Minimum group membership for imp/exp for ora 8i(client)  windows xp users

Hi to all,
For oracle 8i clients, windows xp users, what is the minimum group membership required that can be used so that the users can import or export dmps. Using Administrators imp/exp works ok... Any alternative?
Thanks

Hi Thierry,
Please do not confuse the issue. Here we have the windows Operating System - privilege and then the Oracle database user privilege. In my case the Oracle database user privilege is DBA. If the user is given a Windows - Administrators privilege (which I do want to give) the exp/imp creates the DMP and log file. But any other standard windows privilege (with DBA privilege) the exp/imp does not create the dmp and log file. I hope I am clear and now you can suggest some alternative solution to OS - administrator.
Thanks again

Similar Messages

  • Get AD group membership doesn't work for global groups

    I want to pull the group membership for OBIEE directly from AD.
    This has been covered in many blogs and forums, no problem, I've found some user created functions - basically all of it uses
    DBMS_LDAP package methods
    with one exception that additionally to it also uses
    DBMS_LDAP_UTL.get_group_membership
    ALL THOSE functions work BUT I've verified it with the actual group membership from AD or adfind tool (http://www.joeware.net/freetools/tools/adfind/index.htm)
    The list returned by Oracle packages doesn't match, or to be exact only partially matches the factual AD list.
    I've done some research and found there are three types used for defining group's scope by AD:
    Domain Local, Global, or Universal
    (http://technet.microsoft.com/en-us/library/cc755692(WS.10).aspx)
    leaving the first one out of the scope as we don't use it
    - I've verified and found ALL missing ONES are defined as GLOBAL
    All the Oracle funcitons I've found correctly pulls only UNIVERSAL group memberships and none of GLOBAL
    Microsoft documentation says that both of them (Universal and Global) have forest-wide visibility....
    and so AdFind can list both..
    so why Oracle limits the search to UNIVERSAL ones only?
    Maybe it's a matter of initialize those DBMS_LDAP packages differently or passing slightly different parameters??
    I've really tried a lot of this code in different combinations but no joy
    Has anyone got some ideas?

    ...I try to block the usage of the command prompt only on this server.
    I have the same question as jrv: Why? It doesn't increase security. The command prompt is a program, not a security boundary.
    Disabling the command prompt does NOT increase security
    -- Bill Stewart [Bill_Stewart]

  • AD Group Membership with User From Domain Outside of Forest

    Here's one to twist your brain around -
    I have kerberos authentication using Active Directory working between a client's web browser and my web-app hosted in JBoss. I also have limited authorization working by checking group memberships using LDAP. This currently only works if all users are in the same domain. The ever-helpful adler_steven has detailed in another thread (http://forum.java.sun.com/thread.jspa?threadID=603815&tstart=15) how to do a group membership check for all Users/Groups in a single forest using the Global Context.
    I need to go beyond the domain and even beyond the forest and try to authorize a user from a trusted domain by checking if the user is a member of a group in my domain. Authentication works fine using kerberos. It's the authorization by group check I am having trouble with. I believe there are two ways to approach this:
    Approach #1
    Access the MS-specific PAC in the kerberos token from the client to get the group SIDs. The structure of the PAC is nicely defined in this article: http://appliedcrypto.com/spnego/pac/ms_kerberos_pac.html. However, I have no idea how to access the decrypted token. I pass the encrypted token that I receive from the browser to myGssContext.acceptSecContext(...) to complete the authentication.
    Question: Does anyone know how to get the decrypted kerberos ticket from there, specifically the authorization-data field?
    Approach #2
    Try to walk through the Active Directory structures in both domains using LDAP. In the domain group that I am checking, I can see a member attribute that references a foreignSecurityPrincipal object. The CN of this object happens to be the objectSID of the user I am looking for in the remote domain. Unfortunately, I have to check the remote domain server directly to verify that. The foreignSecurityPrincipal object itself does not contain any hint about what user it refers to aside from the SID (no originalDomainName attribute or something similar). It is feasible that I could walk the chain of references back to the remote domain AD server. That would require that my configuration include a list of remote domain servers to check (since I could have users from multiple trusted domains) and that my JBoss server have access to those servers.
    Question: Does anyone know of some other LDAP-related way of finding information about a user from a remote, trusted domain without having to hit the server for that domain directly?
    adTHANKSvance
    Eric

