OSR11g - Setting Group Permissions on a Business

I tried setting permissions on a particular business for a group, setting all 5 (Find,Get,Save,Delete, Create) to "Allow" for the group within the OSR Control.
However, after the permissions were set, the business was no longer visible within OSB 11g's "Import from Uddi". The user configured within the OSB UDDI registry is a member of the same group within OSR.
If I remove the group permissions from the business, the business returns to being visible within OSB.
So what's the missing step?

The same problem also occurs in an even simpler scenario:
If I apply "FIND ALLOWED" permissions to the "admin" user on a particular business within OSR 11g, that business is no longer visible to my OSB 11g dashboard for either the "Publish to UDDI" or "Import from UDDI" actions.
So I've given this to Oracle Support to digest.

Similar Messages

I have 2 sets of permissions, how do I delete one?

I have five Macs, one G4 and 4 - G5's. G5s are running Snow Leopard 10.6.8.
Five graphic designers, who back up their work on a Mac XServer 10.6.6
Permissions on the designer's Macs are set to read/write for everyone.
Designer A backs up his job to the XServer, then Designer B needs to edit it, so she attempts to pull it off the XServer.
Permission denied for only some of the files, not all.
I guess I need some guidance on the proper way to administer the ACL on the Xserve.
I have set up an ACL group on the server. The strange thing is, there are 2 sets of permissions showing, one seems normal, but the other is labeled "Custom".
Is there any way I can log in as something other than the Administrator, and "wipe out" the custom permissions?
I usually do not mess around in the Terminal.
Thank you for any insights...

As Templeton Peck says, the proper way is to use the repartitioning facility, but this will result in loss of data.
However, SubRosaSoft do make a utility, Volume Works ($10), that will do this resizing on the fly. A complete back up would be prudent in either case.

Group Security Issue with Business Rules

Hopefully you experts out there can follow this. We have about 200 users in our Planning application split into 3 categories (Admins, Interactive Users and Planners) via groups setup in Shared services. We also have an email group list setup in Outlook that has all 200 users in it that we use to send out emails to all users regarding the application. So in Shared Services we have the email group list as an assigned group in the Planners group. So as new people are added to the group list in email they are automatically included as a user in the Planning application. People that are Admins or Interactive Users are manually added to those groups in Shared Services. Everything seemed to be working fine until we tried blocking the Planners groups from running certain business rules in the application. We have clusters setup in Essbase to control access to the business rules. I went into the cluster and set the Planners group to cannot validate or launch on certain rules but found that I now could not run the business rules either even though I am an Admin and the Admin group has vaildate and launch privledges in the cluster. I believe the issue has to do with the fact that I am by default in the Planners group because I am in the email group list which is assigned to the Planners group in Shared Services. Other than setting up and managing 3 seperate email group lists and assigning them individually in Shared Services, does anyone know how I can manage business rules security using the 3 groups i have setup? I hope this makes sense. If not I can provide more detail. Thanks.

Have you tried using Business Rules projects? Create a project for the admin Shared Services group and assign all rules to that group. Create a Planning project for planners and assign only rules that you want them to run. Any rule that planners should not have access to would be removed from the Planner business rules project, but still in the admin project for you to run.

ACL group permissions not propagating

I have a group of designers that are connected to X Server running Snow Leopard.
I have placed them in a group, "MarComm"
I have granted everyone full read/write access. ( I can trust them all)
I have tried to propagate these permissions..I saved the changes and restarted server.
For some reason there are 2 sets of permissions.
1) full access (desired configuration)
2) "custom" access
This "custom" access does erratic things..for ex:
Allows the designer to pull off a job folder containing 12 items. He has permission to use 8 items, but not the remaining 4.
Perhaps I need a step by step tutorial on how to create a proper "group" and to propagate permissions. I understand that the ACL should take precedence over the POSIX. I am not well-versed in using the terminal, but I am a careful person, and willing to try it.
Thank you in advance

