Migrate 8.1 Global roles include Role Conditions

Hi all,
have one question. I want migrate Global Role conditions from one WebLogic 8.1 server to another. When I export DefaultRoleMapper provider, I can see in exported file list of Global Roles only. I cannot see any mapping item in this file. Please, know someone how migrate Global Roles including mapping ?
TY very much,
Lada

Hi,
I export DefaultRoleMapper through Security-Realms-myrealm-Providers-Role Mapping-DefaultRoleMapper/Migration-Export in WL console.
In exported file I can see only list of defined Global Roles, for example:
dn: cn=::AbortTaskRole,ou=ERole,ou=@realm@,dc=@domain@
objectclass: top
objectclass: ERole
cn: ::AbortTaskRole
createTimestamp: 201000261052Z
creatorsName: cn=admin
EExpr:: fALDp01DQWRtaW5Hcm91cArDp01DU3BBZG1pbkdyb3VwCg==
wlsCreatorInfo: mbean
modifyTimeStamp: 201000261147Z
modifiersName: cn=admin
dn: cn=::CancelTaskRole,ou=ERole,ou=@realm@,dc=@domain@
objectclass: top
objectclass: ERole
cn: ::CancelTaskRole
createTimestamp: 201000261053Z
creatorsName: cn=admin
EExpr:: fALDp01DQWRtaW5Hcm91cArDp01DU3BBZG1pbkdyb3VwCg==
wlsCreatorInfo: mbean
modifyTimeStamp: 201000261148Z
modifiersName: cn=admin
But in this file I dont see any conditions which are bound to these Roles (myrealm-Global Roles-<concrete role>-Conditions). I cannot find these conditions in any other files generated through export wholes security realm.
TY for your help,
Lada

Similar Messages

WLST 92 - How to Create Global Role and Role Condition?

I'm currently using WLS 9.2 and trying to use WLST to create a global role and defining a role condition. Anyone know how to do so using WLST for WLS 9.2?
Trying to:
- create Global Role, testRole
- create condition where 'username = testuser'
thanks!

Did you find out a solution for this?

Virsa Config Logic?: Include Role/Prof mitigating contls in User Analysis

Hello All,
After changing configurations option "26 Include Role/Prof mitigating contls in User analysis(YES/NO)" to YES from NO, I noticed that the mitigation seems to be overextending itself into other roles. Example:
User with RoleA, RoleB and RoleC has potential conflicts. It turns out that RoleC is not a real problem but RoleA and RoleB are. So, I mitigate one rule against RoleC.
With the configuration option 26 set to YES, I would expect that The mitigation control would apply only against RoleC and SoD issues against RoleA and RoleB should still be a problem; however, RoleA and RoleB are now also mitigated. Therefore, this means that roles which I had not intended to be mitigated are mitigated.
How should the logic within Virsa be understood?
Thanks, Dylan

Adding details to this subject, here is a test scenario for which anyone can try:
Build RoleA only with S_TABU_DIS and change/display access to P000 to PZZZ table groups.
Build RoleB with transactions PC00_M10_CDTC and PC00_M99_CURSET
Build RoleC also with transactions PC00_M10_CDTC and PC00_M99_CURSET
Create a dummy user with all three roles assigned and run the SOD report against the user and risk H00600501.
Afterward create a mitigation for that risk and RoleC combination only.
Re-run the report. If possible, please also list your Virsa version and support pack level. The customer system I'm on is 4.0 and SP 04.
Many thanks for any help in this regard. The mitigations configuration option is a really important option under the circumstances and I would like to use it but cannot at the moment considering the results.

Assigning role to role doesn't work when applying Database security model

I applied Oracle Database security model for BI Publisher.
then I create some roles and users and assigned roles to users in Oracle Database.
i also assigned appropriate folders to each role in BI Publisher.
the users with direct roles worked successfully but i got problem when i assigned roles to a super role, and assigned this role to a super user.
the super user could only access guest folder.
Please help me.
thanks.
Daniel
Edited by: user13344498 on Jul 5, 2010 11:13 PM

Add a Role to a Role:
1. From the Security Center, select Roles and Permissions; this will invoke the
Security Center page. Here you can see the list of existing roles and permissions.
2. Select the Add Roles icon for the Role.
3. Select the desired role from the Available Roles list and use the Move shuttle
button to move it to the Included Roles.
this is from "Oracle® Business Intelligence Publisher User's Guide Release 10.1.3.2 Part No. B40017-01" book, but the security model is BI Publisher Security.