    You should be able to work back from the foreignSecurityPrincipal object :-) He says with a wry smile..
    This post prompts me to think whether one day someone will draw the entity relationship diagram for AD. Oh well, I've been procrastinating for years, a few more won't hurt !
    If it was a user from within the same forest, you should just be able to perform a search against a GC using the objectSID as the search filter. I've forgotten, but I don't think they will be represented as foreign security principals.
    Have a look at the post titled JNDI, Active Directory and SID's (Security Identifiers) available at
    http://forum.java.sun.com/thread.jspa?threadID=585031&tstart=150 that describes how to search for an object based on their SID.
    Now if it is a user from another forest, with which you have a trust relationship, then we begin the navigation excercise.
    You'll need obtain the user's SID (either from the cn or from the objectSID attributes) from the foreignSecurityPrincipal object. For example CN=S-1-5-21-3771862615-1804478405-1612909269-2143,CN=ForeignSecurityPrincipals,DC=antipodes,DC=com
    objectSID=S-S-1-5-21-3771862615-1804478405-1612909269-2143Then obtain the domain RID, eg.S-1-5-21-3771862615-1804478405-1612909269Next you will have to recurse each of the crossRef objects in the Partitions container, in the configuration naming context (which you will find listed in the RootDSE). The crossref objects that represent trusted domains or forests will have values for their trustParent attributes. A sample query would be something like//specify the LDAP search filter
    String searchFilter = "(&(objectClass=crossRef)(trustParent=*))";
    //Specify the Base for the search
    String searchBase = "CN=Partitions,CN=Configuration,DC=antipodes,DC=com";For each crossRef object, you can then use the dnsRoot attribute to determine the dns domain name of the forest/domain (if you want to later use dns to search for the dns name,ip address of the domain controllers in the trusted domains/forests), and then use the nCName attribute to determine the distinguished name of the trusted forest/domain.dnsRoot = contoso.com
    ncName = dc=contoso,dc=comPerform another bind to the ncName for the trusted domain/forest and retrieve the objectSID attribute, which will be the domain's RID. You may want to cache this information as a lookup table to match domain RID's with domain distingusihed names and dns names.String ldapURL = "ldap://contoso.com:389";
    Attributes attrs = ctx.getAttributes("dc=contoso,dc=com");
    System.out.println("Domain SID: " + attrs.get("objectSID").get());Once you find out which domain matches the RID for the foreignSecurityPrincipal, you can then perform a search for the "real user" .And then finally you should have the user object that represents the foreign security principal !
    Just one thing to note. Assume that CONTOSO and ANTIPODES are two separate forests. If you bind as CONTOSO\cdarwin against the CONTOSO domain, the tokenGroups attribute (which represents teh process token) will contain all of the group memberships of Charles Darwin in the CONTOSO domain/forest. It will not contain his memberships if any, of groups in the ANTIPODES forest. If Charles Darwin accesses a resource in ANTIPODES, then his process token used by the ANTIPODES resource will be updated with his group memberships of the ANTIPODES forest. Also you can have "orphaned foreignn security principal", where the original user object has been deleted !
    BTW, If I was doing this purely on Windows, IIRC, you just use one API call DsCrackNames, to get the "real user", and then the appropriate ImpersonateUser calls to update the process token etc..
    Good luck.

  • "Domain Users" group in Active Directory does not belong to any Group Membership in LC

    Active Directory user belonging to "Domain Users" group does not belong to any Group Membership in LC, why does it not belong to "Domain Users" group?
    Any way to correct this issue, without changing group membership on AD side?
    If Active Directory user is member of "Domain Admins" or "Users" then these show same group membership in LC.
    Thanks.

    If you want to use the Domain Users group for the purpose of representing all the users then you can use the "All principals in domain xxx" group which is created by UM.
    Coming back to Domain Users group. For determining group membership in AD UM uses "member" attribute of the group object. "Domain Users" group is treated differently by AD. It is the default primary group for all the users and normally members of the primary group are not specified using the member attribute.So when we sync the data from AD "Domain Users" membership does not get completed.

