrator of OID the correct user account name is
    "orcladmin" with a default password of welcome. Try this and let
    me know if you sitll have troubles.
    Thanks,
    Jay Tomlinson

  • Insufficient access rights registering Oracle Directory Integration Server

    Hi all!
    following steps I´ve done to use the Oracle Directory Integration Server.(I´ve installed Oracle 10g infrastructure - OID is running - I´m also able to apply successful with ODM and orcladmin account)
    - oidctl connect=mydb1 server=odisrv instance=1 stop
    - odisrvreg -h localhost -p 389 -D cn=orcladmin,cn=Users,dc=localhost;dc=com -w ,pass
    where pass is the password of orcladmin.
    -> now I get the following error:
    registering..
    Error javax.naming.NoPermissionException [LDAP:error code 50: Insufficient Access Rights]; remaining name 'cn=odisrv+orclhostname=maschine,cn=odi,cn=oracle internet directory' !
    Any idea ??
    Thanks for all help & comments.

    I have gone through the documentation for creating the script. But there is one thing which I am not able to understand i.e. Subscription Parameters.
    Can anyone tell me the use of subscription parameters? What is the role of subscription parameters in Oracle Lite and External Authentication.
    Regards
    Kapil

  • Page Not Found error when accessing the Identity server console

    Hi,
    I have installed the Sun One Portal Server.
    when i access the URL for Identity server, i am getting Page not Found exception.
    Any suggestions, why this problem could occur.
    Regards,
    Mukta

    First the obvious: Restart the Webserver/Application Server
    Did you choose "Configure Later"?
    Is amconsole/amserver/... really deployed? You can see this in the Admin web interface of the server.
    Do you see anything in the logfiles?
    Chris

  • Page not found error while accessing Identity server console(Error Code:50)

    Hi Guys,
    Whenever I am trying to access the admin console of Identity server I am getting Page not found error. I believe some configuration must be missing for which I am getting this error. I am accessing the URL through following URL
    http://<Portal Server Fully Qualified Domain Name>/amconsole
    Please Help me if anybody has come across this problem

    Hi,
    First of all,check your install logs.
    Most likely you should find errors like the following
    "cannot access /usr/jdk/ent2se "
    "/usr/jdk/bin/jar" not found etc.
    In these cases the problem is the JDK version.
    Install the latest version of JDK and make sure that
    /usr/bin/java points to the installed JDK version.
    HTH,
    Ramnath

  • WebPass communication to access server and identity server failing

    I have Identity server installed on Windows and WebPass on IIS web server. When I go to http://hostname:port/identity/oblix/ and http://hostname:port/access/oblix/the default page shows up. But when I click on the Identity System Console link, it Hangs. This behaviour has occured today although the things were working fine prior for a long time. I have checked the webpass logs but nothing specific to the problem is coming.

    Hi Colin,
    There is an activity on the server,as the processing goes on after entering credentials and there is no blank page. I have put on HTTP Headers
    and there result is
    POST /identity/oblix/apps/admin/bin/front_page_admin.cgi?pluginName=front_pageadmin&program=commonLogin&returnUrl=..%2F..%2F..%2F..%2F..%2Faccess%2Foblix%2Fapps%2Fadmin%2Fbin%2Ffront_page_admin.cgi%3FloginTry%3D1%26pluginName%3Dfrontpage_admin&backUrl=..%2F..%2F..%2F..%2F..%2Faccess%2Foblix%2Fapps%2Fadmin%2Fbin%2Ffront_page_admin.cgi HTTP/1.1
    Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-powerpoint, application/vnd.ms-excel, application/msword, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, */*
    Referer: http://10.1.9.4/identity/oblix/apps/admin/bin/front_page_admin.cgi?program=commonLogin&returnUrl=..%2F..%2F..%2F..%2F..%2Faccess%2Foblix%2Fapps%2Fadmin%2Fbin%2Ffront_page_admin.cgi%3FloginTry%3D1%26pluginName%3Dfrontpage_admin&backUrl=..%2F..%2F..%2F..%2F..%2Faccess%2Foblix%2Fapps%2Fadmin%2Fbin%2Ffront_page_admin.cgi
    Accept-Language: en-us
    Content-Type: application/x-www-form-urlencoded
    UA-CPU: x86
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; FDM; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
    Host: 10.1.9.4
    Content-Length: 104
    Connection: Keep-Alive
    Cache-Control: no-cache
    I have tried to access from different browsers and different machines,but the prblem remains same.