Automatic Creation of Roles and Role Mappings in GRC

Hi,
we are planning to use SAP Identity Management and SAP GRC Access Management.
In SAP IDM we have defined several business roles that contain privilieges in SAP systems. When a user is requesting a role, the request will first be sent to SAP GRC for approval and risk checking.
In order to get this to work, we need to load the business roles of SAP IDM into SAP GRC and we also need to configure the role mapping between the business roles and the technical SAP privileges.
From what I understood, this could be implemented by loading the required information via Excel filles into SAP IDM.However, this is a quite cumbersome and error-rpone approach an we would like to automate this.
Is there a way to use e.g. web service calls to create/delete roles and role mappings in SAP GRC?
BTW: is a documentation of all available GRC web service calls and their parameters available?
Thanks for your help in advance!
Best regards
Tom

Hi Tom,
as stated before, the web service description is in the config guide.
Unfortunately there is no web service to create roles or even mappings in CUP - this is one of many I would also like to se created
I don't think in your context you will be able to directly send Business Roles to CUP. The role mapping only happens after you send the request, so I'm not sure if that's in time for risk analysis - you will need to try that.
Are you a customer or a consultant - anyway, feel free to contact me if you need further help integrating CUP and IdM. This is an evolving interface with many possible scenarios, so it's not easy to give you good advise without seeing the full picture.
Frank.

How to track the transport request number for the Role/Composit Role

Hi,
How to track the transport request number for the Role/Composit Role.
Thanks,
Ravi

Use transaction SE03 Transport Organizer Tools
Execute "Search for Objects in Requests/Tasks" with objects of types:
R3TR ACGR Role
R3TR ACGT Role - User assignment
Regards

GRC 10 - Business role, no role owner but associated role have owner....

Dear All,
In GRC 5.3 we perform the following mapping:
Business Role A mapped with (no owner)
- Technical Role 1 (from ECC with Owner1)
- Technical Role 2 (from CRM with Owner2)
- Technical Role 3 (from HR with Ownwer3)
IN GRC 5.3 we have a business role mapped with multiple child role(techinical role) from other system.
GRC 5.3 request is able to close and provisioned as it can see owners from child role.
Now in GRC 10, we did the same. Create a business role, then mapped the child role (technical role). Unfortunately, when manager approves the workflow reroute to "NO OWNER DETOUR PATH" because it cannot see the technical role owner.
Seems like GRC 10 is only looking at business role owner. We are unable to add Owner1, Owner2, Owner3 to the business role because when one of the owner approves, it will provision all the technical roles. We might have owners who will reject their role.
Please advice.
Jacky

Hi Mustafa,
you can use end user personalization to avoid a role owner to approve roles for himself. Define a dedicated EUP for role owner stage and restrict via "Approve/Reject Own Requests" like shown below:
Does this answer your question?
Regards,
Alessandro

Problem to migrate a non-global zone to a different machine.