Setting up groups in WGM is pretty fool proof. What I would try first is to remove all of the ACL's for the folder in question first.
Ensure that all of the files and folders within your folder have ACL's that can be removed. If not, then you'll have to clear the ACL's on each, one at a time.
The command to clear the ACL's from a folder and it's subfile and folders looks like this:
sudo chmod -R -N /path/to/folder
If you want to just remove an ACL from one file or folder, remove the -R from the command.
To write an ACL and have it apply to all folders within looks like this: (two commands, one to add read and one to add write permissions)
sudo chmod -R +a "groupname allow read" /path/to/file/
sudo chmod -R +a "groupname allow write" /path/to/file/
HTH!
-Graham

Sharepoint 2013 setup group permissions

In my SharePoint 2013 test sharepoint site, I would like to know how the users should normally have access to the test sharepoint site. Would the user sign as themselves individually or would they sign on with a group id? Can you tell me and/or point me
to a url that will show how to setup group permissions and how the users should login?

There are two suggested ways to assign permissions on SharePoint sites:
    Using SharePoint Groups
    Using Active Directory Groups
Note: A site can be set up to either inherit permissions from the parent site, or to allow unique permissions to be set for the site. If the site is set up to inherit permissions from the parent site, you will have to Add Users or Active Directory Groups
to pre-existing SharePoint groups in the parent site.
Using SharePoint groups:
Click on “People and Groups”
Click on “New” from the drop-down menu
Select “New Group” Under “Choose the permission level group members get on this site:… ”
Select “Contribute” and click OK.
Click on “People and Groups”
Click “New”, from the drop-down menu
select “Add Users” Type in the netID(s) you wish to add
Click on “Check Names” (the netID(s) should now be underlined)
Under “Give permission”, select the group you just created and click OK.
Note: If site owners want their site to show up automatically in users' "My Links" in "My Site" then those users must be part of a SharePoint group and that group must be defined as the "Members of this Site" group.
Using Active Directory Groups:
Click on “Peoples and Groups”
Click on “New” from the drop-down menu
select “Add Users” Type in the name of the Active Directory group you wish to add
Click on Check Names (the group name should now be underlined)
Under Give Users permissions directly, select “Contribute” &click ok.
Note: You can specify multiple netID(s) or AD groups by separating the names with a semi-colon(;).
Below are list of permissions you can use for the site..
Permission Level
Description
Full Control
This permission level contains all permissions.      Assigned to the
Site name Owners SharePoint group, by default. This      permission level cannot be customized or deleted.
Design
Can create lists and document libraries, edit      pages and apply themes, borders, and style sheets in the Web site. Not assigned      to any SharePoint group, by default.
Contribute
Can add, edit, and delete items in existing      lists and document libraries. Assigned to the
Site name Members SharePoint      group, by default.
Read
Read-only access to the Web site. Users and      SharePoint groups with this permission level can view items and pages, open      items, and documents. Assigned to the
Site name Visitors SharePoint      group, by default.
Limited Access
The Limited Access permission level is designed      to be combined with fine-grained permissions to give users access to a specific      list, document library, item, or document,
without giving them access to      the entire site. However, to access a list or library, for example, a user      must have permission to open the parent Web site and read shared data such
as the theme and navigation bars of the Web site. The Limited Access permission      level cannot be customized or deleted.
NOTE You cannot assign this permission level to users or SharePoint      groups. Instead, Windows SharePoint Services 3.0 automatically assigns this      permission level to users and SharePoint
groups when you grant them access      to an object on your site that requires that they have access to a higher      level object on which they do not have permissions. For example, if you grant
users access to an item in a list and they do not have access to the list      itself, Windows SharePoint Services 3.0 automatically grants them Limited      Access on the list, and also the site, if needed.

Most efficient/quickest way to set NTFS permissions in PowerShell

Hello all,
Trying to figure out what the most efficient/quickest way to set NTFS permissions via PowerShell is. I am currently using ICACLS but it is taking FOREVER as I can't figure out how to make inheritance work with this command.
This has prompted me to begin looking at other options for setting NTFS permissions in PowerShell, and I wondered what everyone here likes to use for this task in PowerShell?