  • OAM - Identity Server Cache Flush to Access Server

    In OAM, a feature is that any user profile change in identity server could be updated to access server cache. Currently, we run into problem. the cache flush is a water fall process, from one identity server to an access server then to all other access servers. If one server hangs and does not respond, all servers may hang (that happens to us).
    I would like to know if you are using this feature and if you run into the same problem. You can also comment if this is a necessary feature and/or a troublesome feature. I would appreciate your any contribution. Thank you!
    Richard

    I am facing issue while setting up the automatic cache flush for access server.It looks like you were able to set up this. Can you please provide bit more details?. I have tried by setting -
    a. Parameter doAccessServerFlush in basedbparams as <NameValPair ParamName="doAccessServerFlush"
    Value="true"/>
    b. An Access Gate has been configured under /identity/AccessServerSDK
    My requirement is to flush the changes to the Group membership in a group. Are there any specific restrictions on what is included in user cache?.
    Thanks
    GK Bhat

  • Which is the right IDE to develop policy Agents in Identity Server

    Hi,
    Can any one tell me which is the right IDE to develop agents in Identity Server.Am thinking of using Sun One Studio??Any better IDEs??
    Thanks,
    Ramnath

    Your favorite text editor and a comman-line javac. What do you expect from an IDE?!

  • ACS 5.3 Authorization problem with using Identity Groups in Access Policy Rule

    Hello guys, I am found a problem which I can't solve regarding authorization with using Identity Groups in Access Policy rule.
    ACS version: 5.3.0.40.6 (internal build B.839)
    I have very simple RADIUS Authorization rule which authorize user on behalf of right Identity Group.
    Requested Identity Group exist
    Testing user is created in Internal Users and has assigned requested Identity Group
    Radius Access Policy: 
    Authentication against Identity Store Sequence, where authorization server is external RSA SecurID device and additional attributes retrieval is configured from Internal Users.
    Authorization is very simple – One Rule with only one Condition which is: Identity Group - in - Requested_Testing_Rule. Then Default rule is set to Deny.
    When I will try login with my testing user then authentication against RSA SecurID is OK, but authorization will be denied by Default rule – It looks like my Rule with Identity Group is totally omitted.
    I am managing several other ACS servers (version 5.3 but with older patches) where similar rules are working without problem.
    What I am tested:
    Remove testing user and create his account again.
    Rename Identity Group
    Use another Identity Group
    Remove Access Policy rule and create it again
    Use Compound Condition: System:Identity Group
    Use Compound Condition: System:UserID instead of Identity Group in Rule (it is working without problem)
    Do you have any idea where problem can be?

    OK guys, it started working yesterday without any configuration change. Maybe it was some database inconsistence wich was solved by ACS itself.

  • You do not have sufficient access rights, pls help

    Hi folks,
    I'm getting the "You do not have sufficient access rights" error accessing the Identity System Console. The same admin account can access User/Group/Org Manager screen, however, for some reasons user and group searches return no results. This is the second OIS install against the same ldap dir (ovd to sun 6.3), so I had to specify Id server was not the first one to avoid profile conflict with oblix DBAgents. The admin user had been selected during prev install, and exists under o=Oblix in both cn=Web Masters and cn=Directory Administrators.
    I have LDAPMaxNoOfRetries set to the number of dir servers +1 in all globalparams.xml on OIS. I also can modify ldap dir via both ldapmodify and ldap browser binding to OVD as same user. Turning the TRACE on didn't showed any errors except for the following:
    DB_RUNTIME WARNING 0x00000504 ldap_config_db.cpp:187 "Exception during DB runtime code" function^LDAPConfigDB::Open() status^17
    DB_RUNTIME WARNING 0x00000504 ldap_config_db.cpp:355 "Exception during DB runtime code" function^LDAPConfigDB::ReadOblixDBConfig()status^17
    SCHEDULER_FRAMEWORK ERROR 0x00000501 ../obschedulerthread.cpp:316 "ObError exception caught" ObScheduledTaskLiaison::LoadTasks^ObWFScheduledTaskLiaison
    PPP INFO 0x000008C7 obeventcatalog.cpp:183
    Cannot find the action
    function^ObEventCatalog::GetActionEntry2Modify()
    actionName^front_page_admin_klogin_post
    APP_BASE WARNING 0x00000833 oblixbasecommon2.cpp:1235
    Login failed
    Error^You do not have sufficient access rights
    numLoginFailures^1
    There's nothing in the ldap logs either. The only warning I get per that user is in the ovd log:
    DoSManager: Found unbound connection from active ip addresses
    DoSManager: Found unbound connection from active users
    The Oracle Support is clueless, please help.
    Thank you, Roman