  • OIM 10G OID user account / group membership reconciliation

    Hello
    I have an OID environment that is used for OAM access to applications within the environment. I need to be able to reconcile users from OID into OIM along with their group membership so that roles for users are maintained and updated. I have ORM integrated within the environment so entitlements would need to flow to orm to document that users are members of a role / OIM group. Not sure if this is possible through the trusted reconciliation or if there is a user / group target reconciliation that can be used for this. Any help you can give for this would be appreciated.
    Thanks

    When i use ADCS timestamp as 0 (to capture changes from the beginning and not necessarily after the group change event occured on the AD side) and run AD user target recon this is getting updated. Is this correct and if so how can i always default ADCS timestamp as 0 in the scheduled task and are there any side effects for this sort of approach.
    Prasad.
    Edited by: Prasad on Nov 7, 2011 12:31 PM

  • Imp/exp stdout language

    Hi all,
    I am interested in changing language in exp and/or imp log files? Oracle version is 10.2.0.4.0, OS version is Win 2k3R2.
    I have Oracle DB installed on hungarian-language OS, and when issue an exp command, I get log file on hungarian language. I need stdout language for imp/exp utility to be on english. Can I do this?
    As far as I know stdout language for sqlplus query for current session can be changed with alter session set nls_language=ENGLISH.
    A little demonstration:
    current logfile:
    . . a következo tábla exportálása:                         A          3 sor exportálva
    . . a következo tábla exportálása:                         B          2 sor exportálva
    . . a következo tábla exportálása:                         C          0 sor exportálva
    desired logfile:
    . . exporting table                       A          3 rows exported
    . . exporting table                       B          2 rows exported
    . . exporting table                       C          0 rows exported
    . . . . .Tnx in advance.

    Prior to running exp or imp (and why still use exp and imp?)
    set nls_lang=<Region>_<territory>.<characterset>
    Don't know why but it seems it is 'Doc question day' again.
    Sybrand Bakker
    Senior Oracle DBA

  • Question on Group Membership issue in installation

    Hi,
    I am installing the Oracle DB and got this error in the 'Prerequisite Checks':
    'Group Membership: <GroupName>
    This is a prerequisite condition to test where user "<userID>" is a member of the group "<GroupName>"

    SD wrote:
    Hi,
    I am installing the Oracle DB and got this error in the 'Prerequisite Checks':
    'Group Membership: <GroupName>
    This is a prerequisite condition to test where user "<userID>" is a member of the group "<GroupName>"consider reading & following the Installation Guide found at http://tahiti.oracle.com

  • Imp/exp ORA-12899: value too large for column

    imp/exp ORA-12899: value too large for column
    source :
    os: linux as 4 update4
    .bash_profile NLS_LANG=AMERICAN_AMERICA.US7ASCII
    for run exp bill/admin001 file=bill0518.dmp bill rows=y
    oracle: 10.2.1
    NLS_LANGUAGE AMERICAN
    NLS_TERRITORY AMERICA
    NLS_CHARACTERSET US7ASCII
    target :
    os: linux as 4 update4
    .bash_profile NLS_LANG=AMERICAN_AMERICA.AL32UTF8
    for run
    imp bill/admin001 file=bill0518.dmp
    oracle: 10.2.1
    NLS_LANGUAGE AMERICAN
    NLS_TERRITORY AMERICA
    NLS_CHARACTERSET AL32UTF8
    imp log
    Import: Release 10.2.0.1.0 - Production on Wed May 16 14:57:59 2007
    Copyright (c) 1982, 2005, Oracle. All rights reserved.
    Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - Produc tion
    With the Partitioning, Real Application Clusters, OLAP and Data Mining options
    Export file created by EXPORT:V10.02.01 via conventional path
    import done in US7ASCII character set and AL16UTF16 NCHAR character set
    import server uses AL32UTF8 character set (possible charset conversion)
    export client uses AL32UTF8 character set (possible charset conversion)
    . importing BILL's objects into BILL
    . . importing table "MY_SESSION" 44 rows imported
    . . importing table "T1"
    IMP-00019: row rejected due to ORACLE error 12899
    IMP-00003: ORACLE error 12899 encountered
    ORA-12899: value too large for column "BILL"."T1"."NAME" (actual: 62, maximum: 5 0)
    Column 1 1
    Column 2 ÖйúÈË. 0 rows impo rted
    Import terminated successfully with warnings.

    Yes it's probably due to different char sets
    A way around it it to change the DB setup on the new database to use CHAR as default for varchar2 rows, and then use datapump to do your import/export, because datapump uses the default varchar2 type when creating tables that includes varchar2 (which is normally byte). Exp/imp uses the varchar2 type that is in the original database
    Best regards
    /Klaus

  • OIM 9.1.0.2 Group Membership Removal for Disabled Users

    Hello
    In OIM 9.1.0.2, when a user is disabled, they are removed from the groups they are a member of within 24 hours. i was wondering if this is a set time and if so, can this be extended to a specified time so membership can be left for a week before it is removed from the user. If you can let me know on this I would appreciate it.
    Thanks
    Nick

