Neat OAM Trick (showing users' groups), but a problem...

Hi,
I took an OAM class this week, and the instructor showed us a way to show users' group membership in User Manager.
To do this, create a derived attribute for the inetorgperson attribute, e.g., named "ThisUsersGroupMembership", and configure it with:
Self
groupofuniquenames
uniquemember
Then, add the derived attribute to the user panel, and then go into User Manager and display an individual user's profile. The user's group membership should be displayed as the "ThisUsersGroupMembership".
I thought that this was pretty nice, but I noticed that if I go to the User Manager's main page and customize it to display the "ThisUsersGroupMembership" attribute,
the attribute name is shown, but no values are shown for that attribute.
I'm trying to figure out why the values for the derived attributes are not being displayed on the main User Manager page, and also if it's possible to get that working?
Thanks,
Jim

Jim,
Yes even I am not able to list users. I did not understand what you were exactly pointing to in your earlier mail.
This seems to be a bug with OAM but before we arrive at this conclusion. I think we should try and look at the xml response sent by OAM for search result. I am not able to recall how we can see the xml response in the browser. If you know then you can try and see if the Groups of the user are returned? If groups are returned then you will have to look at the stylesheet being used and modify it to display the groups.
If groups are not fetched then it must be a bug with OAM.
Thanks
Preetam

Similar Messages

HT4796 I did all of the above and the migration was successful, but I don't know where the files are. It says they're under a different user, 'owner' . I tried to access via sys pref/system/users&groups, but it asks for a password for owner which I don'

Migration Assit , PC to MAC - The migration was successful, but I don't know where the files are. It says they're under a different user, 'owner' . I tried to access via sys pref/system/users&groups, but it asks for a password for owner which I don't have. What must I do to access my files?
My experience is with MS PC's I'm new with the MAC Book Pro.

Then, see if this works:
Mac OS X 10.6 Help- If you forget your administrator password
If you are running Lion or Mountain Lion you may need to do the following to access the same utility:
Boot to the Recovery HD:
Restart the computer and after the chime press and hold down the COMMAND and R keys until the menu screen appears. Alternatively, restart the computer and after the chime press and hold down the OPTION key until the boot manager screen appears. Select the Recovery HD and click on the downward pointing arrow button.
When the menubar appears select Terminal from the Utilities menu. Enter resetpassword at the prompt and press RETURN. Follow instructions in the dialog window that will appear.
Or see Reset a Mac OS X 10.7 Lion Password and OS X Lion- Apple ID can be used to reset your user account password.

TFS says {oldaccount} is not a member of the Team Foundation Valid Users group, but I am

I'm trying to check in changes to TFS using VS2013. When I hit the submit button, TFS returns the following error, "TF14002: The identity {domain} \ {oldaccount} is not a member of the Team Foundation Valid Users group."
Background: my account name has been changed to {newaccount} from {oldaccount}. And when the sys-admins changed my account name they did not update my computer itself, so I'm still using C:\Users\{oldaccount}. I can't believe that would make a difference
but you never know....
When I first started working at this company I'm almost certain I set up my TFS Workspace with my old account. But I thought I deleted all that stuff related to my old account and reset everything to my new account (Workspaces and TFS server). My lead tech
has even shown me the account mgmnt screen with my new account name. And I've been able to check out items with my new account name.
I performed the following steps to try to "clean out" TFS:
• I copied all of my changed files to a back-up location.
• I undid all changes in TFS (note that TFS has been allowing me to check out files to edit).
• I deleted the TFS entry in Credential Manager per a suggestion online.
• I deleted my Workspace.
• I even deleted my TFS server.
• I Rebooted my computer.
• I reconnected to the TFS server.
• I rebuilt my Workspace.
• I restored my changed files from my back-up location.
At this point I tried checking-in my changes again but got the same error message as above.
Next, I deleted everything in this folder:
C:\Users\ ...\AppData\Local\Microsoft\Team Foundation\5.0\Cache
... but I'm still seeing the error.
Also, we'd been informed that a number of us need to downgrade from "Ultimate" to "Professional". I did my downgrade to VS2013 Pro (after the steps above) but I am still seeing the same error.
A comment on another question
here suggested that I shelve my changes without preserving changes locally, then un-shelve and attempt to check-in. This also did not work, I could shelve my changes and un-shelve, but doing so did not fix the original problem.
Note that I do NOT have access to the TFS server itself - much less permissions to perform any sort of admin on it (and I don't know the person who would) - but might there be a table in the TFS database that still has an entry for my old account that could
be joining to my computer name &/or new account name when TFS goes to look up my account info when I check in my changes? I am getting desperate for an answer!
Any suggestions?
Thanks,
D. Kelley

