IIS - assigning a userid to a role

When we use IIS as HTTP proxy we can retrieve the complete correct
userid. Is it possible to assign this userid to a role in the filerealm
without having to define a password for it. This way we can assign the
correct role for that user without the need for prompting for a
password. (If we use NTRealm we also have a problem, we can't have
several Windows Primary Domain Controllers in 1 cashinf realm).
Regards,
Merg

I can see publish query To Role, To Portal & BEx broadcaster, this will publish my query. My need is to publish or assign workbook to a role. When you log in through Bex Analyzer, you have two options 1). Open Query, 2). Open workbook., If you choose Open workbook, you can see all workbooks created. I would like to assign these workbooks to a role. Otherwise these workbooks will be saved in the favourites and no one else can view this other then me.

Similar Messages

OES MAPI problem of "Assigning Principals to an Administration Role"

Hi,
I meet the problem of programmatically Assigning Principals to an Administration Role using Oracle Entitlement Server Management API. I can successfully run the sample code following the <Developer Guide>, Chapter 5.4.3 Assigning Principals to an Administration Role
My code snippet is like this:
List<PrincipalEntry> principals = new ArrayList<PrincipalEntry>();
     principals.add(new BasicPrincipalEntry
       ("weblogic.security.principal.WLSUserImpl", "Lisa"));
     //Grant the users in the list the role
     admManager.grantAdminRole(adminRole, principals);
And no error or exception occurs in java app side or oes_admin side. But when login to http://vmware.localdomain:7001/apm admin GUI, I could not login with Lisa.
I also tried manually assign app1 with delegated admin role, and then Lisa can successfully login to admin GUI.
Then I run the app program to programmatically assign app2 with delegated admin role to Lisa. Login with Lisa could not see app2.
I have checked the system admin "weblogic" login to admin GUI and it can see that app2 already have Lisa listed on the external user of delegated admin of app2.
I even checked the DEV_APM.JPS_CHANGELOG in the oracle database schema for oes. I can see the changelog of java app assiging operation.
Can anyone tell me the reason why programmatically assign user to an delegated admin not work correct? Is there some mistake steps in my java app code or there is a bug in OES product?
I use the OES 11.1.1.5 version with Oracle Database 11.2.0, Weblogic 10.3.5 on Oracle Enterprise Linux 6 32bit.
Thanks very much.

Thanks very much for all the reply posts. With the suggestions from yours, I tried distribute the policy and finally it works!
The code snippet is from 4-8 Using the distributePolicy() Method , listed below:
//get the PolicyDistributionManager
PolicyDistributionManager pdm =
app.getPolicyDistributionManager();
//distribute policies
String distID = pdm.distributePolicy(true);
DistributionStatusEntry status = pdm.getDistributionStatus(distID);
System.out.println("Start distribute policy");
while (status.getPercentComplete() != 100) {
Thread.currentThread().sleep(200);
System.out.print(".");
status = pdm.getDistributionStatus(distID);
System.out.println("Finish distribute policy");
There is another trick that I discovered from DEV_APM.JPS_CHANGEBLOG:
If this is the first time that user be assigned as a delegated admin, you should also grant user with applicaionRole "APMViewer" to the application "oracle.security.apm"
You can refer to the sample code from 2-9 Assigning Principals to an Application Role , also listed below:
ApplicationPolicy app = ps.getApplicationPolicy("oracle.security.apm");
AppRoleManager roleMgr = app.getAppRoleManager();
//Construct the list of users to be granted
List<PrincipalEntry> principals = new ArrayList<PrincipalEntry>();
principals.add(new BasicPrincipalEntry
("weblogic.security.principal.WLSUserImpl", "Nick"));
//Grant the users in the list the role
//admManager.grantAdminRole(adminRole, principals);
AppRoleEntry appviewerRole = roleMgr.getAppRole("APMViewer");
roleMgr.grantAppRole(appviewerRole, principals);

OBIEE 11g issue - same user assigned to the multiple application role

Hi All,
We are facing an issue when assigning a user to the multiple application role and applying the data level filter on the different column of the same table.
For example, we have a table Department with three columns Department No, Department name, Department location.
Application Role A1 and A2 are created.
Data Level security Applied on the application role A1: Department Name='Finance'
Data Level Security Applied on the application role A2: Department location='US'
The user "User1" is created in LDAP and is assigned to both the Application roles A1 and A2.
When logged in with "User1", none of the filters of Role A1 or A2 is applied in the report. If this user is assigned to only one role, either A1 or A2, then the filter is applied. It seems the filter will not be applied if a user belongs to multiple roles with data filter applied on the same table across these roles.
Please reply if anyone has faced similar issue.