    Today, when accounts are disabled, within 24 hours all the group memberships are removed on the OIM side. I would like to change the interval for the cleanup so that when an account is disabled, all the existing group (role) memberships stay assinged to the account then after 30 days of the account being disabled, the group (role) memberships are removed. Not sure if this would be an ORM thing or OIM, but I think it would be OIM since ORM still has the role mappings for users when they are disabled.
    Thanks
    Nick

  • Exp/Imp alternatives for large amounts of data (30GB)

    Hi,
    I've come into a new role where various test database are to be 'refreshed' each night with cleansed copies of production data. They have been using the Imp/Exp utilities with 10g R2. The export process is ok, but what's killing us is the time it takes to transfer..unzip...and import 32GB .dmp files. I'm looking for suggestions on what we can do to reduce these times. Currently the import takes 4 to 5 hours.
    I haven't used datapump, but I've heard it doesn't offer much benefit when it comes to saving time over the old imp/exp utilities. Are 'Transportable Tablespaces' the next logical solution? I've been reading up on them and could start prototyping/testing the process next week. What else is in Oracle's toolbox I should be considering?
    Thanks
    brian

    Hi,
    I haven't used datapump, but I've heard it doesn't offer much benefit when it comes to saving time over the old imp/exp utilitiesDatapump will be faster for a couple of reasons. It uses direct path to unload the data. DataPump also supports parallel processes, so while one process is exporting metadata, the other processes can be exporting the data. In 11, you can also compress the dumpfiles as you are exporting. (Both data and metadata compression is available in 11, I think metadata compression is available in 10.2). This will remove your zip step.
    As far as transportable tablespace, yes, this is an option. There are some requirements, but if it works for you, all you will be exporting will be the metadata and no data. The data is copied from the source to the target by way of datafiles. One of the biggest requirements is that the tablespaces need to be read only while the export job is running. This is true for both exp/imp and expdp/impdp.

  • Report of Groups owned along with group memberships for each group, all in a single .csv file

    Hello all,
    What I'm trying to do is generate a report of all groups owned by a specific user, along with the group memberships, and output it all to a single .csv file. In the .csv file, I would like to have the group names as the column headers, and underneath
    the group name, list all the members of the group down through the column. So for example, if User1 owns 3 groups, the output would look like:
    What I'm having trouble with is outputting the objects to the .csv using New-Object psobject, and I'm starting to wonder if there is an easier way to do this and my brain is just fried.
    Any ideas?

    OK so I can try and give some code here, but I'm asking more of a concept question about how PowerShell builds objects so I'm not sure it will help....
    $User = "User1"
    get-adgroup -filter {managedby -eq $user} -pr member | %{
    $_.name
    $_.member
    OK so this is a simple script that outputs a group name followed by the membership, all in a single column. What I would like is for the group names to each be the header of a column, and have the membership listed underneath. For example:
    Is this possible in PowerShell?

  • Read group membership for a user object and populate every group with matching user from another domain

    I have LON\JSmith in LON domain and DEL\JimSmith in DEL domain
    I would like to extract group memberships of LON\JSmith in LON domain and append matching by email (i.e. DEL\JimSmith) user object in every group in LON domain.
    for instance
    LON\JSmith and DEL\JimSmith is the same person and has same email address [email protected]
    LON\JSmith belongs to 3 groups - LON\localadmingroup;LON\univdesktop;LON\globalsurvey
    The outcome of the script should be
    LON\JSmith; DEL\JimSmith    should be in 3 groups - LON\localadmingroup;LON\univdesktop;LON\globalsurvey.
    How can i do it?
    Navgup

    Hi Navgup,
    Please refer to the script below, to query users in other domain by specifying the parameter "-Server" in the cmdlet "get-aduser", and also note I haven't tested the script below:
    import-module activedirectory
    get-adgroupmember "group"|foreach{
    $email=(get-aduser $_.samaccountname -properties *).EmailAddress#get the user email
    Get-ADUser -filter {EmailAddress -eq $email} -properties * -server DomainB.company.com|select samaccountname, memberof}#filter user name and group with the email in other domain
    To get users across domain, please also refer this blog:
    Adding/removing members from another forest or domain to groups in Active Directory:
    http://blogs.msdn.com/b/adpowershell/archive/2010/01/20/adding-removing-members-from-another-forest-or-domain-to-groups-in-active-directory.aspx?Redirected=true
    I hope this helps.

  • How to see the group membership for a user in oidadmin

    how to see the group membership for a user in oidadmin?
    I see the memberships in oiddas, but I would like to know if its possible to see them in oidadmin? Thanks.