Hi D. Kelley,
Thanks for the details. Based on your description, you might need to change or update the SID for users. Try identity command to change the username if you never use the new username in TFS. Check this page for more information about
identities command in this
page.
You can also check the table "tbl_Identity" in the tfs_configuration database to see if the new user exists, or it has the old user. Another option is have a check on other machines to see if it works fine. Refer to links below for more information:
https://social.msdn.microsoft.com/Forums/en-US/93568425-a877-4d21-8497-1adc4561b6d3/unable-to-check-in-code-to-tfs-due-to-tf14002-the-identity-old-user-name-is-not-a-member-of-the?forum=tfsversioncontrol
https://social.msdn.microsoft.com/Forums/en-US/acc56859-624f-41bc-b698-cbb5e0b8f525/cant-check-in-code-the-identity-devoldusername-is-not-a-member-of-the-team-foundation-valid?forum=tfsversioncontrol
Best regards,
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

Samba4 user groups rights management problem

Hey,
I have a network with an archlinux server as only server on the network.
On the server with samba3 there are different directories with different user and group rights. Every user was existing twice, as a Linux user and as a samba user. In the samba smb.conf force group was set to the linux group, the files were forced 660 and directories 770.
user 1-4 were in officesmbgroup with access only to share1
user 1-2 were in officesmbgroup and extrasmbgroup with access to share1 and share2
all 4 users exist as linux users and have ssh access to the linux server
Example working on samba3
[share1]
available = Yes
browseable = Yes
comment = office
create mask = 660
directory mask = 2770
force create mode = 660
force directory mode = 2770
force group = officesmbuser
guest ok = No
path = /data/office
writeable = Yes
valid users = @officesmbuser
[share2]
available = Yes
browseable = Yes
comment = office
create mask = 660
directory mask = 2770
force create mode = 660
force directory mode = 2770
force group = extrasmbuser
guest ok = No
path = /data/extra
writeable = Yes
valid users = @extrasmbuser
As I understood with samba4 this is no longer possible because it is not possible to force a linux group in samba any more. I figured out to mange this in samba4 standalone role mode. But this has a big disadvantage: I had to set all files on the shares to 666 and folders to 777.
Working wtih samba4 standalone role mode, but security problem
[share1]
available = Yes
browseable = Yes
comment = office
create mask = 666
directory mask = 2777
force create mode = 666
force directory mode = 2777
guest ok = No
path = /data/office
writeable = Yes
valid users = user1, user2, user3, user4
[share2]
available = Yes
browseable = Yes
comment = office
create mask = 666
directory mask = 2777
force create mode = 666
force directory mode = 2777
guest ok = No
path = /data/extra
writeable = Yes
valid users = user1, user2
This would be a problem because linux user3 and user4 have ssh access and would have access to all files on both shares in all directories.
Is there another way to manage this or do I have to set up active directory, manage group rights there and leave the local rights on the linux machine at 660 and 770?
Thanks in advance

Thanks Bill, that was really handy.
I'd used the Add ID option without being on a specific store, and it had placed it under Digital IDs. It was still offering me the option to use that certificate to authenticate against the server with. I imported the certificate into the Windows Digital ID section it now authenticates against the server perfectly.
So problem solved, although I'm still not 100% sure why the Import Digital ID places the certificates into a location which doesn't work with Rights Management, although I'm sure there's a good reason.
I'll make sure that we only add to the Windows Digital ID container in Acrobat/Reader or import directly into the Personal Certificate store in Windows for the demonstration.
Thanks for your help in fixing this.

