ISG service authorization question

Hi everybody! Need you help!
I can't figure out how to authorize services for different PPPoE users (binded to diferent Virtual Template/bba-groups) on different RADIUS-servers..
I'v got the following config (some lines are removed):
#2 radius-groups
aaa group server radius PPPOE
server name PPPOE
aaa group server radius test_PPPOE
server name test_PPPOE
# AAA
aaa authentication login default local
aaa authentication ppp PPPOE group PPPOE
aaa authentication ppp test_PPPOE group test_PPPOE
aaa authorization network PPPOE group PPPOE
aaa authorization network test_PPPOE group test_PPPOE
aaa authorization subscriber-service default group PPPOE
aaa authorization subscriber-service test_PPPOE group test_PPPOE
aaa accounting network PPPOE start-stop group PPPOE
aaa accounting network test_PPPOE start-stop group test_PPPOE
# 2 bba-groups
bba-group pppoe PPPOE
virtual-template 1
bba-group pppoe test_PPPOE
virtual-template 2
# 2 virtual templates
interface Virtual-Template1
ip unnumbered Loopback10
peer default ip address pool PPPOE_POOL
ppp authentication chap pap PPPOE
ppp authorization PPPOE
ppp accounting PPPOE
interface Virtual-Template2
ip unnumbered Loopback11
peer default ip address pool PPPOE_POOL
ppp authentication chap pap test_PPPOE
ppp authorization test_PPPOE
ppp accounting test_PPPOE
Services are defined on 2 external RADIUS-servers.
Users binded with virtual-template1 (bba-group PPPOE) are authenticated and authorized by AAA method lists "PPPOE". Their services, recieved from external RADIUS server (aaa group server radius PPPOE) are authorized with defaul method list "aaa authorization subscriber-service default group PPPOE".
Users binded with virtual-template2 (bba-group test_PPPOE) are authenticated and authorized by AAA method lists "test_PPPOE". But i can't figure out how to authorize their services recieved from external RADIUS server (aaa group server radius test_PPPOE) with method list "aaa authorization subscriber-service test_PPPOE group test_PPPOE". What do i need to bind with it?
Will appreciate any help!
Thank you!

Hello Raja Subramanian,
If you mark 0plant as authorizationRelevant all InfoCubes that have 0plant will also being checked for that authorization.
If you want to only restrict one InfoCube you have to do it separatly.
Let me give you a example:
You have InfoCubes:
A
B
C
D
All these four InfoCubes have 0plant inside. You mark 0plant as AuthorizationRelevant but you want to restrict only InfoCube B with values from 0plant, let's say 0plant value '110'. For the other Infocubes you don't want to restrict 0plant.
In that case you would create an authorization in RSECADMIN that will have 0TCAIPROV = 'B' and 0plant = '110'.
You would also create authorization for RSECADMIN for the others InfoProviders (it could be the same authorization for all the others or separate authorizations) with:
0TCAIPROV = 'A'
0TCAIPROV = 'C'
0TCAIPROV = 'D'
0plant = *
In this case everytime a user executes a query over B he would have to insert '110' as value for 0plant otherwise he would receive a lack of authorization. Everytime a user executes a query over A, C or D, he doesn't have to insert nothing in 0plant because he is allowed to see all the values for 0plant.
Please assign points,
Diogo.

Similar Messages

Adobe Interactive Form / Web Service - Connection question

Hi
We have CRM 2007 and want to use Adobe Interactive forms for our sales managers to upload customer information when they're out in the field. Before they leave all information about the customer will be downloaded to an Adobe Interactive Form. The client sees the customer and then enters the information required to e.g. create a sales order. He has an Internet connection but is not neccessarily logged into CRM 2007. He is a registered user in CRM 2007.
My question is: if we create the web services to send and receive data to the CRM 2007 system, does the sales manager have to be online and signed into the CRM system to upload the Adobe Interactive Forms back to the server, or does the web service handle this?
Kind regards
Declan