    Hi Vinod,
    Thanks for the post. OK, if I got it right, I have two entries under obcontainerId=DBAgents for each of my primary Id servers. For the one I currently use, I have this towards the bottom:
    obname=oblixConfig-OIS_mdi-oamlx-3
    obname=default-OIS_mdi-oamlx-3
    Both entries have obdbusedby set to OIS_mdi-oamlx-3 which is my OIS id. The obsearchbasestr is different: o=Oblix,o=paychex inc for the oblixConfig, and o=paychex inc,c=us for the default one. Is that's the way it should be?
    Thanks Roman
    P.S: I've noticed I get same error accessing My profile under User Manager.

  • OAM- "You do not have sufficient access rights" message with Master Admin

    Customer has configured the OAM system to have both the primary and the secondary side for failover purposes. The back end directory server on both systems are in sync. The primary side of the systems works well as far as this issue is concerned.
    On the secondary side, if you login with the MASTER administrator of the system and click 'Identity System Console' or click any of the configurations under the Configurations in the User Manager, you get the error message saying "You do not have sufficient access rights". However, if they navigate to the Access system on the same browser and access the "Access System Console", and then navigate back to the Identity system, the Master Administrative rights are granted and now have a full access to the system.
    We tried following things to resolve the issue, but could not resolve it:
    1) Tried deleting 'cookieencryptionkey' which is found under "obcontainerid=encryptionkey,o=oblix" and restarted both the Identity Servers.
    2) Confirmed that the OAM administrator is present in cn=Web Masters,o=Oblix,<> and cn=Directory Administrators,o=Oblix,<> from the LDAP.
    3) Under the apps=PSC node, checked the Advance Properties for the 'obuniquememberStr' attribute:
    - Master Web Resource Admins (cn=master web resource admins, obapp=PSC, o=oblix, ...)
    Made sure that the values for the 'obuniquememberStr' attribute has the correct value there.
    4) Reconfigured the Secondary Identity Server.
    None of the above really helped to resolve the issue.
    Could anybody please help here to get rid of this issue.
    -Amol