Ah ok. Unfortunately, my ICACLS is taking FOREVER. Here is the code I'm using:
ICACLS "C:\users\[user]\Desktop\test" /grant:r ("[user]" + ':r') /T /C /Q
However:
1. I can't figure out how to make the inheritance parameter work with ICACLS
2. If I do make the inheritance parameter work with ICACLS, I still need a way to add the permission to child objects that aren't inheriting.
Any tips on how to improve performance of ICACLS?
1. icacls folder /grant GROUPNAME:(OI)(CI)(F) (i will post corrected code later, this works in CMD but not powershell couse of bracers)
2. get-childitem -recurse -force |?{$_.psiscontainer} |%{icacls ....} (or u can list only folders where inheritance is disabled and apply icacls just on them)
I think jrv and Mekac answered the first question about inheritance flags. I would just add that you probably don't want to use the /T switch with icacls.exe because that appears to set an explicit entry on all child items (that's probably why it's taking
so long).
For your second question, I'd suggest using the Get-Acl cmdlet. It throws terminating errors, so I usually wrap it in a try/catch block. Something like this might work if you just wanted the paths to files/folders that aren't inheriting permissions:
dir $Path -Recurse | ForEach-Object {
try {
Get-Acl $_.FullName | where { $_.AreAccessRulesProtected } | ForEach-Object { Convert-Path $_.Path }
catch {
Write-Error ("Get-Acl error: {0}" -f $_.Exception.Message)
return
If you're looking for speed/performance, you don't want to just use the PowerShell Access Control (PAC) module that Mike linked to above by itself. It's implemented entirely in PowerShell, so it's incredibly slow right now (unless you use it along with Get-Acl
/ see below for an example). I'm slowly working on creating a compiled version that is much faster, and I think I'm pretty close to having something that I can put in the gallery.
Since I wasn't sure which command would give you the best results, I used Measure-Command to test a few different ones. Each of the following four commands should do the exact same thing. Here are my results (note that I just ran the commands a few times
and averaged the results on a test system; this wasn't very rigorous testing):
# Make sure that this folder and user/group exist:
$Path = "D:\TestFolder"
$Principal = "TestUser"
# Native PowerShell/.NET -- Took about 15 ms
$Acl = Get-Acl $Path
$Acl.AddAccessRule((New-Object System.Security.AccessControl.FileSystemAccessRule(
$Principal,
"Read", # [System.Security.AccessControl.FileSystemRights]
"ContainerInherit, ObjectInherit", # [System.Security.AccessControl.InheritanceFlags]
"None", # [System.Security.AccessControl.PropagationFlags]
"Allow" # [System.Security.AccessControl.AccessControlType]
(Get-Item $Path).SetAccessControl($Acl)
# PAC Module 3.0 w/ PowerShell/.NET commands -- Took about 35 ms
$Acl = Get-Acl $Path | Add-AccessControlEntry -Principal $Principal -FolderRights Read -PassThru
(Get-Item $Path).SetAccessControl($Acl)
# icacls.exe -- Took about 40ms
icacls.exe $Path /grant "${Principal}:(OI)(CI)(R)"
# PAC Module 3.0 w/o Get-Acl -- Took about 350 ms
Add-AccessControlEntry -Path $Path -Principal $Principal -FolderRights Read -Force
Unless I messed something up, it looks like the native PowerShell/.NET commands are faster than icacls.exe, at least for modifying a single folder's DACL.

Group Permissions Problem

An issue has cropped up where whenever a user creates a file they are the owner with read/write permissions, but the group permissions are set to read only. I have checked the group permissions are being assigned in ACL, and it is set to read and write.
Please let me know if there is any other information needed to help me solve this and I will see if I can get it.
thnx.

I repaired all the permissions on the user account directories and this fixed my issues with share folder permissions for some reason.
Here is a script that will do it all in one go. Change /Volumes/XXXX/Users/ to where you users directory is. chmod the script to 755 and run with sudo and it will fix the user directory permissions for all accounts.
#!/bin/sh
# This shell script needs to be run as super-user
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown -R $u:staff $i
   /bin/chmod -R 700 $i
esac
done
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown $u:staff $i
   /bin/chmod 755 $i
esac
done
/usr/sbin/chown -R 'root':wheel '/Users/Shared'
/bin/chmod -R 777 '/Users/Shared'
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown -R $u:staff $i/Public
   /bin/chmod -R 755 $i/Public
esac
done
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown -R $u:staff $i/Public/Drop\ Box
   /bin/chmod -R 733 $i/Public/Drop\ Box
esac
done
for i in /Volumes/XXXX/Users/*
do
u=`echo $i | cut -d/ -f5`
case $u in
Shared)
Temporary)
   /usr/sbin/chown -R $u:staff $i/Sites
   /bin/chmod -R 755 $i/Sites
esac
done
exit 0

