Is there a best practice way of segregating biztalk permissions across the SDLC?

I'm working on the SQL Server side of things, helping some people set up a biztalk project. There are some issues with figuring out the SQL permissions required by biztalk and how to set them up.
I have read the guide
here which indicates which SQL permissions to assign to which AD groups. I assume these groups are created by the biztalk install process (if that's not true then please let me know).
I generally try to grant SQL permissions to AD groups rather than individual users, but it seems like all of the biztalk services (dev, uat and production) would be using the same AD groups (eg, "SSO Administrators"). So if I grant permission to the
groups, then all biztalk services would be able to access all SQL Servers. For example, someone could point the development biztalk services at the production biztalk SQL server, and it would work because on both SQL Servers the permission would be assigned
to the same AD group.
Is there any way to have biztalk create, for example, the AD group "SSO Administrators - DEV" and "SSO Administrators - UAT" so that I can prevent biztalk from violating SDLC boundaries, or do I just have to accept this in biztalk-land?

Yes, our SQL services and biztalk serviecs are hosted on different machines, but that's not really relevant to this particular topic.
Yep, the goal here is to assign the appropriate rights to the appropriate groups.
You said "Separate AD windows group for Production and Test Environment is preferred"
- I definitely agree. But this is the reason for the question. If the biztalk install creates the AD groups (SSO Administrators, SSO Affiliate adminstrators, Biztalk Administrators, Biztalk Host users, etc) then every biztalk install (dev, UAT and prod) will
all use the same AD groups. If permissions in SQL are assigned to these groups, then it doesn't seem possible for different phases of the SLDC to be accessible only to specific biztalk services. In other words, it doesn't seem like I can enforce the idea that
the biztalk dev services should only be able to access the biztalk dev databases.

Similar Messages

  • Is there a best practice for deleting a published report?

    Post Author: matthewh
    CA Forum: General
    Is there a best practice for deleting a published report from C:\Program Files\Business Objects\BusinessObjects Enterprise 11.5\FileStore on Crystal Reports Server or can I just delete the subfolders?  Does it reference them elsewhere?  I have a load of old reports I need to shed, but can't see how to do it.

    Hi,
    You can refer the SRND guide. As per document (page -292)
    you can configured -You can add a maximum of 50 agents per team.
    http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/ipcc_enterprise/ippcenterprise9_0_1/design/guide/UCCE_BK_S06086EC_00_srnd-9-0-1.pdf
    Also you can check the Bill of Material document of UCCE , under the section "Operating Conditions, Unified ICM, Unified CC" What are the number should configure in UCCE.

  • Is there any best practice about by-products

    Dear all,
    Is there any best practice about handleing by-products in production order?
    Thanks!

    Hi,
    Have you searched the SCN forum, blog and wiki?
    You may check this: http://wiki.sdn.sap.com/wiki/pages/viewpage.action?pageId=23593837
    Thanks,
    Gordon

  • Is there any Best Practice Document for OEDQ development?Please share.

    Is there any Best Practice Document for OEDQ development?Please share.

    Hello, Please check the below projects, you would get better idea on the best practices like Naming Standards, which processors to use, how to bundle the jobs, external tasks etc.,
    edq-cds-data-quality-health-check-9.0.4.(645).dxi
    edq-cds-initialize-reference-data-9.0.4.(645).dxi
    Regards,
    Bala Govi

  • Are there any  best practice templates available to load Customer Master data into ECC using data services?

    Hi,
    As far as I remember there are best practices templates (AIO). I am not able to find the location to download these atl files though.
    Thanks,
    Pramod

    Hi pramod did you reffered this document:
    http://help.sap.com/businessobject/product_guides/sboDS41/en/sbo41_ds_sap_en.pdf
    http://events.asug.com/2011AC/4103_Legacy_Data_Migration_to_SAP_ECC.pdf

  • Is Adobe Connect part of Adobe Creative Cloud? Are there any best practices ideas from people who use Connect and Creative Cloud?