    Hi Vinod,
    Here is the customer's response to your above 2 questions:
    1. We have 4 Directory server profiles for Identity servers; one for user data and one for configuration data for each server.
    I have at least reduced them to two and used only the ones initially used by the primary identity server as our user and configuration data do not reside together. User data is consumed via OVD.
    However, this does not seem to have any effect on the current behavior.
    2. All components except for the access server are on 10.1.4.2 and the access server is on 10.1.4.1
    Also below are the errors from the oblogs:
    dentity Server log
    =============
    2008/03/19@10:04:16.508530 4332 262160 PPP INFO 0x000008C7 obeventcatalog.cpp:183 "Cannot find the action" function^ObEventCatalog::GetActionEntry2Modify() actionName^ENCRYPTION_cookieEncryptionKey
    Access Server Log
    =============
    2008/03/19@10:03:56.329959 13608 1687633 CONNECTIVITY DEBUG3 0x00000201 /usr/abuild/Oblix/1014lwhf/palantir/netlib/src/obmessagechannel.cpp:601 "Received " ipaddr^10.217.209.81 ipport^1853 seqno^12 opcode^1 opcodeStr^IsResrcOpProtected Message^ro=t%253d0%2520o%253d%2520no%253d%2520r%253d%2520nr%253d%2520wu%253d/identity/oblix/apps/admin/bin/frontpage_admin.cgi%2520wh%253d10.217.209.81%2520wo%253d1%2520wa%253d0%2520ws%253d st=ma%253d2%2520mi%253d2%2520sg%253d0%2520sm%253d version=3 pd=
    2008/03/19@10:03:56.340433 3099 802864 AUTHENTICATION DEBUG2 0x00000201 /usr/abuild/Oblix/1014lwhf/palantir/aaa_server/src/aaa_service_server.cpp:2779 "Authorization successful"
    Webgate Log
    ==========
    2008/03/19@10:04:05.661000 5796 4516 HTTP_REQ DEBUG3 0x00000201 \Oblix\coreid1014\palantir\webgate2\src\isprotected.cpp:185 "Resource is protected" ResourceOperation^GET ResourceType^http Resource^//10.217.209.81/identity/oblix/apps/admin/bin/front_page_admin.cgi authnSchemeName^Oracle Access and Identity Basic Over LDAP
    2008/03/19@10:04:14.661000 5796 4516 LDAP DEBUG3 0x00000201 \Oblix\coreid1014\np_common\db\ldap\util\ldap_util2.cpp:537 "MLK-Memory leak for LDAP error information. This will show up as memory leak in LDAP SDK calls." key^25
    2008/03/19@10:04:14.661000 5796 4516 LDAP DEBUG3 0x00000201 \Oblix\coreid1014\np_common\db\ldap\util\ldap_util2.cpp:537 "MLK-Memory leak for LDAP error information. This will show up as memory leak in LDAP SDK calls." key^25
    2008/03/19@10:05:54.552000 5796 5256 CONFIG DEBUG2 0x00000201 \Oblix\coreid1014\palantir\access_api\src\obconfig.cpp:865 "Client configuration not updated"
    2008/03/19@10:05:54.552000 5796 5256 CONFIG INFO 0x0000182D \Oblix\coreid1014\palantir\access_api\src\obconfig.cpp:866 "The Access Server has returned a fatal error with no detailed information." raw_code^302
    I checked the OVD logs but did not find any error in it. Customer also tried to unprotect the /identity and /access URLs but the issue persist.
    Also I do not feel this as a bug, because this environment was working quite for few months without any such issues, also there were no changes made on the OVD/AD configurations. However, the server that hosts the OVD/AD was shut down and when it was restarted, we started experiencing this issue.

  • Security solution with Identity server for SOX compliance

    Hi all,
    Has anybody used Identity Server as security solution to achieve SOX compliance? i want to know general view, opinions , experiance of ppl while implementing such solution.
    Just a little background of SOX: It is Created by US Congress in the wake of corporate scandals like Enron in 2001 and 2002.it is an attempts to tighten controls over corporate financial reporting and transparency.
    I am basically interested in implementing security solutions using Identity server for SOX compliance. Section 404 of this act deals with internal controls, which essentially requires organizations to provide following facilities -
    1. User Identification, authorization and access
    2. User control of user accounts
    3. Central identification and access rights/permissions management
    4. Violation and security activity report
    Has anybody developed such solution? What are your general experiance, problems , issues etc? Please share your view....

    Just too quick to draw conclusion: See below FAQ
    If you are not in the same AS container, let me know. Jerry
    Copy from J2EE agent FAQ
    Question - Is it possible to install a J2EE 2.1agent and Identity Server on the same instance of the application server ?
    Installing the IS60SP1/IS61 server and J2EE 2.1 policy agent on the sameninstance of Application server is not a supported configuration. We do support the 21 J2EE agent and IS installed on different instances of the application server. So, users can install theJ2EE 2.1 agent on a one instance of the application server and install IS on a different instance of the apps server.

  • OAM Identity Server user search is very slow after upgrading to 10.1.4.2

    We recently upgraded Identity-Server from 7.0.4 to 10.1.4.2 + BP10. The new webpass (version 10.1.4.2) is on iPlanet webserver, which does not have any bundled patch available. After this upgrade, we found the user search is very slow. It is taking double the time compare to version 7.0.4. The search performance for NetPoint admin users is fine.
    The new version is connecting to the same LDAP (Sun 5.2) as the old one. The 7.0.4 version was well tuned (like Ldap connections, caching, etc) for the performance. The migration suppose to carryover those performance configuration to the new version. Is there any new parameter (related to performance) I should look for in version 10 ? Anybody have faced these issues after migration and found a fix for it ?
    Thanks!
    Kabi

    More in this thread - Re: OAM- "You do not have sufficient access rights" message with Master Adm
    -Vinod

Maybe you are looking for