Hi All,
Regarding the above issue to update the analysis we came up that the user if assigned to the multiple group with the data filter applied on the same column of the table is getting an *"OR"* join.
We had a requirement to get an "AND" in the query condition. Please let us know if any one faced the issue and the resolution of the same.
Regards,
Jyotshna

How to assign possible agents at security role / CAG level?

Hi Experts, How to assign possible agents at security role / CAG level?

Yes, that's exactly what I'm talking about. In your task maintenance, goto additional data -> agent assignment -> Maintain
Click on th task, click on the assign button. Choose object type 'Role', enter role.
Cheers,
Mike

Which authorizations are required for assigning a query to a role?

Hi everybody,
we try to set up some roles for "reporting power users". These guys should be alble to define new queries using BEx (works fine) and also should be able to assign these new defined queries to a role, so other users can use these roles.
The idea is simple, but we're searching for the right authorization object (or - as i suppose - set of authorization objects) that enables the user to assign a query to a role (using that "enter to a role" button in the open / save dialog).
At the moment, the user can user that button, and the role, he should the query assigned to is shown. After selecting the role and clicking button "create" it take some seconds and a message "error when saving. entry has not been created" is shown.
Obviously, there is a problem with writing the role (or adding the new information to that role).
So, could anyone help me and provide me with a list of authorization objects that are required.
Thanks in advance,
Alfred

S_RFC
S_TCODE
S_USER_GRP
S_BDS_D
S_OD_SEND
S_RS_AUTH
S_RS_BCS
S_RS_COMP
S_RS_COMP1
S_RS_FOLD
S_RS_ICUBE
S_RS_MPRO
The above mentioned authorization objects are enough to add in the role and required for the accessing a query.
particularly, S_RS_COMP, S_RS_COMP1, S_RS_MPRO, S_RS_ICUBE are the most important auth objects which are directly getting involved in authorization of a query in a role.
SO, you have to assign the respective info area, info cube and info providers names in these auth objects.
The same scenario , i am using in my project to give access to the queries in all the areas for my end users.
The values and access/authorizations restrictions is up to your project requirement.
Hope this would help you.

Assigning Group(of users) to Role when starting a process programmatically

Hi All,
I m starting a process programmatically(using startProcess()).
Process initiation is working fine, but i need to assign a 'Group' to the role, and not a user. It is a portal group, available at portal end only. How can this be done?
Please guide.
Thanks and Regards,
Sakshi

you can use the following code
import com.sap.caf.eu.gp.process.api.GPProcessFactory;
import com.sap.caf.eu.gp.process.api.IGPProcess;
import com.sap.caf.eu.gp.process.rt.api.IGPProcessRoleInstanceList;
import com.sap.caf.eu.gp.process.rt.api.IGPRuntimeManager;
import com.sap.security.api.IUser;
public void startProcess( java.lang.String processId )
   // retrieve the Runtime Manager
   IGPRuntimeManager rtm = GPProcessFactory.getRuntimeManager();
   // create an empty role assignment list
   IGPProcessRoleInstanceList roles = rtm.createProcessRoleInstanceList();
   // get the process role number
   int rolenum = process.getRoleInfoCount();
   // iterate over the required roles
   for (int i = 0; i < rolenum; i++) {
      // create a new role instance by specifying the role's unique name
      IGPProcessRoleInstance roleInstance = roles. createProcessRoleInstance(process.getRoleInfo(i).getRoleName());
      // add a user to the role instance
      roleInstance.addUser(roleUser);
      // add the new role to the assignment list
      roles.addProcessRoleInstance(roleInstance);
Thanks and Regards
shanto aloor