Hello Declan,
You can send the information captured in an SAP Interactive Form by Adobe to your CRM system in two ways based on the way in which your form is designed -
1] By making a direct web service call : A typical use case is that the user fills out all the necessary fields in the form and simply clicks a submit button; on clicking, the particular web service is called and the input data is transferred to SAP CRM. It should be noted that the web service authorizations should be in place to enable this kind of usage.
2] By utilizing SAP CRM via Email scenario : A typical use case here would be that the user fills out all the necessary fields in the form and simply clicks a submit via email button; on clicking, an email is composed with all the form input infomration added as an attachment. The user can then send this email to the SAP CRM system. It should be noted that SAP CRM via Email application should be setup on the SAP CRM system and the particular SAP CRM via Email service & web service should have proper authorizations.
An interesting point to note here is that while scenario 1] would require the user to have just internet access for this to work, scenario 2] could work in a fashion such that if the user isn't having internet access, he/she could still fill out the forms thereby creating emails which would then reside in the outbox of the user's email client. Once the user is having internet acces, the email client would send these emails automatically, thereby achieving a different flavour of "offline functionality".
Hope this info helps!
Best regards,
Sandeep.

ISG: Service with traffic policing counts dropped packets.

Hello,
Our company has a router Cisco 7304 NPEG100. ("show version" in the bottom of this message). We are planing to start ISG services at this router, but there is a bug CSCei4190. When I set traffic policing in service, accounting in this service counts packets that has been dropped by traffic policing.
Here is example of my definition of service in RADIUS:
User-Name = 'Internet-Service'
Cisco-AVPair += "ip:traffic-class=in access-group 2000 priority 10"
Cisco-AVPair += "ip:traffic-class=out access-group 2001 priority 10"
Cisco-AVPair += "ip:traffic-class=in default drop"
Cisco-AVPair += "ip:traffic-class=out default drop"
Cisco-AVPair += "prepaid-config=TRAFFIC_PREPAID"
Cisco-AVPair += "accounting-list=ISG_ACCT"
Cisco-Service-Info += "QU;256000;D;512000"
Acct-Interim-Interval += '60'
When I remove Cisco-Service-Info += "QU;256000;D;512000" from service definition, all traffic are counting correctly.
I did not found in Bug Details, which version of IOS, I should use in my 7304 router where this bug is fixed.
Cisco IOS Software, 7300 Software (C7300-A3JK91S-M), Version 12.2(31)SB17, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2009 by Cisco Systems, Inc.
Compiled Fri 30-Oct-09 12:35 by vpernank
ROM: System Bootstrap, Version 12.2(22r)S, RELEASE SOFTWARE (fc1)
BOOTLDR: 7300 Software (C7300-BOOT-M), Version 12.2(20)S6, RELEASE
SOFTWARE (fc4)
7304 uptime is 17 hours, 24 minutes
Uptime for this control processor is 17 hours, 24 minutes
System returned to ROM by reload at 06:22:24 TSK Wed Feb 23 2005
System restarted at 18:46:54 TSK Mon Mar 22 2010
System image file is "disk0:c7300-a3jk91s-mz.122-31.SB17.bin"
cisco 7300 (NPEG100) processor (revision B) with 983040K/65536K bytes of memory.
SB-1 CPU at 800Mhz, Implementation 0x401, Rev 0.2, 512KB L2 Cache
4 slot midplane, Version 67.49
Last reset from software reset or reload
4 FastEthernet interfaces
3 Gigabit Ethernet interfaces
1021K bytes of non-volatile configuration memory.
62592K bytes of ATA compact flash in bootdisk (Sector size 512 bytes).
125952K bytes of ATA compact flash in disk0 (Sector size 512 bytes).
Configuration register is 0x2102

I am getting other logs sent to the syslog server, yes, just not the firewall-related "dropped packet" logs. Here's an example of one that does make it through:
5790: *Apr 30 15:05:27.039 UTC: %FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:-647534746 1500 bytes is out-of-order; expectedseq:3647406270. Reason: TCP reassembly queue overflow - session 192.168.1.179:3895 to 54.240.160.142:80 on zone-pair inside-to-Transitclass WB-Browsing
I am not allowing all the traffic across the box. The "self-to-inside" zone-pair just allows the *firewall itself* to initiate any traffic to the inside zone. That's temporary until I get all the management traffic to and from the firewall defined, then I will lock it down further.
And I added the "ip inspect log drop-pkt" and it did not appear to make any difference.
Any other suggestions?
-Mat

TS1277 i cant remember my 2 authorization questions answers and when when i click send to email it sends to an email adress thats not mine and now i cant use my $100 what should i do?

i cant remember my authorization questions answers and when i click send to email it sends to a random email thats not even created but hotmail.
what should i do???!