Project Server 2010 categories and group permissions

Hi, I have reason to suspect that permissions have been varied on categories and are different for differing users requiring the same categories. Are there any tools I can use to quickly look at the current permissions compared to the default permissions?
thanks
Steve

Steve,
This is one of the reasons why we always suggest that the default categories/groups be left intact and new elements be created for security.
You do have some options though:
1)
Here is an excellent quick reference set up by Guillaume, that will give you links to the default security as defined out of the box.
2) You could simply create a blank PWA instance and see the permission settings.
3) For the Category Specific permissions for groups, you could create new groups and set up permissions with templates.
4) I think the Orange book by Gary Chefetz and Dale Howard also details out all the permissions.
At least these are the few things that I can think of the top of my head.
Cheers,
Prasanna Adavi, Project MVP
Blog:
Podcast:
Twitter:
LinkedIn:

DPM 2012 R2 UR4 - DPM could not set security permissions on the replica or recovery point volume that was created.

Hi All,
I am running a fresh install of SCDPM 2012 R2 with a protection group that is backing up the 'C:\', Bare Metal and System State of some VMs. If i add any additional servers to the group since the first creation it returns the following error:
Modify protection group: System State & Bare Metal Recovery failed:
Error 419: DPM could not set security permissions on the replica or recovery point volume that was created.
Error details: The process cannot access the file because it is being used by another process
Recommended action: Review the error details, take appropriate action and retry the operation.
If i re-create the whole protection group it works fine.
Could any one advise any further diagnostics I can do to try and locate the reason behind not being able to modify the group after the first creation? I can add new servers to other PGs without any issues.
Thanks in advance,
Dan

If you are protecting any of the system state/BMR protection. Can you stop protection by deleting the older recovery points and then recreate the protection group.
This thread mentions this to be a hardware issue, albeit with less information on what exact hardware issue:
https://social.technet.microsoft.com/Forums/en-US/480679c2-1079-4847-ab38-5cc8f454ef86/error-419-dpm-could-not-set-security-permissions-on-the-replica-or-recovery-point-volume-that-was?forum=dataprotectionmanager
Regards, Trinadh [MSFT] This posting is provided AS IS with no warranties, and confers no rights. If you found the reply helpful, please MARK IT AS ANSWER. Looking for source of information for DPM? http://blogs.technet.com/b/dpm/ http://technet.microsoft.com/en-in/library/hh758173.aspx

Setting up permissions on the file server

I am attempting to set up a file server with the OS X Server that came with my mac mini.
I need to be able to set up permissions for 4 different users to be able to read and write, however with no permission to delete.
I went to the MacMini section (on the left hand corner of the server app), then storage, and from there set up custom permissions
I added the four users as a group.
When I added the group to have access to the needed file, I clicked on the drop downs.
I allowed all permissions for inheritance and reading. I selected all permissions for writting except for "delete" and "Delete subfolders and files"
This give me a "-" sign next to write versus the check symbol (like it was shown for Read and Inheritance)
After I set this up... I went to one of the users to test it out, it would not allow me to drop a file on the server or delete anything.
How do I get this to work the way I want it!?!