Hi, recently, I had try to migrate a non-global zone to a different machine but its doesnt work.
1. First, this is the structure of my machine with my non-global zone:
host1# uname -a
SunOS testsolaris 5.11 snv_101b i86pc i386 i86pc
host1# zfs list
NAME USED AVAIL REFER MOUNTPOINT
big-zone 1.71G 1.64G 20K /big-zone
big-zone/export 1.71G 1.64G 22K /big-zone/export
big-zone/export/big-zone 1.67G 1.64G 21K /big-zone/export/big-zon e
big-zone/export/big-zone/ROOT 1.67G 1.64G 18K legacy
big-zone/export/big-zone/ROOT/zbe 1.67G 1.64G 1.66G legacy
big-zone/export/zonetest 41.8M 1.64G 21K /big-zone/export/zonetes t
big-zone/export/zonetest/ROOT 41.8M 1.64G 18K legacy
big-zone/export/zonetest/ROOT/zbe 41.8M 1.64G 1.66G /big-zone/export/zonetes t/root
rpool 8.35G 7.28G 72K /rpool
rpool/ROOT 6.86G 7.28G 18K legacy
rpool/ROOT/opensolaris 6.86G 7.28G 6.73G /
rpool/dump 575M 7.28G 575M -
rpool/export 375M 7.28G 21K /export
rpool/export/home 18K 7.28G 18K /export/home
rpool/export/small-zone 375M 7.28G 21K /export/small-zone
rpool/export/small-zone/ROOT 375M 7.28G 18K legacy
rpool/export/small-zone/ROOT/zbe 375M 7.28G 375M legacy
rpool/swap 575M 7.78G 56.8M -
2. In second, I had detach my non-global zone zonetest whit this commands :
host1# zoneadm z zonetest halt
host1# zoneadm z zonetest detach
3. In third, I had move my zonepath to my new host.
host1# cd /big-zone/export
host1# tar cf zonetest.tar zonetest
host1# sftp jay@new-host
host1# put zonetest.tar
Uploading .
host1# quit
4. Unpack my .tar file
host2# cd /big-zone/export
host2# tar xf zonetest.tar
So, after this, I think that my zonepath is transfert to my new host.
This is the structure of my new host :
jay@alien:~$ uname -a
SunOS alien 5.11 snv_101b i86pc i386 i86pc Solaris
jay@alien:~$ zfs list
NAME USED AVAIL REFER MOUNTPOINT
rpool 18.3G 73.3G 72K /rpool
rpool/ROOT 2.98G 73.3G 18K legacy
rpool/ROOT/opensolaris 2.98G 73.3G 2.85G /
rpool/dump 1023M 73.3G 1023M -
rpool/export 13.3G 73.3G 19K /export
rpool/export/home 13.3G 73.3G 19K /export/home
rpool/export/home/jay 13.3G 73.3G 13.3G /export/home/jay
rpool/swap 1023M 73.9G 321M -
zdata 10.7G 80.8G 9.65G /zdata
zdata/zones 1.08G 80.8G 18K /zdata/zones
zdata/zones/zonetest 1.08G 80.8G 1.08G /big-zone/export/
*I have a mountpoint to /big-zone/export
5. I had try to configure my zone on my new host and I receive and error message:
host2# zonecfg -z zonetest
zonetest: No such zone configured
Use 'create' to begin configuring a new zone.
zonecfg:zonetest> create -a /big-zone/export/zonetest
invalid path to detached zone
zonecfg:zonetest>