    Hi,
    For what I understand, you know the user and want to know the groups that the user is member of (am i wrong?)...
    With this query you pass the user's DN to the ldapsearch and the search gives you back the list of groups the member is a member of, all you need to do is change the value "uniquemember=cn=orcladmin" in the query for your own user.
    For example:
    $ORACLE_HOME/bin/ldapsearch -h localhost -p 389 -D "cn=orcladmin" -w oracle10g -b "dc=acme,dc=com,dc=au" -s sub "uniquemember=cn=orcladmin" dn
    will give you the list of groups that the user "cn=orcladmin" is a member of.
    $ORACLE_HOME/bin/ldapsearch -h localhost -p 389 -D "cn=orcladmin" -w oracle10g -b "dc=acme,dc=com,dc=au" -s sub "uniquemember=cn=smithj,cn=Users,dc=acme,dc=com,dc=au" dn
    will grive you all the groups that the user smithj is a member of.
    if you don't want to get the DN of the group you can change the last parameter of the query like this
    $ORACLE_HOME/bin/ldapsearch -h localhost -p 389 -D "cn=orcladmin" -w oracle10g -b "dc=acme,dc=com,dc=au" -s sub "uniquemember=cn=smithj,cn=Users,dc=acme,dc=com,dc=au" cn
    will give you the CN of the groups the user is member of.
    let me know if this is what you need.
    Regards,
    Juan

  • AD account used for running SIA locked during group membership querying

    Hello,
    I have code that is querying user / group membership from the BOE repository using the Java Enterprise SDK.  When running against an environment using an AD service account to run the SIA, an error is thrown and the AD account is subsequently locked when I execute my code.  The error is as follows:
    com.crystaldecisions.sdk.exception.SDKServerException: The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator. 
    cause:com.crystaldecisions.enterprise.ocaframework.idl.OCA.oca_abuse: IDL:img.seagatesoftware.com/OCA/oca_abuse:3.2
    detail:The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator. 
    The server supplied the following details: OCA_Abuse exception 10505 at [.\exceptionmapper.cpp : 79]  50068 { ,  , secWinAD}
         ...The Active Directory Authentication plugin failed to verify the currently specified administration credentials required to connect to Active Directory. Please contact your system administrator.   Plugin error: SecWinAD Error: an error occurred in CADCredentialManager::SwitchSecurityContexts().
    If the account is successfully running the SIA, I'm not understanding why this message is being thrown.  Also - I'm assuming some internal login is happening with this AD account when I query for group membership (?), as I am able to query for other types of metadata without error / locking the account.  Based on the error thrown, the authentication with this ID is failing, and is probably being attempted multiple times, resulting in the account being locked?  Can anyone provide insight here?
    Thanks...

    Ted is right on the mark with this one.
    The cause is outlined in the exception indicating a problem with the SwitchSecurityContexts() function.  The Active Directory plugin requires a set of credentials with which to connect to Active Directory and perform any necessary lookups.  Therefore, the issue is not with the account running your SIA (and by extension your CMS), but the Active Directory administration credentials you've set on the plugin (either via the CMC or through code).  When the CMS tries to impersonate, or switch security context to the other account, it fails to authenticate against Active Directory.
    Check to make sure this property is set identically to the account running the SIA, and like Ted said, that you can successfully update the plugin via the CMC.
    Thanks,
    Jim

  • Design question: Change Group membership for a AD resource via SelfService

    Hi all,
    based on the OIM tutorials, I designed OIM that way that an end user can successfully request a resource. Is there a way to allow end users to modify their resource "subscriptions"? For example, I would like to allow end users to change their AD group memberships after the initial provision to the resource.
    From what I have learned from the tutorials, I would assume to create an AD group membership attribute in the user account profile form and propagate changes to that attribute back to AD.
    Or is there a way to allow end users to change their resource data directly under "My Resources" ?

    there is no concept of requesting a modification of an already provisoned account. Like you said this can be achieved thru an attribute on the user's profile and on changing that attribute, downstream applications can be propagated the new value.
    Typically if changes to an already proviisoned account needs to be done in oim and through oim, an oim admin goes to the user's resource profile and clicks on edit on the process form and can edit any data there. in case of ad groups, there will be a child process form that shows the groups that the user is a member of, you can insert(add) new groups or delete existing groups from there and save the form. In the proviisoning porcess of AD you will need to write a porcess task, which should add/remove the user from the specified group in AD on the trigger when a new group is added or an existing group is removed wehn the admin is modifying the user's AD process form/process child forms in oim.

Maybe you are looking for