You can not do this with a single ACE. Or at least I've never been able to. This shoud resolve.
Please make sure you test this however. Remember that trying to overwrite is a delete and then a write. So if you deny delete, then you can not replace a file or folder with one of the same name. Also, renaming a file is also a delete. You will not be able to rename. Make sure you test this before putting into production to ensure you are getting the behavior you want.
You have a share point named Archive. You have a group called Archive_Users. The Archive_Users are allowed to read and write but NOT delete data in the Archive. Do do this, follow these steps:
1: Create a group called Archive_Users and place your users into the group.
2: Define your share point in File Sharing.
3: Edit to share point to add the group. Press the + button and start typing the group name. When it appears, set the permission to Read Write. You permission window should have 4 entries at this point. The everyone, the group (likely staff), and the owner (likely the server admin). Then the one you added. The bottom three are POSIX, the final one is an ACE.
4: Now, you need to get your hands dirty and create a custom ACE. Server.app does not allow you to use the Deny rules so break out Terminal.
5: I will assume the Archive folder is in this path /Shares/Archive. First get a list of the folder's ACL using:
ls -le /Shares/Archive
It should like like the following:
drwxr-xr-x+ 2 carbon wheel 68 Feb 18 22:27 Archive
0: user:_spotlight inherited allow list,search,file_inherit,directory_inherit
1: group:archive_users allow list,add_file,search,add_subdirectory,delete_child,readattr,writeattr,readextat tr,writeextattr,readsecurity,file_inherit,directory_inherit
6: Now you must add your deny rule. Use the following command:
chmod +a# 2 "group:archive_users deny delete,file_inherit,directory_inherit" /Shares/Archive
The syntax here is to add (+a) an ACE at index 2 (# 2), an ACE for the group archive_users that states the group can no delete any file or folder and this is inherited all the way down.
7: If you have content in the folder already, be sure to propagate the permissions.
8: Test, test, test.
Remember, the deny rules can have some odd effects. As mentioned, I can think of the renaming and the overwrite as possible deterrents.
A possible alternative is to not give everyone read write access to the Archive. It might be more sane to define two groups. The first groups, Archive_admins, is a subset of users who are entrusted with moving data to archived status. The second group, Archive_users, is the rest of the team and they have read only access, allowing them to pull data but not edit the archive. This allows you to use two simple ACEs in Server.app: Archive_admin = read/write and Archive_users = read.
R-
Apple Consultants Network
Apple Professional Services
Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Copying files from Windows rips out group permissions

Hi there all,
Having some problems with group permissions being removed from files when data is copied from a Windows OS.
We currently have a network of Macs that are tied to a AD/OD structure.
We have also set a custom umask for each mac defining 002 as the permissions to be written to files.
However, when we connect to a Windows file share using the smb:// protocol and copy files/folders across to the Mac environment the umask permissions are not written correctly.
The User is given full control and the Everyone group is denied access. However, no group permissions are written at all.
We have tried altering the smb.conf file to no effect.
Could anybody shed some light on this annoying problem?
Many thanks

You have to install this version of samba as Apple have made a complete hash of implementing their own... Another massive fail from the worlds favourite consumer electrics company... Listen to the pro users leaving in droves...
http://eduo.info/apps/smbup

ACLs Masks + Group Permissions

I don't get this...
I applied setfacl -d -m mask:002 /home/http/pyther.net
pyther.net
# file: ../pyther.net/
# owner: pyther
# group: http
user::rwx
group::rwx
other::r-x
default:user::rwx
default:group::rwx #effective:-w-
default:mask::-w-
default:other::r-x
drwxrwxr-x+ 16 pyther http 4096 2009-11-08 00:19 .
Create File
[pyther@mongo pyther.net]$ touch abc.txt
Permission of File
[pyther@mongo pyther.net]$ getfacl abc.txt
# file: abc.txt
# owner: pyther
# group: users
user::rw-
group::rwx #effective:-w-
mask::-w-
other::r--
-rw--w-r--+ 1 pyther users 0 2009-11-08 00:19 abc.txt
Why does getfacl show that the file has group permissions of 777?
I want the group to be able to read + write, but not execute the file. As far as I can tell the file isn't really executable.
Last edited by pyther (2009-11-08 05:24:32)

The group permission is 777 because the directory has default:group::rwx. Effectively there are no read and execute rights because of the mask.
Set the default mask and default group to rwx and try again.

How to do group permissions in cyradm?

