OIM Group Permissions(OIM User access rights)

Is it possible to set the permissions for an OIM group (ie AD Admins) to have access to Enable, Disable, and Revoke the resources on the Resource Profile page for a user– without giving them write access to the User Detail page.
And secondly, could it be restricted enough to only allow them to do those actions on a specific resource (ie AD User) and not other resources (ie OID, etc).
Please let me know asap if have any idea..
Thanks..

My suggestion would be request based Enable/Disable/Revoke. You can code an approval task to validate submission of the request based on a group membership and either allow the process to continue or reject the request. Once you give someone access to manage users and access to the menu item, they will have access to all the drop downs for that user. You will need to test the permissions. You can give the group update writes to specific objects, and only read only to others and see if this meets your requirements.
-Kevin

Similar Messages

Problems Managing User Access Rights for Web Gallery

Has anyone else had issues changing the user access rights for a web gallery? It seems like the access is everyone or no one. Are the user rights handled per event in the gallery? I had issues adding events to the user's view/download rights in the publish settings.
Also, can these settings only be set when an event is first published? Attempting to change the user access rights after the event is published seems to require a re-upload of the images.
Any thoughts?

Problem solved.
I had to put the following lines in the specified "0000_any_80.my.website.conf" file:
        <Directory "/Library/WebServer/subdomain.domain">
                Options All +MultiViews -ExecCGI -Indexes -Includes
                AllowOverride None
                # For Password protection
                AuthType Digest
                AuthName "Password Protection"
                require valid-user
                <IfModule mod_dav.c>
                        DAV Off
                </IfModule>
        </Directory>

Drilldown based on user access rights

Hi
I have a bar chart which displays monthly sales for Region A, Region B.
I would like to know if it is possible to restrict drilldown based on user access rights (I'll get this from database and i know if the user has access or not when clicking, but i don't know how to disable the drill down or stop drilling down when user has no access rights)
Thanks
yesvee
Edited by: yesvee123 on Jun 2, 2010 2:03 PM

Hello Yesvee,
Database security does not exist in CR Designer, only in Trusted Authentication but it doesn't support Row security. You'll have to use one of our other Products to get this feature/functionality.
Call Sales for more info on which Products would be best suited for your needs and pricing.
Thank you
Don

User access right / permission function

how can i write a function user access right?
How can i save the url in database, and then different user enter the ui have different ui/function display.

The only solutions and they could get messy would be to create alternate rollups with the different combinations you want the users to see and filter on that. There might be a way to do a similar thing with an attribute dimension, but both approches would be rather messy. There is no "Create a summary on the fly" type of processing which is what you want.

[OIM] Group Permissions

Dear people,
I would like to know if anyone has knowledge of how group permissions are resolved when they have conflicts. For example, if I have GroupA with all permissions (like system administrators) and GroupB with no permissions (it could be a group made for access policies purposes), how this would be resolved?
I have a concrete situation here, with something like described where OIM don't let some users to do things, like revoke resources. I tried with the order of assignation of the groups, but problem persists.
Thanks!

I have never specifically seen this but you learn something new every day.
Something I have seen is that sometimes the OIM logic doesn't take into account members of groups that are members of groups. So if I am a member of group a and group a is a member of group b then I may not get the permissions that are assigned to group b.
Best regards
/Martin

[OIM] Group Permissions Conflict

People,
I created a new resource with an approval process. I configured ALL_USERS group permissions allowing only Insert permission on the Object Form, but without the Update and Delete permissions, so everybody can generate the request and fill the form for the first time, but not modify it. This is working fine.
Then, I created another group, called OIM_ADMINISTRATORS, that have ALL permissions on the same Object Form (Insert, Delete, Write). The problem is that when a user that belongs to OIM_ADMINISTRATORS tries to modify the Object Form, I have a message that says I have no permissions to Update it.
So I figure that the permissions from ALL_USERS are winning over the ones of OIM_ADMINISTRATORS. Is there a way to manage the priority of the permissions, so ALL_USERS can only create the Object Form but users under OIM_ADMINISTRATORS can ALSO modify it?
Thanks in advance.

Hi,
Both tabs server the differnet purpose in form.
Its good your requriement solved by this, but its not general solution.
As per my understanding, Group in Administrative tab have the full acess over the current record of the form while Object Permission tab define the access over the form.
Now, you are able to insert the record from ALLUser group right??
Just try to update/delete the same??
Please let me know the result....
Regards
Alabhya Goel

Run a report of user access rights ?

Hello, I would like to run a report from Active Directory (windows server 2012) that summarises the access rights that my various users have.
Is there a way of doing this ?
Thank you for any information.

Greetings!
Since other experts already mentioned about the OU ACLs, you can refer to this blog by Ashley in order to find out where your groups are used in shared folders:
PowerShell to Find Where Your Active Directory Groups Are Used On File Shares
Regards.
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?

801.x WLANs authenticated via Radius and Active Directory permit any user access any WLAN

Hi,
I have configured several WLANs with WPA2 and 8021.x which authenticate users through Radius server (Windows Internet authentication service) that conects with an Active Directory, into the AD exists one user group for each WLAN but the problem is that any user that was added to some group can get access to any WLAN, does anyboby know if I need some configuraion on the WLC to restric that?
thanks for your help.

Hi Scott,
I have done some test modifying the Radius Policy to look at called station ID and test too looking at the NAS-ID, In the first case, I change the Call Station ID Type into WLC RADIUS Authentication Servers configuration to AP MAC Address:SSID and AP Name:SSID and into the Radius Server using .*:SSID-NAME$ and SSID-NAME$ ,but it blocks access for any user. In the second case, I change the NAS-ID into WLC WLAN and interface confguration and into the radius server Policy to match all, but it doesn´t have any impact, what other test could I try?
thanks for your help.