You need to ask Apple to reset your security questions. To do this, click here and pick a method; if that page doesn't list one for your country or you're unable to call, fill out and submit this form.
(126538)

Forgot my authorization questions how cani change them

i got a new computer and i dont remember my itunes authorization questions, how can i change them?

Click here and search the article for '2 out of 3'. Follow the instructions.
(74000)

Complicated Authorization Question

Complicated Authorization Question
I had my itunes software on my laptop with the songs on a portable hard drive. The laptop was stolen, the portable hard drive was not. I installed itunes on the new laptop and pointed to the music on the portable hard drive and it is telling me I am not authorized to play certain songs although I have authorized the computer. Also when I try to snyc my iphone it is saying it is going to erase all the songs on the iphone and replace them. I have purchased songs on the phone that are not in my itunes.
How do I resolve this?

Have you tried to play one of the songs in iTunes? It should then ask you to authorize them.

Authorization questions PFCG...

Hi Guys
A Couple of questions...
We are upgrading from an older version of CRM without WEB UI to 7.0, we have composite roles on all our user, i.e. more than 1 role per user. As I have understood it you only have the possibility to assign on PFCG ROLE ID to a specific Business Role in the WEBGUI.
I know how to set up the business roles etc, these questions are more "how did they intend it to work"...
1. Overall Question, How should we use this PFCG role?
2. I have heard that you can leave it blank, what does this mean, that it the users authorization is as before i.e. as defined with the multiple composite roles stored directly on the user?
3. How does this PFCG Role on the Business Role work together with the PFCG Roles you have on the users directly? What is the meaning of the PFCG ROLE on the business role in relation to the ones on the user?
4. Should we delete the roles on the users and add them directly on the business role, we might have a problem there as many users work as "SALESPRO" but they have different authorizations, some are more senior than others. Would we then have to have several busines roles (SALESPROJR,SALESPROSR etc) as we can only have 1:1 between business role and pfcg role id.
5. What we would like to have basically is 2 or 3 Business roles that sets the layout and basic worksets, the authorization should behave as before per user not per business role.
Any relevant input on these questions will be greatly rewarded.
/Jabba

UGLY for some reason there are no line breaks... I will try to fix it so it is readable after lunch....
Thanks, Very Grateful for your comments but I think we have to be abit more specific. I will try to clarify
I understand how the standard roles work together with the standard PFCG ROLE IDs assigned to them. However we already have a structure for our authorization roles that is on user level via su01 and each user has several composite roles. To merge these roles into one PFCG role and assign it to a business role is unrealistic, this will create too many business roles for the user as there can be only a 1:1 relation between a Business role and PFCG ROLE assigned to the business role.
With that said I have been recommended to leave the PFCG ROLE id on the business role blank, this will lead to that the authorization on the user level kicks in.
However this raises some additional questions...
1 The authorizations in our old CRM system could not possibly cover the authorizations in the WEB GUI as we don't have a   WEBGUI today so are there any special authorizations we need to setup for the WEBGUI itself. Example: Lets say that in the old CRM system the user had authorization to create a service order. If the user keeps this authorization on su01 do we need to add any additional authorizations on the user or to the business role so he can access the workset and trigger create service order from the WEBGUI?
2 IF we had both a PFCG ROLE ID assigned to the Business Role and Composite roles directly on the user which one will actually be used? Will they both be used? What happens if the authorization on the Business role says "NO" and the authorization on su01 says "YES" Or is it really as it is stated above answer that if we specify a PFCG ROLE ID on the business role this will be used and nothing else?
3 What about our own authorization objects, is there a way to scan these and see if they are valid for CRM 7.0? How should we go about verifying our old authorizations in the new 7.0 system? Is there a report you can run? I guess also that some authorizations are not valid anymore, or how does the authorizations per transaction work. I mean we have in our roles added certain transactions, people will no longer use CRMD_ORDER how does this translate to the webgui?
4 We are using the salesorg structure today and the plan is based on what we know so far to assign business roles to the positions and not to assign a PFCG ROLE id at all to business role. Can anyone see any problems with this?
5 What is UIU_COMP is that a new auth object? What new auth objects are delivered in webgui?
Again thanks for any input on the above. Perhaps more people will be interested if we make this investigation thorough.
BTW I found this post Re: Reg: Business Role but it still leaves some questions unanswered.
Edited by: jabba hut on Nov 10, 2009 1:52 PM