User groups and permissions problem

Hello everyone,
I've been running Arch Linux for about a month now and I have noticed a few things related to permissions associated with user groups that annoy me. My user is part of the storage, wheel and network groups, amongst others. I can see this when I run the `groups` command. From what I could read on the Wiki, the storage group should allow me to mount/umount drives such as my USB key and my iPod when they are plugged in and access the files from my user account without using sudo. The network group should let me manage the network connection via ifconfig, iwconfig, etc. once again without using sudo.
However, when I run iwconfig as my normal user, I get incomplete and inaccurate information. I get about 2 lines telling me essentially that I am not associated with any Access Point, which I clearly am. When I run it with sudo, I get the full information, including my Access Point's ESSID. iwconfig does not get the same data when run with and without sudo. Same goes with ifconfig. Also, I can not run dhcpcd or wpa_supplicant at all as a normal user.
I get a similar problem with the storage group. I can not mount or umount drives without sudo and I can not write to mounted drives that I've mounted with sudo. This is particularly annoying when I try to manage my iPod.
Does anyone have a clue what could be causing this?
Thanks a lot

I have searched Google and the Arch Wiki, have tried a lot of the suggestions from the forums, such as the 'how I beat policykit and hal' forum post. Nothing seems to let me mount my drives. I can see them in Nautilus, I click them but they don't mount. I can do it as root. It's really frustrating because I can't figure it out. I haven't filed a bug report because I thought it was a problem that I was having.
I haven't tried the iwconfig or network yet.
This is pretty much the only thing holding me back from everything working.

ARD showing users offline, but I'm able to control and observe.

Strange thing/bug happening.
I updated a user's computer with a static IP address to new hardware, using the same static IP as before. Old machine was taken out of service, but the brand new Thunderbolt iMac is showing up as offline in ARD.
Observer and Control buttons connect me to the new machine, but ARD has the old machine's info populating the info fields, including MacOS version and ARD version.
Deleting and adding the machine back in did nothing to fix the problem — only after changing the new Mac to DHCP the updated info showed up in the scanner window.

Hello I have ran into this issue as well and this is my solution.
on the left side i have groups by dept, teachers, etc and found that the link from the left side loses connection from the source like you have on your scanner for bonjour or network range, etc.
So what i do is in my left pane i would select the specific computers - then press delete key on the mac to remove them. Then i go to that scanner via ip or bonjour how ever it is searched on the network.
Find those specific computers again and re-add them to the left folder, smart list, group, etc and now the computer is bold in blue and not offline anymore.
it some how loses its connection but when i perform my process above they are online and working with no issue able to interact or chat where when it was offline i can remote in but not deploy, chat, interact, etc. but by removing them and adding again it reconnects or clearing it out is like removing the old cache and everything starts working.
I have been performed this process for 2 years, and i even took my macbook to apple retail store, and stated there is no reason why it should not work, but they wanted me to delete the app and all settings and do it again - i said no not happening.
Then i called Apple Edu Support and they jumped in and they stated the process i performed seems to work properly and this is why i continue it. Until i see a fix in an update.
Thanks
Dan Fernandez
Apple.iOSGenius on youtube
iOSG3nius on twitter

How to create user in specific user group in Microsoft Active Directory ?