The security-role-assignment references an invalid security-role: Certifica

In Oracle Enterprise Pack for Eclipse, I failed to deploy an application in debug mode. The error I noticed in my domain log is:
weblogic.management.DeploymentException: [HTTP:101168]The security-role-assignment references an invalid security-role: Certificate.
     at weblogic.servlet.security.internal.WebAppSecurity.setRoleMapping(WebAppSecurity.java:180)
     at weblogic.servlet.security.internal.WebAppSecurity.registerSecurityRoles(WebAppSecurity.java:155)
     at weblogic.servlet.internal.WebAppServletContext.prepareFromDescriptors(WebAppServletContext.java:1181)
     at weblogic.servlet.internal.WebAppServletContext.prepare(WebAppServletContext.java:1120)
     at weblogic.servlet.internal.HttpServer.doPostContextInit(HttpServer.java:449)
     at weblogic.servlet.internal.HttpServer.loadWebApp(HttpServer.java:424)
     at weblogic.servlet.internal.WebAppModule.registerWebApp(WebAppModule.java:910)
     at weblogic.servlet.internal.WebAppModule.prepare(WebAppModule.java:364)
     at weblogic.application.internal.flow.ScopedModuleDriver.prepare(ScopedModuleDriver.java:176)
     at weblogic.application.internal.flow.ModuleListenerInvoker.prepare(ModuleListenerInvoker.java:93)
     at weblogic.application.internal.flow.DeploymentCallbackFlow$1.next(DeploymentCallbackFlow.java:387)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:37)
     at weblogic.application.internal.flow.DeploymentCallbackFlow.prepare(DeploymentCallbackFlow.java:58)
     at weblogic.application.internal.flow.DeploymentCallbackFlow.prepare(DeploymentCallbackFlow.java:42)
     at weblogic.application.internal.BaseDeployment$1.next(BaseDeployment.java:615)
     at weblogic.application.utils.StateMachineDriver.nextState(StateMachineDriver.java:37)
     at weblogic.application.internal.BaseDeployment.prepare(BaseDeployment.java:191)
     at weblogic.application.internal.EarDeployment.prepare(EarDeployment.java:16)
     at weblogic.application.internal.DeploymentStateChecker.prepare(DeploymentStateChecker.java:155)
     at weblogic.deploy.internal.targetserver.AppContainerInvoker.prepare(AppContainerInvoker.java:60)
     at weblogic.deploy.internal.targetserver.operations.ActivateOperation.createAndPrepareContainer(ActivateOperation.java:197)
     at weblogic.deploy.internal.targetserver.operations.ActivateOperation.doPrepare(ActivateOperation.java:89)
     at weblogic.deploy.internal.targetserver.operations.AbstractOperation.prepare(AbstractOperation.java:217)
     at weblogic.deploy.internal.targetserver.DeploymentManager.handleDeploymentPrepare(DeploymentManager.java:723)
     at weblogic.deploy.internal.targetserver.DeploymentManager.prepareDeploymentList(DeploymentManager.java:1190)
     at weblogic.deploy.internal.targetserver.DeploymentManager.handlePrepare(DeploymentManager.java:248)
     at weblogic.deploy.internal.targetserver.DeploymentServiceDispatcher.prepare(DeploymentServiceDispatcher.java:159)
     at weblogic.deploy.service.internal.targetserver.DeploymentReceiverCallbackDeliverer.doPrepareCallback(DeploymentReceiverCallbackDeliverer.java:157)
     at weblogic.deploy.service.internal.targetserver.DeploymentReceiverCallbackDeliverer.access$000(DeploymentReceiverCallbackDeliverer.java:12)
     at weblogic.deploy.service.internal.targetserver.DeploymentReceiverCallbackDeliverer$1.run(DeploymentReceiverCallbackDeliverer.java:45)
     at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
What I do not understand is that this error remains even though I modified weblogic.xml to remove the following lines:
<wls:security-role-assignment>
<wls:role-name>Certificate</wls:role-name>
<wls:externally-defined/>
</wls:security-role-assignment>
I also deleted <MYDOMAIN_HOME>/servers/AdminServer/cache and <MYDOMAIN_HOME>/servers/AdminServer/tmp but this error still showed up when I attempted to deploy the application in Eclipse.
If I exported the EAR file and deployed it using Admin Console, the application was deployed successfully. But when I deleted it in Admin Console and attempted to deploy it in Eclipse again, the same error occurred and the deployment failed. What could be the reason for this behavior? Is there anything cached somewhere when deploying it in Eclipse? Thanks in advance for your help.