    Is Adobe Connect part of Adobe Creative Cloud? Are there any best practices ideas from people who use Connect and Creative Cloud?
    I have an Adobe Connect account and I'm are also in the early stages of developing a webinar. I am looking for any tips and advice from anyone who uses both of these services.

    As the £27, was an introductory offer. Upon the completion of one year, the price will change to the normal creative cloud cost which is at £46.88. However if you have the previous versions of the creative suites like CS 3, 4, 5, 5.5 or the CS 6. You can avail the offer at £27.34 per month incl. VAT. However this Requires annual commitment; billed monthly.

  • Best Practice: Dynamically changing Item-Level permissions?

    Hi all,
    Can you share your opinion on the best practice for Dynamically changing item permissions?
    For example, given this scenario:
    Item Creator can create an initial item.
    After item creator creates, the item becomes read-only for him. Other users can create, but they can only see their own entries (Created by).
    At any point in time, other users can be given Read access (or any other access) by an Administrator to a specific item.
    The item is then given edit permission to a Reviewer and Approver. Reviewers can only edit, and Approvers can only approve.
    After the item has been reviewed, the item becomes read-only to everyone.
    I read that there is only a specific number of unique permissions for a List / Library before performance issues start to set in. Given the requirements above, it looks like item-level permission is unavoidable.
    Do you have certain ideas how best to go with this?
    Thank you!

    Hi,
    According to your post, my understanding is that you wanted to change item level permission.
    There is no out of the box way to accomplish this with SharePoint.               
    You can create a custom permission level using Visual Studio to allow users to add & view items, but not edit permission.   
    Then create a group with the custom permission level. The users in this group would have the permission of create & add permission, but they could no edit the item.
    In the CodePlex, there is a custom workflow activities, but by default it only have four permission level:
    Full Control , Design ,Contribute and Read.
    You should also customize some permission levels for your scenario. 
    What’s more, when use the SharePoint 2013 designer, you should only use the 2010 platform to create the workflow using this activities,
    https://spdactivities.codeplex.com/wikipage?title=Grant%20Permission%20on%20Item
    Thanks & Regards,
    Jason
    Jason Guo
    TechNet Community Support

  • Best Practice? - Implementing different sap portals on the same hardware

    We have a very large intranet portal implementation today spanning multiple boxes with 30k+ users on it.
    A different business group is asking us to build a sap vendor portal system, but would like to know if we can run it on the same equipment.
    The intranet uses ldap where the vendor will authenticate/authorize against the database. Aside from this, other configurations will be different. My gut feel is that this is something we should not do (mixing both intranet and vendor systems on the same hardware with different config's).
    Is there a best practice document that outlines if this is something that should be done or avoided. Also, if you have run into this and have an answer, would appreciate the feedback.
    Thanks in advance for the assistance,
    Todd

    Hi Todd,
       Technically there isn't a reason you couldn't run both portals on the same hardware assuming it is sized properly. You could even use the same portal if you wanted to.
    The thing I would be concerned with is security.  I assume you have more stringent security requirements for external facing applications than internal applications like the need for additional firewalls and reverse proxies.  Usually if you pursue the security requirements you will find the need for separate portal hardware. 
    Hope this helps
    John

  • What is the best practice way of stopping a sub-domain from being indexed?