Hi,
I am using Nestcape LDAP, and want to create user in the user defined group. I have created a new user group "TestUsers" in the "Users" container of Active Directory, I want to add the new user to Test Users group But my problem is that whenever I create a new user
it get added to Domain Users group.
Following is the code I am using which adds user to default group Domain Users.
public LDAPResult createUserID(
String userId,
String pwd,
String pId,
boolean resetonLogOn,
LDAPConnection ldCon) {
boolean flag = false;
int code=0;
try {
String pwdLastSetVal;
String desName;
String desc;
/* Specify the DN of the new entry. */
String dn =
"CN=" + userId + ",CN=" + this.container + "," + this.baseDN; // container = "Users"
/* Create and add attributes to the attribute set. */
String objectclass_values[] =
{ "top", "person", "organizationalPerson", "user" };
// LDAPEntry findEntry=null;
/* Create a new attribute set for the entry. */
LDAPAttributeSet attrs = new LDAPAttributeSet();
/* Attribute sAMAccountName */
LDAPAttribute attr = new LDAPAttribute(LDAP_SAM_KEY, userId);
attrs.add(attr);
/* Attribute unicodePwd */ // LDAP_PASSWORD_KEY = "unicodePwd"
attr =
new LDAPAttribute(
LDAP_PASSWORD_KEY,
(byte[]) this.encodePassword(pwd));
attrs.add(attr);
/* Attribute Display Name */
desName = userId + ":" + pId;
//desName = userId ;
attr = new LDAPAttribute(LDAP_DIS_NAME_KEY, desName);
attrs.add(attr);
/** Attribute userAccountControl to enable the userid.
attr = new LDAPAttribute(LDAP_ACCOUNT_KEY, LDAP_ACCOUNT_EN_VAL); // LDAP_ACCOUNT_EN_VAL= "548"
attrs.add(attr);
/* Attribute pwdLastSet to reset the password on first logon*/
if (resetonLogOn == true) {
pwdLastSetVal = "0";
} else {
pwdLastSetVal = "-1";
attr = new LDAPAttribute(LDAP_RESET_KEY, pwdLastSetVal);
attrs.add(attr);
/* Attribute Description */
desc = " Account Created by HelpNow App";
attr = new LDAPAttribute(LDAP_DESC_KEY, desc);
attrs.add(attr);
/* Attribute objectclass */
attr = new LDAPAttribute("objectclass", objectclass_values);
attrs.add(attr);
/* Create an entry with this DN and these attributes . */
LDAPEntry myEntry = new LDAPEntry(dn, attrs);
/* Add the entry to the directory. */
ldCon.add(myEntry);
flag = true;
}catch (LDAPException e) {
flag = false;
code=e.getLDAPResultCode();
}catch (Exception e) {
flag = false;
code=LDAPException.OTHER;
}finally {
ldaprs.flag=flag;
ldaprs.code=code;
return ldaprs;
}

Refer to the post titled "JNDI, Active Directory and Group Memberships" available at http://forum.java.sun.com/thread.jspa?threadID=581444&tstart=150

WGM creates new home folders with _unknown user/group, SA can't change it

A little background:
In our school we've got an xserve (about 1.5 yrs old), that was having issues last year. (the OD database pretty much ate itself). in august we did a clean install of 10.5, and updated to 10.5.3 (after suffering through the AFP/OD issues in 10.5.2). Because of the corrupt database from the last server, and the fact that a large number of our accounts have migrated through 4-5 iterations of servers from 9.2 on through 10.4.11, we created all new clean accounts by hand in WGM and moved the user files to the new home folders, changed user and permissions with SA to the new accounts and propogated that info to all the files for each home folder. everything has been going fine since then.
until this week.
the issue was discovered when we tried to create a new staff account (we created several accounts last week with no issue). in WGM everything looked fine. it created the account, assigned it to the proper group, and sucessfully created a home folder. the problem however was when we went into SA to change the permissions. we don't need everybody seeing everyone else's files, so we change the default group and everyone permissions to something more appropriate (don't even get me started on that gripe). When you navigate to the new home folder you just created in WGM, it shows the owner as _unknown (read/write) and group _unknown (read only... I think), Everyone (read only). Server Admin refuses to change the user or group. doesn't matter whether you use the 'show users/group' dialog and drag the account, or whether you edit it manually and insert the short name or UID. when you hit save, it stubbornly reverts back to unknown/unknown for user and group. we've tried creating accounts with different templates, no template, different account names and UID's, all with the same result.
The odd part is that nothing in the OS has changed since we first set it up and created all the users. nothing installed, nothing updated...
We've stayed at 10.5.3 due to the disaster in one of the updates (10.5.5 I think) that many of our other local districts had with network accounts not being able to see their own library folders due to permission issues, as well as the AFP causing 100% CPU use bug reported with 10.5.5
A second, probably related issue is that when browsing home folders in Server Admin filesharing, any files our network users create seem to end up assignedunknown/unknown for user and group (as far back as October it seems). After searching around the net most of the day I came across a lot of info about the _unknown user issues for folks upgrading from 10.4, but these are all newly created 10.5 network users (not local) logging in and working in home folders on the server. The original owners can read/write/delete these files as normal.
Any help would be most appreciated.