Hi,
I know that is an old thread, but just in case... Maybe you could try setting up the DEBUG_OPTIONS in your startManagedWeblogic script and configure a remote debug in Eclipse:
DEBUG_OPTIONS="-Xdebug -Xnoagent -Xrunjdwp:transport=dt_socket,address=8003,server=y,suspend=n"
Hope it helps,
Luis

Context based assignment - context filter to display roles

Hi!!
I would like to make a guided task with a context named SYSTEM that contains values such as SAP ECC / SAP BW... and once the user selects the system (s) he wants (step 1), the appropriate roles (corresponding to the value of the context SYSTEM) display in step 2.
I assign the MX_CTX_TYPE to the roles. Roles having context type SYSTEM were well display. Then I add the MX_CTX_CONDITIONAL (by modifying the attr to allow assignment to MX_ROLE entrytype) to the same roles. But it seems that the filter is made at contexte type level and not value context level.
1 : Do you think if it's possible to use context value as filter for displaying roles in step 2?
2 : Do you know a way to filter on system for displaying roles in order to assign them to a user even if it's not a guided task? I tried to use the FIELD functionnality but it seems that it's not allow with the attribute type of MX_ASSIGNMENT.
Thanks,
Guillaume

Also suggest that you have a look at the MX_ASSIGNMENT attribute on the user, for use in the WebUI. This attribute will allow you to see both role and privilege assignments in a WebUI task. This also has the "context" setting as you mentioned.
Regards
John Erik Setsaas
Development Architect IdM

Assigning a workbook to the role

Hi Gurus,
We are using NW2004s and are in front end patch 12.
We have created a workbook role to assign all our workbooks, however Iam unable to find an option to assign these workbooks to the role. In earlier versions (3.x) there was a role icon in Bex Analyzer which we use to use to assign the workbooks, Iam not seeing this icon anymore in BI7. Can someone quide on how to assign this.
Thanks!

I can see publish query To Role, To Portal & BEx broadcaster, this will publish my query. My need is to publish or assign workbook to a role. When you log in through Bex Analyzer, you have two options 1). Open Query, 2). Open workbook., If you choose Open workbook, you can see all workbooks created. I would like to assign these workbooks to a role. Otherwise these workbooks will be saved in the favourites and no one else can view this other then me.

Assigning App Builder and Application roles using Account Administration Tool

If you have a DPS Enterprise or Professional Account and need to assign App Builder or Application role to an id to in case you need to create a new id with these roles, refer to the following documentation:
Assigning App Builder and Application roles in your DPS Professional or Enterprise accounts

gnm,
Please refer to KnowledgeBase 2IDDCHB9: Using Remote Panels with a LabVIEW Applications (EXE) for the information you are looking for.
Randy Hoskin
Applications Engineer
National Instruments
http://www.ni.com/ask

Problem while assigning multiple staffing to project role.

Dear All,
I am facing problem while assigning multiple staffing to project role.
In the project role, we are doing staffing ( assigning BP). While assigning the BP's getting below errors.
Resource assignments overlap
Message no. DPR_BUPA_LINK004
Diagnosis
The validity period '10.02.2008'-'01.03.2008' for the assignment of project role Product Manager and ' Rakesh Pradhan' overlaps with the validity period of the assignment ''.
However, the project role type does not allow several staffings to be edited at the same time in the project role.
System Response
The system does not allow this constellation of data when saving.
Procedure
Check and correct the start and finish dates of the staffings affected.
Request you to advise in fiixng the issue.
Thank you for your cooperation.
Regards,
Ranjan

Hi Biplab,
For multiple staffings in the same time frame, check the option of 'Edit in Parallel' in the Role Type settings in SPRO.
Let me know if that helps.
Regards,
Vivek Pandey

Bulk assignment from Queries to a role

Hey folks,
we would like to transport more than 100 queries (not Workbooks) - from an Excel-list.
Unfortunantely, it is not possible to filter queries in Transport Connenction, compared to Workbooks.
Therefore we created a temp-Role, assigned all Queries to this role, selected that role in the transport connecntion and we had our 100 queries selected by selecting only the temprole - this is much faster.
As we´d like to improve this, I would like to know, what is the fastest way, to assign 100 reports to a temp-role? Any suggestions on that?
Best regards,
Christian Röttgers

Any suggestions?