OIM Organization Access Rights Inheritance

I'm using OIM 9.1.0. I have two Organizations defined in OIM, they are defined as parent and child org. If I assign the access right for the parent org to an OIM group, it seems this group will not automatically be granted the access right for the child org.
Is it possible to make the group also have the access right to the child org without specifically assign it?

My suggestion would be request based Enable/Disable/Revoke. You can code an approval task to validate submission of the request based on a group membership and either allow the process to continue or reject the request. Once you give someone access to manage users and access to the menu item, they will have access to all the drop downs for that user. You will need to test the permissions. You can give the group update writes to specific objects, and only read only to others and see if this meets your requirements.
-Kevin

Audit log of the User access and permissions

Hi All,
We need to have the Audit trail of the user access and permission. Meaning Changes to user access rights will be logged.
This should include:
Current Access Rights (including Date the access was given),
Group membership (including Date the access was given),
Previous Access Rights (including Date the access was given and revoked).
Can we reuse any out of the box functionality of CQ. Does anybody having any pointer to this?
Thanks,
Debasis

Hi PChamoun,
At the outset thanks a lot for the clue. I am very new to CQ. Could you please guide me like, what are the API required to track the rep:policy node changes. Even if workflow will be started after any change to rep:policy but how I will be able to get the information of what change happened.
Thanks,
Debasis

Need info about group permissions

Hi All,
I'm confused with OIM group permissions for the following scenario.
Consider three groups G1,G2,G3 with the following permissions to a particular resource object RO.
G1 - Has all permission in all places for this RO(resource object,process form,process definition,etc)
G2 - Has only read permissions in all places for this RO.
G3 - Doesn't have any permission with respect to this RO.
And also "Provision by Object Admin Only" is selected for this RO and G1 is an object administartor.
Now I got the follwing result when I try to provision this resource object.
case 1:The actor(logged in user) is a member of G1 & G2 ------- Got this error "DOBJ.INSERT_PERMISSION_DENIED.You do not have permission to insert this object " and the provisioning operation is failed.
case 2:The actor is a member of G1 & G3 ----- Able to provision this resource object.
Now my question is, in case1 if OIM is denying the operation as G2 doesn't have insert or write permission then how come it is allowing the opertion in case 2 where G3 doesn't have any permission ?
Is this an expected behaviour or am I missing something ?
How OIM is handling the permissions for this operation ?
Thanks in advance.
Regards,
NS

I have the same problem here.. the issue we have is that some users have groups that give permissions, other group that are used by access policies and others for menu visibility. The last two aren't for permissions purposes but they impact on the effective rights of the users, because for example, when users try to revoke resource, OIM says that they don't have permissions. Do you figure a workaround to solve this problem?

Message Monitor - Access rights

Hello,
we want to give some user access rights to look into Message Monitor to track the transfer of IDOCs.
Basically we have the role Role_SAPMEINT which lets us take look into the queue monitor but not the message monitor.
By which UME roles or UME actions is this part is accssible for the user.
I don't want to give the user SAP_XMII_Admin role.
Regards,
Kai

It looks like there are some Actions for the Message Listener Monitor listed in the MII help.
Actions for Permissions - SAP Manufacturing Integration and Intelligence - SAP Library

BAM tab access rights

Hi,
I’m currently working on user access rights for tab groups in BAM.
If the tabs within BAM each access different reports located in different directories, then by controlling the user access rights on those directories it is possible to control which tabs (ie. directories) the users will be able to view.
However, in my design there is a single report with an input filter parameter. Each tab opens up the same report by applying a different input filter parameter. Instead of replicating the same report multiple times in separate directories for each of the 12 different input parameters, is there any way I can control access to the different tabs by different users?
Any comments/suggestions would be greatly appreciated.
Thanks in anticipation,
Shiraz

One way we do is that, when launching the forms application, it first logs on as a dumb user login/login, that only has the rights of executing some stored functions in a package that return the name & password of a user that has all the needed privileges. After the making the calls to those functions, the form has the name & password of the user that will be used to logon and perform what's needed.
You may say that this way one may easily find-out the name & password of that "priviledged user". Still, those functions are not returning "in clear" the name & password, but they have to be combined in a way one would not easily guess. Moreover, the "login" user has no other priviledges except executing the respective package, no selects, no other things at all.
null

How can I make a file not read only? Using LV6.0, I have tried the Access Rights VI w/o luck.

I am talking about any file in windows 98 that has the read only box checked when I look at the properties of the file from Windows Explorer. I can can get rid of the check from the properties box, but I want to do it programmaticaly in LabView.

Hi,
Wire in '448' to the 'New Permissions' of the Access Rights VI. This will set the file as readable, writable and executable. I just tried this (on WinNT, though).
The 'permissions' parameter is a 16-bit integer where the least 9 bits are used. Of these, for Windows, bits 8, 9, and 10 (0-indexed) are important (i.e. if these are set = integer 448). See online Help for full details.
Hope this helps,
Khalid

Checking user access status

I'm writing an installer with InstallAnywhere. When the installation is made on a Windows machine we need to set a System Variable, system-wide if possible. How can I check the user's access rights in java? Is there any way to tell if he has full access on his system (ie, logged in as administrator) or not?
I need to be able to do this for every Win32 system.
Thanks,
Walter Gildersleeve
Productivity Engineering, GmbH
Freiburg, Germany

this code return all system properties U can access
Properties p = System.getProperties();
but I didn't find any information about user access right... :(

OIM Group Permissions(OIM User access rights)

Similar Messages

Maybe you are looking for