    Hi there
    I notice that a client site is being indexed as both xxx.com.au [their primary domain] as well as xxx.PARTNERDOMAIN.com.au.
    I have Googled quite a bit on the subject and have browsed the forums, but can't seem to find any specific best practice approach to only having the primary domain indexed.
    One method that seems to be the most recommended is having a second robots.txt site for the sub-domain xxx.PARTNERDOMAIN.com.au with Disallow: /
    Does anyone have a definitive recommendation?
    Many thanks
    Gavin

    Sorry I assumed they were two different sites, they are the same "content" just two different URLs?
    Canonical links will help but it wont stop or remove you being indexed it only adds higher index weight to the Canonical linked URL. Plus only search engines that support that meta tag will work.
    You essentially need two robots.txt to do this effectively or add the META TAG if you can split the sites somehow.
    There is a more complex way, you could host the second domain somewhere else, use htaccess or similar to do a reverse proxy to the main site to pull the contents in realtime, all except the robots.txt file. This way you could have two sites with only 1 to update but still have two robots.txt's
    http://en.wikipedia.org/wiki/Reverse_proxy
    I've done this for a few sites, you are essentially adding a middle man, it will be a tad slower depending on how far the two servers are apart, but it is like having a cname domain but with total control.

  • Is there any best Practice to create Local KF than CKF

    Hi All
    Just answer can do or cannot? What are the inconveniences we would face?
    I have requirement to apply some selections and formulas and then create query for every month from JAN-DEC>
    if I do Locally,
    I need to create every Selections and Formulas for every month, right?
    If do as CKF, I just create commonly the CKF and RKF,
    and create every month in the structure.
    is there any  wrong if we create as CKF and RKF??
    But my user say this is not the best practice since we use it only for this query...we dont use for other query..
    so try to do locally..just got ....
    Pls tell which is better way?

    Hi Srikanth,
    Thanks for your response,
    Nope see my requirement doesn't seems like it will not fit to LOCAL FORMULA OR STRUCTURES than using GLOBALLY which you have to create all FORMULAS and  SELECTIONS for every month..
    I create structure, in it create SELECTIONS and FORMULA I create locally.
    But I want to create for all months i.e JAN - DEC and for any year based on USER input..
    But I want to create locally for all SELECTIONS and FORMULAS for all months.
    which is long process.. Also I need to get the data for any year for all months based on user input CALYEAR/MONTH..
    1.CAN YOU provide solutions??
    2. Actually he is another IT consultant *** experience in respective organisation, so when I say why not we create this way which is easier and feasible to use and will you have any issues in reporting performance or any other, if we create CKF than creating locally?

  • Trouble with organizing VIs to be used in multiple applicatio​ns? Is there a best practice?

    Question...basically, about best practice.     I have made a VI that I use very often in
    many different applications.  (a special
    path stripping thing for help with executable stuff)    Right now, I have used it in so many
    places always making a copy of it if I use it somewhere else because when I
    deploy my code on a CD, I can't always be looking all around for all the VIs and where they are
    stored, but the other hand is that I have so many copies of it, and if I make a
    change, I have to replace them all, and when they are in different
    versions...its' really tough...is there a better way than this?
    In summary, say I kept one copy of each VI that I made as the master copy used in various places, when I go to deploy the VIs, is there a way that I can 'gather' all the appropriate VIs so that there are none missing when I deploy the code?  Help would be appriciated...
    James

    I have a "Utility" folder where I keep all my often-used in different applications vi's.  I always add these vi's directly to the block diagram directly (using the "Select a vi" button on the block diagram funtions palette.  That way, those utility vi's are automatically included in the build.  Of course, if such a vi is changed, that change will be included in any application that is subsequently "rebuilt".  That's very good.  Means your updates are automatic.

  • Is there any best practice or standard for database object naming ?

    Hi
    Thank you for reading my post
    is there any standard or best practice for databse objects naming ?
    for example how should we name columns of a table ? should it be like TOTAL_VOTE or TOTALVOTE and many other items.
    Thanks

    what does oracle suggest as a naming schema for tables , fields , views. indexes , tablespaces , ... If you look at the data dictionary you will see that not even Oracle keeps rigidly to any specific standard, although there are tendencies :)
    "The nice thing about standards is that there are so many of them to choose from."      
    -- Andrew Tannenbaum
    Cheers, APC

  • Is there any best practice document by SAP on MRP

    Hi experts ,
    i am working on consumption based planning for client , there i required to refer Best practice document by SAP for MRP.
    I was searched the same in building block library and help document is not there.
    please let me know if any doc is there
    Kaustubh

    hi ,
    check this link
    http://help.sap.com/printdocu/core/print46c/en/data/pdf/MMCBPCBP/MMCBPCBP.pdf
    Regards
    G.Ganesh Kumar

  • What's the 'best practice' way to get email and fax number from vendor?