How to change HR assignment for BP with employee role in CRM

Hi,
we download employees from R3 HR into CRM. By mistake, some duplicates BP were created. we want to change the assignment with the BP employee in CRM and the employee in R3. In other word, to remove the personnel number ID stored in CRM and to add this personnel ID to others BP in CRM.
For example:
In CRM, BP 100 does not have a personnel number assigned to his employee role.
In CRM, BP 101 (duplicate of BP 100) is assigned to the personnel number 345 from the employee in R3.
We'd like to assign the personnel number 345 to BP 100 and remove the link with HR in BP 101.
is it possible? where is this assignment stored - In R3&HR or in CRM?
can you guys share your experience on how to resolve this
thanks in advance
Stephanie
Edited by: Stephanie Blouin on May 6, 2008 2:16 PM

Hi,
We can assing the CC in two ways.
1. is for position.
2. or for a Org unit.
In your case if it is for Position. GOTO PP02 enter the details as
Plan Version    HI
Object Type     s
Object ID       50018133
Object abbr.
Infotype        1001
Subtype         A011
Planning status 1
Validity        06/23/2008 to     12/31/9999
Data sample.
Then goto change and change the CC. this will also updates the IT0001.
If not, You can also change through Org unit.
Where goto PPos_old> select the org unit> then goto staff assignments> select the required position> and there is a option called goto from top menu> there you can check accoutn assignment> there you will get diff screen to be displayed--> there select the position if you want to change and select the option maste cost center and change the CC by giving dates, this will also updates the IT0001.
Reward me if hleps.
Thanks,
Vasu.

Assigning different authorizations inside a role to different users

Hello,
Could someone please guide me to how can we assign different authorizations (authorizations field values) for an authorization object inside a role to different users; i.e. in the role maintenance transaction (pfcg) after we create a new role and add an authorization object to it, if this authorization object has several authorizations (authorization field values), and if I need to add two users to that role, how can I assign to one user an authorization different from that assigned to the other user ?
Thank you in advance.
Best regards.
Reda Khalifa
IT Department - Almansour Automotive Group - Egypt

Hi Reda,
That documentation complicates the subject slightly as it is talking about principles that are at a lower level than the usual role level.
We have 1 authorisation object - S_TRVL_BKS
Authorisations have been created for this object, called S_TRVL_CUS1 and S_TRVL_CUS2
In this context, an authorisation is an instance of an authorisation object that has been populated with data.
Before the profile generator you used to create authorisations (auth objects populated with data) and assign them to profiles which are then assigned to users.
In this example 2 profiles would be needed
Profile1: S_TRVL_CUS1 and S_TRVL_CUS2
Profile2: S_TRVL_CUS2
Miller would be assigned profile1, Meyers would be assigned profile2
The profile generator allows us to easily build authorisations and profiles and packages them up in a role. This way, we can assign transactions and authorisation objects into a role, populate the authorisations (which is what we do in the authorisations tab in the role) and automatically create the profile.
The example in the documentation is still valid because it requires 2 seperate authorisations (and therefore profiles and roles) to be assigned to different people. Unfortunately this is not explained very well in the documentation.
I hope that makes sense, roles are static and the permissions that they give do not vary dynamically. In BW we can use variables to do something similar and to some extent structural authorisations in HR work dynamically however this doesn't apply to R/3 or ECC. (it can be done in come cases but costs many, many £££/$$$'s)
Please let me know if you want me to elaborate further on this
Cheers
Alex

Is it possible to filter Account Assignment rule by Account Creators Role?

Hi,
We have enabled Account Assignment rule but would like to know how we can filter the rule to fire only when the Account Creator's role is not equal to "Account Manager"
Is this possible?
jang
Edited by: jang on Aug 25, 2010 9:59 AM

hi Subbu,
thanks for replying but that does not fit our requirement.
our account assignment's Unassigned Owner is our CRM Admin Clerk and that works.
the rules are set per region + country + state. we have about 15 rules.
so if an admin or intern creates an account, the account assignment works fine.
but if a user with account manager role(we have 10 of them), creates an account, we dont want the owner to be replaced.
eg.
Rule UK => if Country is UK, assign to ROB.
Rule US => if Country is US, assign to JOE.
Jasmine(INTERN role) creates an Account with Country US. Account assignment runs and it properly goes to JOE.
JOE(Account Manager role) creates an Account with Country UK. Account assignment runs and it gets assigned to ROB. => This is the one we want to fix. Since JOE is an account manager, it is assumed he created the account because he should be the owner and therefore should not go to ROB.
Somehow, there is no way to filter based on who created the account.

IIS - assigning a userid to a role

Similar Messages

Maybe you are looking for