And my new big-zone (on the second host) show this in the /big-zone/export/zonetest folder :
jay@alien:/zdata/zones# zfs list
NAME USED AVAIL REFER MOUNTPOINT
rpool 23.5G 68.0G 72K /rpool
rpool/ROOT 6.31G 68.0G 18K legacy
rpool/ROOT/opensolaris 6.31G 68.0G 6.18G /
rpool/dump 1023M 68.0G 1023M -
rpool/export 15.2G 68.0G 19K /export
rpool/export/home 15.2G 68.0G 19K /export/home
rpool/export/home/jay 15.2G 68.0G 15.2G /export/home/jay
rpool/swap 1023M 68.6G 361M -
zdata 11.6G 79.9G 10.7G /zdata
zdata/zones 921M 79.9G 18K /zdata/zones
zdata/zones/web 921M 79.9G 21K /zdata/zones/web
zdata/zones/web/ROOT 921M 79.9G 18K legacy
zdata/zones/web/ROOT/zbe 921M 79.9G 921M legacy
zdata/zones/zonetest 54K 79.9G 18K /big-zone/export/zonetest
zdata/zones/zonetest/ROOT 36K 79.9G 18K legacy
zdata/zones/zonetest/ROOT/zbe 18K 79.9G 18K legacy
jay@alien:/zdata/zones/zonetest# pwd
/zdata/zones/zonetest
jay@alien:/zdata/zones/zonetest# ls -ls
total 6
3 drwxr-xr-x 2 root sys 2 Feb 8 2009 dev
3 drwxr-xr-x 16 root root 19 Feb 8 2009 root
jay@alien:/zdata/zones/zonetest# cd root
jay@alien:/zdata/zones/zonetest/root# ls -ls
total 52902
1 lrwxrwxrwx 1 root root 9 Feb 1 20:29 bin -> ./usr/bin
3 drwxr-xr-x 13 root sys 15 Feb 8 2009 dev
11 drwxr-xr-x 55 root sys 168 Feb 8 2009 etc
3 dr-xr-xr-x 2 root root 2 Jan 22 16:26 home
15 drwxr-xr-x 9 root bin 241 Feb 4 2009 lib
3 drwxr-xr-x 2 root sys 2 Jan 22 16:23 mnt
3 dr-xr-xr-x 2 root root 2 Jan 22 16:26 net
3 drwxr-xr-x 4 root sys 4 Jan 24 15:26 opt
3 dr-xr-xr-x 2 root root 2 Jan 22 16:23 proc
3 drwx------ 3 root root 7 Feb 6 2009 root
5 drwxr-xr-x 2 root sys 47 Jan 22 16:24 sbin
3 drwxr-xr-x 4 root root 4 Jan 22 16:23 system
3 drwxrwxrwt 2 root sys 2 Feb 8 2009 tmp
5 drwxr-xr-x 30 root sys 42 Feb 6 2009 usr
3 drwxr-xr-x 32 root sys 32 Feb 6 2009 var
52835 -rw-r--r-- 1 root root 42882560 Jan 22 16:35 webmin-1.441.pkg
jay@alien:/zdata/zones/zonetest/root#
I think my problem is there ...
jay@alien:/big-zone/export/zonetest# pwd
/big-zone/export/zonetest
jay@alien:/big-zone/export/zonetest# ls -ls
total 8
2 ---------- 1 root root 114 Dec 31 1969 @LongLink
3 drwxr-xr-x 2 root root 2 Feb 1 21:10 root
3 drwx------ 4 root root 4 Feb 1 21:10 zonetest
jay@alien:/big-zone/export/zonetest# cd zonetest/
jay@alien:/big-zone/export/zonetest/zonetest# ls -ls
total 6
3 drwxr-xr-x 2 root sys 2 Feb 8 2009 dev
3 drwxr-xr-x 4 root root 5 Feb 1 21:10 root
jay@alien:/big-zone/export/zonetest/zonetest# cd root
jay@alien:/big-zone/export/zonetest/zonetest/root# ls -ls
total 7
1 lrwxrwxrwx 1 root root 9 Feb 1 21:10 bin -> ./usr/bin
3 drwxr-xr-x 4 root root 4 Jan 22 16:23 system
3 drwxr-xr-x 23 root sys 28 Feb 1 21:11 usr
I think I have a problem with my zfs mountpoint but I don't how to resolve this.
Edited by: jaymachine on Feb 26, 2009 6:16 PM

Include dynamic conditions in the where clause

Hi All,
I have an requirement where i need to dynamically include the conditions in the where clause based on the bind variable.
My condition is like this.
SELECT f.scheduled_date, a.bld_id, a.room_id, a.cage_id, f.test_num
FROM feeding_test_results f,
v_onl_gf_anmls a
WHERE f.sak_feeding_test_res > 5000000
AND f.anml_id(+) = a.anml_id
AND f.bld_id = 'A5'
AND f.room_id > 0
AND f.cage_id > '0'
case when :check_value = 1 Then
AND scheduled_date <= '16-Apr-2009'
AND scheduled_date >= '06-Apr-2009'
Else
AND scheduled_date = '16-Apr-2009'
End
AND f.feeding_status <> 'X') f
Kindly anyone help me how to acheive this.
Thanks & Regards,
P. Gayathri Devi

michaels2 wrote:
and scheduled_date <= case when :check_value = 1 then date '2009-04-16' end
and scheduled_date >= case when :check_value = 1 then date '2009-04-06' end
and scheduled_date = case when not :check_value = 1 then date '2009-04-16' end
Hmmm, you may want some NVL's around those case statements such as..
       and scheduled_date <= NVL(case when :check_value = 1 then date '2009-04-16' end,scheduled_date)
       and scheduled_date >= NVL(case when :check_value = 1 then date '2009-04-06' end,scheduled_date)
       and scheduled_date = NVL(case when not :check_value = 1 then date '2009-04-16' end,,scheduled_date)or some such thing. Otherwise the comparisons with Null will just cause it all to fail.