Web Service Security Question

I have created a web service in the NetWeaver portal using a Portal Service. I have marked the service as requiring basic http authentication. However, when I call the web service from the Enterprise Portal Web Services Checker in NWDS it just let's me supply the params of the web service and no authentication. Any ideas?
I also noticed that my web service does not appear under the Web Services Container or Web Services Security section in Visual Administrator. Anybody have any idea why this is?
Thanks in advance.
Curtis

Hi Curtis,
My guess is that since you are logged into the Portal while calling this web service, it will use the current session cookie to authenticate automatically. I'm not sure on the second question, tried a restart?
Regards,
Raj

Authorization question-Two users on one computer

My wife and I are going to share a MacBook and all our iTunes purchases are shared under one iTunes account.
My questions are...Will iTunes need to be authorized twice? And do both user logins count towards the 5 authorizations?
Thanks for any help.

iTunes Store: About authorization and deauthorization - http://support.apple.com/kb/HT1420
I'm not 100% positive about this but I believe authorization is for a whole machine.

Multiple Libraries - Authorization Question - For NON-iTune purchased music

Please help! The questions come at the end.
I have an extensive classical music iTunes library in AAC format that I ripped from CDs I've purchased over the past 20 years. NON of these were purchased from iTunes. (I have another library on my PC with other music, and I have purchased some iTunes songs for that library). I access one or the other by pressing Shift, etc. No problem.
Both my son and I listen to classical music, and I wanted to share this library with him by moving my classical iTunes Library to his computer. (I copied the entire folder structure from my PC to his, nearly 50 GB worth). So he now has 2 libraries on his computer. One (the classical library) and his own iTunes library.
He can access the classical library (hold down shift key, etc.), but gets a message to "AUTHORIZE THE FILE SOURCE" before listening to the music. So my questions:
++ Why does he need to authorize music from non-iTunes source? I'm not trying to illegally give him anything from iTunes. My family owns this classical CD collection.
++ If he does need to authorize the FILE SOURCE, I suppose he would use MY iTUNES account information to do so. Is this correct? Or should he use HIS account information?
++ And if he does use my account info, _will he retain his iTunes account setting for his other iTunes Library_? I.e., He would have a classical music library that's authorized by me (I guess my second computer?), and his regular library with his account information?
This sounds more complicated than it is (maybe it IS more complicated than I think (sic).
Any help greatly appreciated.

I could be wrong, but if that's the exact message he's getting, it sounds more like a file permssions error in Windows rather than the typical iTunes authorization message which brings up an obvious request for an iTunes Store ID and password. I'd suggest he look at the Windows permissions for the folder and it's contents and see if perhaps he doesn't have the correct permissions to access that material.
Hope this helps.

Authentication and Authorization question.

Hi All,
I require your help in getting validated my understanding on Authentication and Authorization. This is wrt to WebLogic Server and WebLogic Portal.
Authentication.
1. The custom authentication provider can authenticate(user and group) against any datastore(LDAP OR DB). The LoginModule is a kind of blockbox and it can return true/false depending on authentication.
2. The end result of this process is true/false.
Authorization.
1. The custom authorization providers can authorize the authenticated user based on role. All these entities ie(user,group,role) can be either in LDAP OR DB.
2. The end result of this process is true/false.
Role mapping.
1. The custom role mapper can put all the roles that a user belongs and returns all Role. This can happen agaist LDAP OR DB.
2. The end result is list of roles for a user.
Security policy configuration.
Is it mandatory that a user/group/role should be existing in WebLogic Server LDAP server(OR Portal LDAP server) to create these policies and authorization rules. What i mean by is that can user,group,role can exist in application specific database and still can be used for creatiing security policies??
Thanks,
Prashanth Bhat.

The Security Providers are useful/can be used for developing a standard j2ee application , which will be deployed as standard j2ee application.
The DA means Delegated Administrator, which is way how portal components are restricted to different types of administrators.
The VE means Visitor Entitlemens, which is way how portal components are restricted to end users.
My question is whether thess(DAs and VEs) can also be put
our datastore for access rights??
Thanks,
Prashanth Bhat.