ok... I find we were shot in the foot by one of our own.
The quick answer: DO A GET INFO ON THE VOLUME WITH THE SHAREPOINTS! if the 'ignore permissions on this volume' box is checked... UNCHECK IT!
Explaination: not sure how the ignore permissions box got checked, but I don't think it was done directly by human hands. we use Carbon Copy Cloner Ver. 3.something (not sure which at this point) to back up both our data (daily) and server (weekly) drives to remote storage. by striking coincidence, things started saving with _unknown user and group about the same time as crash reporter shows that CCC hosed itself. My guess is that CCC temporarily ignores permissions (as shown in the status when you do a clone) and then resets them to their original state. when it crashed, it looks like they were still set to ignore, so it happily set it back to that state every time it ran after that. not sure why the account creation issue suddenly turned up after so long... In any event, it turns out that if you have sharepoints on a server volume, AND you set the OS to ignore permissions on that volume, BAD things happen (I'm not sure it should even be an option on a shared volume, but that's for the engineering folks to figure out.) .... specifically, the symptoms above. if you login as root (yeah, I know that's something you should never do) and uncheck the ignore permissions box on the volume, then log into WGM, as root (yeah, yeah, I know... even worse) and set ALL of the Directory Administrator accounts to 'do not administer this server', and no change rights for the directory, save those settings, and then set them back to 'administer this server', and FULL rights to change the open directory, save again. and then WAIT until the drives stop going nuts... after that everything works fine.

Trash and user group help!

why do i need to type in password when i delete things? how do i remove it?
and i can't delete items directly from the dock as well. like opening from the downloads folder and dragging the file to trash. i have to bring open up Finder and delete from the folder directly.
another issue is that am i able to remove the gues user from my start up screen? i've already disabled it from the user groups but i still see it in my login screen.
one last problem, is it a norm to have current leakage for the MBP? i've been having frequent shocks from the 2 bottom corners of it when i plug it in to a power source. i bought it from an authorized retailer and using it in the country where i've gotten it from. i've just gotten my mbp about 3 weeks back.
thanks for replying my queries!

Hi,
Yeah in ACS 3.1 its under the Shared Profile Components page. In ACS 4.1 its directly under the user groups or under SPC page.
You need to check the box for "define ip based access restriction" and deny access for all other groups to the wireless access points network device group.
ACS 3.X)
1. Denied Calling/Point of access restrictions
2. AAA Clients =UPS_PDU (Power Supplies)
3. Port = just put a * for all
4. Src IP address = just put a * as well
SUBMIT to SAVE
Create a second one for the other group like so:
1. Denied Calling/Point of access restrictions
2. AAA Clients =Routers_Switches
3. Port = just put a * for all
4. Src IP address = just put a * as well
Click submit to save it.
Go to the ACS User groups section and select the Network Administrators Group " that don't need access to the UPS's" and apply the NAR you created to that group. Do the same for the other grouping.
(ACS 4.X)
Go directly under the "user groups" and create the NAR under there. No need to go under the Shared Profile Components section
Hope this helps and let me know if you need further assistance or explanation.
Craig

OIM 9.1.0.2 - User group permission

Hi experts,
IHAC that need to configure some user groups in order to perform just specifics activities. We have configured the user groups but with no sucess.
1) Group that should see/track all the opened requests.
Given all request permission. (The requests don´t appear)
2) Group that should disable Resource from user thru User Detail -> Resource Profile.
Given all resource objects permission. (Error message: No permission)
3) Group that create/manage Attestation.
Given all attestation permission. (The attestation is created, but it doesn´t appear to delegated user)
Any tip on how to set the correct permission?
Brgs,

Hi,
I was looking for the same questions! One of them I could make it to work...
About quetion #3, some steps:
1. Create a group with name, lets say: AttestationManagers
2. Give the following permissions:
Attestation Requests
Attestation Process Tasks
Attestation Data
Attestation Process Definitions
Attestation Process Administrator
3. Make the users responsable of attestation process part of group: AttestationManagers
4. Create an attestation process and in the last field: Process Owner, put AttestationManagers
5. Click: "Run Now"
6. This attestation should appear to the user responsable of it.
You can find an explanation about the attestation process in the following link: http://download.oracle.com/docs/cd/E14049_01/doc.9101/e14057/attestation.htm#insertedID1 and about the Process Owner, the point 15.1.1 in the above link.
I hope it helps!
Regards.