    Hello *,
    could anybody let me know what the 'best-practice' is to get the fax number and smtp address from the vendor master? Is there a preferred function module I should use?
    Thanks a lot,
    Torsten

    Hi ,
    try that:
    TYPE-POOLS: szadr.
    DATA adr_kompl TYPE szadr_addr1_complete.
    DATA adr1 TYPE szadr_addr1_line.
    DATA adtel TYPE szadr_adtel_line.
    DATA admail TYPE szadr_adsmtp_line.
    DATA adfax TYPE szadr_adfax_line.
    CALL FUNCTION 'ADDR_GET_COMPLETE'
           EXPORTING
                addrnumber              = lfa1-adrnr
           IMPORTING
                addr1_complete          = adr_kompl
           EXCEPTIONS
                parameter_error         = 1
                address_not_exist       = 2
                internal_error          = 3
                wrong_access_to_archive = 4
                OTHERS                  = 5.
    * Mail
      LOOP AT adr_kompl-adsmtp_tab INTO admail.
        MOVE admail-adsmtp-smtp_addr TO atab-mail.
      ENDLOOP.
    * fax
      LOOP AT adr_kompl-adfax_tab INTO adfax.
        MOVE adfax-adfax-fax_number TO atab-fax_number.
      ENDLOOP.
    regards Andreas

  • Is there a best practice for multi location server setups including mac mail server?

    Afternoon all,
    Last year I setup a client with Snow Leopard Server including hosting his mail on the server with Mac Mail Server and calendaring.  He now has plans to open other sites with the same setup, how can this be done using Mac Server?  The implementation of a new server on the new site would be straight forward my concerns / question are:
    1. How would the two servers communicate?
        a.)Do they need to communicate?
    3. How will mail across the two sites work?
        a.) How will DNS work for email internally?
        b.) How will DNS work for emai externally?
    4.  How will calendaring work across the two sites?
    Is Mac Server the best platform for moving ahead with this type of business need?
    Any help or direction would be greatly appreciated.
    Anthony

    Camelot,
    many thanks for the speedy reply.  Your comments are very helpful thank you, if I may I will give you some for information and some other questions.
    The offices will be from 5 miles to 25 miles apart, the new office and ones that follow will be considered as branches of the main office for example the company name is Sunflower and it serves area 1, then new will office will serve area 2 and so on.  So in theory I could leave the main server domain and mail mx record as sunflower and then add further servers as 2.sunflower.com, 3.sunflower.com as domains and mx records? This would then provide unique mail records and users within the organisation such as [email protected] and [email protected], which doesnt look to good I would prefer all users to be name@sunflower how can this be acheived?
    With regard to user activity in the whole users will be fixed but their will be floaters such as managers and the owners that may at times float from one office to the other and would beneift from logging into any machine and getting their profile.
    I have thought about VPN's as I have acheieved this type of setup with Microsoft server products, I have found speed issues in some cases, how can this be acheived using OS X, are there any how to docs around?  In the Microsoft setup I acheived this using netgear VPN Firewalls which ofcourse adds an overhead, can this be acheived using OS X propietary VPN software?
    So ultimatley I would prefer to have the one domain without subs "sunflower.com" and users to be able to login to their profiles from either location. The main location now will remain as headoffice and the primary location and the new will be satelites.
    I hope that covers all of your other question, again many thanks for your comments and time.
    Kind Regards
    Anthony

Maybe you are looking for