Add Role to Role Category

Hello Experts,
my scenario:
1) AD Group Reconciliation Task
2) Auto creation Role category "AD Roles" if it doesnt exists
3) Auto creation Roles based on AD groups in "AD Roles" Role category
Ive already done auto creation role category and roles in default category, but i still cant create roles in my category.
I think it could be done like this in role creation:
mapAttrs.put(RoleManagerConstants.ROLE_CATEGORY_KEY, key)
but how can i get Role category key of my category to var "key"?
Are there more links between role and role category?
Pls help.
Thanks.

public static String getRoleCategoryKey(String categoryName)
String roleCategoryKey = null;
RoleManager rmgr2;
Set retAttrs = new HashSet();
rmgr2 = oimClient.getService(RoleManager.class);
System.out.println("Creating....");
String ctxFactory = "weblogic.jndi.WLInitialContextFactory";
String serverURL = "t3://10.111.6.101:14000";
String username = "xelsysadm";
String password = "xelsysadm";
Hashtable env = new Hashtable();
env.put(OIMClient.JAVA_NAMING_FACTORY_INITIAL,ctxFactory);
env.put(OIMClient.JAVA_NAMING_PROVIDER_URL, serverURL);
oimClient = new OIMClient(env);
System.out.println("Logging...");
try {
oimClient.login(username, password);
} catch (LoginException e) {
System.out.println("Log in");
rmgr2 = oimClient.getService(RoleManager.class);
retAttrs.add(RoleManagerConstants.ROLE_CATEGORY_KEY);
retAttrs.add(RoleManagerConstants.ROLE_CATEGORY_NAME);
SearchCriteria criteriaM = new SearchCriteria(RoleManagerConstants.ROLE_CATEGORY_NAME, categoryName, SearchCriteria.Operator.EQUAL);
try
List roleCategories = rmgr2.search(criteriaM, retAttrs, null);
System.out.println(roleCategories.size());
boolean found = false;
Iterator i$ = roleCategories.iterator();
do
if(!i$.hasNext())
break;
RoleCategory roleCat = (RoleCategory)i$.next();
roleCategoryKey = roleCat.getEntityId();
System.out.println("FOUND!!!");found = true;
} while(!found);
catch(Exception e) { }
return roleCategoryKey;
- I just find interesting code, but it doesnt work, when i use it to my map:
mapAttrs = new HashMap<String, Object>();
mapAttrs.put(RoleManagerConstants.ROLE_NAME, "testrole");
mapAttrs.put(RoleManagerConstants.ROLE_DISPLAY_NAME, "testrole");
mapAttrs.put(RoleManagerConstants.ROLE_DESCRIPTION, "desc for test");
mapAttrs.put(RoleManagerConstants.ROLE_CATEGORY_KEY, getRoleCategoryKey("testcat"));
And with .browse() I even know my category key, but when i use it:
mapAttrs = new HashMap<String, Object>();
mapAttrs.put(RoleManagerConstants.ROLE_NAME, "testrole");
mapAttrs.put(RoleManagerConstants.ROLE_DISPLAY_NAME, "testrole");
mapAttrs.put(RoleManagerConstants.ROLE_DESCRIPTION, "desc for test");
mapAttrs.put(RoleManagerConstants.ROLE_CATEGORY_KEY, "21"));
- errors.
Whats wrong?

How do I include pages conditionally

I have three incolude files in the mail JSP file. It's given one after another without any condition. How do I include them 'conditionally' -- include the one, which some validation fails. For example, if only shipping address validation fails, it should have only val_ship_addr.jsp included, not others.

i just wanna see clearly your situation.. what exactly you want to achieve? r u trying to have an error message on screen or something else? can u elaborate further ?
anyways, i have a simple example on how to include conditionally just to give u an idea..this might help you <i hope>:
so i hav a main screen named main.jsp .... on the left part of the screen list two links that corresponds to various screen . in short the right part of the screen is dynamic, depending on what the user clicks on the left part of screen.
suppose i have two menu's on the left screen named : My Profile and Change Password
/**** here is the main.jsp ********/
<html>
<head>
<script language="javascript">
function toggleScr(formobj){
document.formobj.submit();
</script>
</head>
<body>
<%@ include file="misc.html" %>
<table width="100%">
<tr>
<td width="200px">