How to change user group of a query (sq01)

Hi,
I'm working with SAP Queries (SQ01) and I don't know how can I change the user group assignation of a query. We did only one user group for all users and queries and know in order to arrange it a bit we've created three user groups.
We know how to assign users to new user groups but for each query of the old group we neet to move it to one of the new user groups, how could we do this?
thanks in advance

Hi
pls go through these links
http://help.sap.com/saphelp_46c/helpdata/en/35/26b413afab52b9e10000009b38f974/content.htm
Step-by-step guide for creating ABAP query
http://www.sappoint.com/abap/ab4query.pdf
ABAP query is mostly used by functional consultants.
SAP Query
Purpose
The SAP Query application is used to create lists not already contained in the SAP standard system. It has been designed for users with little or no knowledge of the SAP programming language ABAP. SAP Query offers users a broad range of ways to define reporting programs and create different types of reports such as basic lists, statistics, and ranked lists.
Features
SAP Query's range of functions corresponds to the classical reporting functions available in the system. Requirements in this area such as list, statistic, or ranked list creation can be met using queries.
All the data required by users for their lists can be selected from any SAP table created by the customer.
for more information please go thru this url:
http://www.thespot4sap.com/Articles/SAP_ABAP_Queries_Create_The_Query.asp
http://goldenink.com/abap/sap_query.html
Please check this PDF document (starting page 352) perhaps it will help u.
http://help.sap.com/printdocu/core/Print46c/en/data/pdf/BCSRVQUE/BCSRVQUE.pdf
check the below link will be helpful for u
Tutorial on SQVI
once you create query system generates a report starting with AQZZ/SAPQUERY/ABAGENCY2======= assing this report to tr code for the same

SQ03, user group removed after release upgrade from 4.6C to ECC6

Dear All,
I have a problem about user group - transaction code SQ03.
After the release upgrade from 4.6C to ECC6 the user group, that I created in the old system, are not present in quality and production environment.
In the development environment there is the user group but doesn't contain the queries that I created in the old environment.
How can I solve this issue?
Can I recover all missing queries?
(moreover I can access to the old environment)
Thanks in advance.
Regards

Hi
Please refer to the SAP note 1278056 and 1278115 - PDS Display: F4-characteristic values are not selectable. Hope this will resolve your issue.
Regards,
JB

How to diable only one field enabled and other fields disabled for one user group?

Hi,
I have a form contains many fields. A group of users can add items using that form.
As per the user requirement I have created a filtered view and that filtered view can be seen by some other sharepoint user group but as per their further requirement the new sharepoint user group is only allowed to update Remarks field. All other fields
should be disabled for them.
In my idea, I have to create multiple forms and in one of it except Remarks field all should be disabled but I am unable to assign multiple forms to a single list.
Or how to make Remarks field enable to this user group and for other admin user group all fields could be enabled.
Hope I have expressed my question correctly.
Any solution would be appreciated.

There is no Out of the Box way to set permissions on each column, primarily due to the performance impact. The following thread provides some options,
http://social.technet.microsoft.com/Forums/sharepoint/en-US/c0794232-9bab-4cea-91d8-f311a793a863/how-to-set-column-wise-permission-in-sharepint-list-in-sharepoint-2010?forum=sharepointadminprevious
Dimitri Ayrapetov (MCSE: SharePoint)

SQ01 - User Group Restrictions

Using transcation SQ01-Sap Query in the HR module is it possible to restrict users to specific queries. I have assigned users to user groups, but this does not appear to prevent users outside of the group running the query.
All users concerned have access to the transaction with authorisation value '23'.
Thanks
Simon

Hi,
Did you check what are the restriction given while creating a Query.
For more info
http://help.sap.com/saphelp_nw04/helpdata/en/d2/cb42cb455611d189710000e8322d00/frameset.htm
Cheers
Soma
Message was edited by:
soma pradeep

No User Group List

I am trying to add newly created User Group but when I click add Principals there is no list of groups available list is empty.
OS 2008 r2
Business object 4.0 SP2
Please help

I am able to resolve this problem.
Solution JAVA_HOME*should point to C:\Program Files (x86)\Java\jre6
and to answer your question when you right click user security on next window there is button Add Principals
Edited by: Babar Rashid on Dec 28, 2011 8:26 PM

Neat OAM Trick (showing users' groups), but a problem...

Similar Messages

Maybe you are looking for