Generic cyradm documentation seems to say that you can set permissions on a per-group basis.
I'd really like to do this (on Panther server) - we have a lot of shared mailboxes, and it is a real pain explicitly adding new users to each and every mailbox every time we get a new user.
But I just can't get group permissions to work. Has anyone successfully done this on Panther Server?
Thanks

Here is one way:
select UPPER(name) from xtable group by UPPER(name)
having count(UPPER(name))>1
Kalman Toth Database & OLAP Architect
SELECT Video Tutorials 4 Hours
New Book / Kindle: Exam 70-461 Bootcamp: Querying Microsoft SQL Server 2012

OIM Group Permissions(OIM User access rights)

Is it possible to set the permissions for an OIM group (ie AD Admins) to have access to Enable, Disable, and Revoke the resources on the Resource Profile page for a user– without giving them write access to the User Detail page.
And secondly, could it be restricted enough to only allow them to do those actions on a specific resource (ie AD User) and not other resources (ie OID, etc).
Please let me know asap if have any idea..
Thanks..

My suggestion would be request based Enable/Disable/Revoke. You can code an approval task to validate submission of the request based on a group membership and either allow the process to continue or reject the request. Once you give someone access to manage users and access to the menu item, they will have access to all the drop downs for that user. You will need to test the permissions. You can give the group update writes to specific objects, and only read only to others and see if this meets your requirements.
-Kevin

Exchange Online - Set FOLDER permissions recursively in shared mailbox

I posted this in the 365 forums. Reposting here see if it gets any traction. Thanks
I have a shared mailbox that is being used instead of public folders. Having trouble with the folders within the shared mailbox syncing to the various users. Want to move folders out of the shared
mailbox but continually run into errors regarding permissions and I must manually find the offending subfolder and set permissions.<o:p></o:p>
So, I have two questions:<o:p></o:p>
1. How can I configure the shared mailbox so that all folders that are created, regardless of which user creates them, will inherit permissions. Any folder created should automatically have permissions
set to owner for a specific security group.<o:p></o:p>
2. How can I set the permissions on these exisiting shared mailbox folders, recursively (all sub folders) ? I have tried the following:<o:p></o:p>
Get-MailboxFolder –Identity user1:\Folder -Recurse | Add-MailboxFolderPermission -User user2 -AccessRights Owner<o:p></o:p>
But I get an error that the mailbox is not found. I believe that the command above does not work on shared mailboxes.<o:p></o:p>
I also found the following, but can not seem to get it to run. I have tried to run as a ps1 file and directly in powershell - I dont get any errors.<o:p></o:p>
ForEach($f in (Get-MailboxFolderStatistics
[email protected] | Where { $_.FolderPath.Contains("/") -eq $True } ) )
$fname = "[email protected]:" + $f.FolderPath.Replace("/","\"); Add-MailboxFolderPermission $fname -User
[email protected] -AccessRights Owner
Write-Host $fname
Start-Sleep -Milliseconds 1000
}<o:p></o:p>
Any help is appreciated. Thanks<o:p></o:p>

First of all, why don't you just give permissions on the mailbox level instead?
If Office 365, the
Get-MailboxFolder cmdlet only works for you own mailbox. So you have to use the Get-MailboxFolderStatistics as shown in the example. You will need to adjust this to give permissions to the Root folder and its best to actually exclude some of the
folders.
The example below should work, note that there is practically no error handling there, so test it first. Also, if the access entry already exists, you will get error messages.
$mailbox = "[email protected]"
$folders = Get-MailboxFolderStatistics $mailbox | ? {$_.FolderType -ne “Root” -and $_.FolderType -ne “Recoverableitemsroot” -and $_.FolderType -ne “Audits” -and $_.FolderType -ne “CalendarLogging” -and $_.FolderType -ne “RecoverableItemsDeletions” -and $_.FolderType -ne “RecoverableItemspurges” -and $_.FolderType -ne “RecoverableItemsversions”}
Add-MailboxFolderPermission $mailbox -User [email protected] -AccessRights Reviewer #root permissions
foreach ($folder in $folders) {
$FolderPath = $folder.FolderPath.Replace("/","\").Replace([char]63743,"/") #with PowerShell v3 'fix'
$MailboxFolder = "$mailbox`:$FolderPath"
Add-MailboxFolderPermission "$MailboxFolder" -User [email protected] -AccessRights Reviewer

OSR11g - Setting Group Permissions on a Business

Similar Messages

Maybe you are looking for