Azure Media Services Pricing Questions

I am contacting you in regards to pricing structures for Azure Media Services. I would like to clarify some details outlined on the Azure pricing page.
I work for a company that provides content security solutions, and we provide Microsoft Playready related DRM solutions to our customers.
I have a customer who has an Enterprise Agreement and is using Azure Cloud services. They are planning to utilise the Azure Media Services and I wish to help clarify some points
for them.
Can you please provide answers to these questions ?
For Content Protection (DRM) does the customer need to prepare their own Playready License servers? Or is this fully covered in the Azure Content Protection service ?
For the PAYG plan for Content Protection, there is a price of $0.21/ 100 licenses.
Can you please confirm the definition of “license” in this scenario ?
Is the license in reference to issuing one license per streaming session per unique user ?
If the user watches multiple contents/assets is a license required for each asset ? Is only one license required per piece of contents ? Or multiple licenses during viewing ?
When using key-rotation for live services, does that impact the number of licenses required ?
Are there any conditions for using Azure Encoding & Processing services in order to attain the Content Protection price? (for example certain amount of minimum usage of encoding?
Are there any conditions for using Azure Streaming services in order to attain the Content Protection price ? (for example certain amount of minimum streaming usage?)
Is the PAY pricing plan for Content Protection relevant to content encoded as HLS and encrypted with Playready ?
Is the separate Playready DRM licensing costs ($0.35/ client and $0.02/quarter per active client) still relevant for Silverlight players when using Azure Content Protection services ?
Is the separate Playready DRM licensing costs ($0.35/ client and $0.02/quarter per active client) still relevant for other players (HLS players) when using Azure Content Protection services ?
If I have other questions about Azure Media Services, can I raise them to this contact email address ?

Will,
Thanks. The first point that the license server is included in the Azure service is now clear, thank you.
For the other questions, the link you put me through to is for support options for Azure. I am being asked to clarify these questions by my customer who is considering using Azure Media Services but is not currently subscribing and I don't have an existing
support account. My customer does have an Enterprise Agreement.
If you are not able to answer the questions above, would it be possible to receive an email address for where I can direct these questions about Azure Media Services pricing structure and billing ? (this is for evaluation purposes before becoming a
subscriber/user)
Please confirm an available address for someone with the answers. I have already contacted MS online technical and billing support groups and have been asked to post here, but not been given an address I can contact with the above specific questions.
Thank you.
Regards
Lincoln

Web Services General Question

Hi All,
Does web services in Java mean to simply provide a SOAP container that wraps around an EJB (or even a web container)?
If this is true, all of the work that's been done with the development of EJBs can be preserved, and other system will make calls to the SOAP container in order to get access to the web services provided.
I'm trying to understand the big picture and slowly get into Web Services in Java.
Thanks

I don�t know if this answers your question, but I think that SOAP indeed can be used to expose existing EJB�s to non-Java-Systems.

Help! Authorization question

OK, this might be a silly question, but I thought I'd give it a shot.
I have iTunes installed on two computers. One doesn't have the internet hooked up and to listen to certain songs, it says I need to authorize them. So is there any way I can authorize these songs without being hooked up to the internet?

You don't need to be connected to the internet in order to authorize the computer ( it's not the songs you are authorizing). Just play a few seconds of one of them.
See this.
About computer authorization.

Analysis Authorization questions

How does Analysis Authorizations work in below cases
1)Infoobject "A" set as Authorization relevant (In Bex explorer tab)
2)Infoobject "B" which is ATTRIBUTE of infooobject "A" set as Authorization relevant
3)Infoobject "A" and "B" both set as Authorization relevant
How to design query in each of the cases above with or without authorization variables and what parameters to be set in the RSECADMIN for infoobject "A" and "B" in each case like ":", "*" and what would be the behaviour after setting the above behaviour .
can any one give example above with demonstration please

Hi John,
please search first the forum and read the online documentation before posting these kind of questions. You should find more than enough information via the above mentioned channels. You save time and effort of your peers.
To answer your questions briefly:
1. 0COUNTRY is in the free characteristics (not in the drilldown) without any selections
==> You need the ':' value, since whenever you ommit a characteristic you basically see want to see the summary value (you summarize / accumulate over the specific characteristics). Nevertheless, as soon as you drilldown on the characteristic you need the specfic values of the drilldown.
- or-
2. 0COUNTRY is not used in the query.
==> You need ':', too.
Cheers
SAP NetWeaver BI Organisation

ISG service authorization question

Similar Messages

Maybe you are looking for