<%@ include file="LeftPanel.jsp"%>
</td>
<td width="350px">

<%
if(request.getParameter("scr")!=null){
String screentype=request.getParameter("scr")
if(screentype.equalsIgnireCase("B")){
%>
<%@ include file="Myprofile.jsp"%>
<%
}else{
%>
<%@ include file="NewPassword.jsp"%>
<%
}else{
// show the default screen
%>
</td>
</tr>
</table>
</body>
</html>
/*** here is the LeftPanel.jsp ***/
<table>
<tr>
<td>
My Profile
</td>
</tr>
<tr>
<td>
New Password
</td>
</tr></table>
/*** here is the misc.html ****/
<FORM NAME="myfprofileform" method="post" action="main.jsp">
<INPUT TYPE="HIDDEN" NAME="scr" VALUE="A"/>
</FORM>
<FORM NAME="newpwdform" method="post" action="main.jsp">
<INPUT TYPE="HIDDEN" NAME="scr" VALUE="B"/>
</FORM>

Clustered role 'Availability Role' has exceeded its failover threshold

I am getting this alert on SQL 2012 R2 SP1. So please kindly tell me the solution of the below given alert on windows failover clustering .
Clustered role 'Availability Role' has exceeded its failover threshold. It has exhausted the configured number of failover attempts within the failover period of time allotted to it and will be left in a failed state. No additional attempts will
be made to bring the role online or fail it over to another node in the cluster.Please check the events associated with the failure. After the issues causing the failure are resolved the role can be brought online manually or the cluster may attempt to bring
it online again after the restart delay period.

Hi Syed Tauseef Ahmed,
Please offer more information such as under what circumstances this issue occurs, what event id you have got. The failover threshold is the number of times the group can fail
over within the number of hours specified by the failover period.
The related KB:
Tuning Failover Cluster Network Thresholds
http://blogs.msdn.com/b/clustering/archive/2012/11/21/10370765.aspx
You can refer the following similar thread for the first step troubleshooting:
Clustered role 'Cluster Group' has exceeded its failover threshold.
http://social.technet.microsoft.com/Forums/windowsserver/en-US/4eb44f05-eb9b-448a-821b-359879141608/clustered-role-cluster-group-has-exceeded-its-failover-threshold
I’m glad to be help to you!
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Publish reports to a role and roles to user

Hi,
What does it mean ..
Publish reports to a role and roles to user
can anybody give a detail what exactly it mean ? In implementation which stage it comes into picture ?/
Thanks,
Debasish

Hi,
This publishing option is available to you when you open the query in Query designer as 8th button in top panel. To publish in a role , you should have that role to be assigned to you.
With rgds,
Anil Kumar Sharma .P
Message was edited by:
Anil Kumar Sharma

Default role + session role

Hi,
How do I enable a session role in addition to keeping the default role enabled. Eg. If user scott has a default role of scott_dflt, I want to enable role scott_session without affecting scott_dflt. Using dbms_session.set_role to enable scott_session semms to disable scott_dflt.
Thank you.

when you call DBMS_SESSION.SET_ROLE, give a comma separated list of roles that you want to set as
parameter:
SQL> exec DBMS_SESSION.SET_ROLE('<role#1>,<role#2>,<role#3>.....') ;

Roles and Role List

Hi all,
Please explain me about the Roles and Role List used in Projects...
Thanks
Dinesh

Hi
Roles are using in Projects for two goals -
A) a basis for project-based security. You might create roles as project roles and assign people to the role in a project. For example, project manger, project admin, project billing person, etc. You then might configure the security access to forms and functions of specific roles.
B) when implementing Proejct Resource Management, the project roles may be scheduled on a project and serve as a template for resource demand. In that case you might configure the team member role on a project, such as competencies, job information, and security.
You might want to review Oracle Projects Fundamentals and Projects Implementation Guide for more details.
Dina

Migrate 8.1 Global roles include Role Conditions

Similar Messages

Maybe you are looking for