Permit access withing schemas in single workspace?

Hi All,
I would like to provide access to all my schemas within one workspace.
basically, SCHEMA "A" and "B" would have access to each other's objects in single workspace.
Can someone detail how to do this?
I tried using MANAGE WORKSPACE TO SCHEMA ASSIGNMENTS" and could not find a way to do this
thanks

Hello,
You can assign multiple schmeas to a workspace. Please read [url http://docs.oracle.com/cd/E23903_01/doc/doc.41/e21678/adm_mg_wrkspc.htm#AEADM245]Managing Workspace to Schema Assignments
basically, SCHEMA "A" and "B" would have access to each other's objects in single workspace.If you want to access Schema-B objects from Schema-A, then you have to grant respective privilege to Schema-A from Schema-B. This is not specific to APEX.
Regards,
Hari

Similar Messages

Accessing Multiple Identical Schemas from Single Form

Hi,
I'm working with oracle 9i.
My question is as follows:
If one has muliple schemas that are all identical, is it possible to setup an oracle form (Oracle Forms 9i) that is able to switch between schemas by selecting the schema from an objecton the form like a drop down list etc..I'm wondering if it is possible to design 1 form that can be used to access all schemas from a single logon. if so, how would I go about doing this? Any help would be greatly appreciated!
I hope my question above is clear. If not I am happy to supply more info.
Kind Regard,
Damian

Your question is not very clear. Of course your logon will determine which schema. If you want to switch schemas, when the form is already running then you can use ALTER SESSION as Aleksandar indicated, but I would not recommend using it unless all form changes were committed. Another alternative is to create another session in the same schema by using OPEN_FORM, then logout of schema in this second session and login into new schema.

Can't log in with valid password, can't boot from disk, can't access disk utility, in single user mode can't reset password as appears locked in caps mode with '?' for forward slash, can anyone help?

Can't log in with valid password, can't boot from disk, can't access disk utility, in single user mode can't reset password as appears locked in caps mode with '?' for forward slash, can anyone help?

Which keyboard layout you were using? German, French ... I suppose your layout is reset to the default: US and you are unable to find the "?" or "/" ...
Please have a look into the keyboard viewer, to see how the layout of your keyboard is actually.
marek

Access denied for folder when permissions set with WMI

Hi,
When I add/modify access rights based on the Win32_ACE class, there seems to be a difference in the result, then when setting it with the GUI in Windows.
The situation is as follow:
I want to set Modify access on a remote folder, but also want to avoid deletion of the folder itself. This can easily be done by setting "deny delete on this folder only" in addition to "allow modify to this folder, files and subfolders".
So far no issue.
Now I notice that, although the GUI shows exactly the same result in advanced settings of the security property, the folder set with WMI script gives a deny when opening it with the user account. The same folder, set with the same security and result in
the advanced tab, but set in the GUI, works fine.
Note: The reason that I use WMI is because the remote system is a standalone machine, not sharing the same domain or trust.
I compared the ACEFlags, AceType and AccessMask for both the GUI set and script set permissions, and they are exactly the same.
GUI => AccessMask:1179817 AceType:0 iAceFlags:3
Script => AccessMask:1179817 AceType:0 iAceFlags:3
What a strange world we live in... :-)
Any idea?

What Operating System Interface are you referring? What program?
You are being obtuse. What is it that you are trying to compare. THe settings in WMI cannot be directly compared to anything in the Security Wizard.
¯\_(ツ)_/¯
Just the properties of the folder in Windows on the security tab. The result is the same for both the permissions set with the interface as well as the one set with the WMI script. The two references you see are just taken with WMI:
Set by Windows interface => AccessMask:1179817 AceType:0 iAceFlags:3
Set by WMI script => AccessMask:1179817 AceType:0 iAceFlags:3
This are the values "AceFlags", "AceType" and "AccessMask" from management class WIN32_ACE:
http://msdn.microsoft.com/en-us/library/aa394063(v=vs.85).aspx
I just want to show that the actual ACE object returns the same values for both methods, but the effect appear to be that the script set permission are denied. And I am looking for the reason why.
Can you provide the script that you're using to create the ACE(s) and add them? If I'm understanding what you're trying to do, there should be two ACEs created: one to allow the modify access and one to deny the folder deletion. The ACE you're showing is just
an allow ACE (AceType 0).
That is correct there are (or should be) two ACEs. I cannot get hold on my source right now (will be later today), but my code is based on this source:
http://www.minasi.com/forum/topic.asp?TOPIC_ID=7501
What I basically do is getting the DACL properties, loop through it to check that the user exists that I want to update. If it does I check that the current AceType is of the same type (allow or deny) that I am updating/adding. If that type is a match, I
replace the ACE object with the new Flag, Type and Mask using a Win32_ACE object. If type type doesn't match, then I add both the current ACE with the new ACE at the same time. I noticed that if I don't do it at the same time, only the last remains. If the
user doesn't match I check that the AceFlags is not equal to 16 (inherit) and then add the original ACE object in the ACE array. At the end I add the new ACE if the user was not found at all (new). The array of individual ACE objects is added to List of managementobjects
and then again linked to the DACL value.

Accessing HR schema using html db

We have our own schema called HR, and I need to create an application based on HR tables.
The person who is administering the html db has problems assigning HR schema to my workspace.
Is HR a reserved word and what is the way to deal with it?

Both are schemas in the same instance I presume.
A workaround can be access from the HR schema to the workspace in htmldb.
If it is the HR schema of Oracle Applications be careful with updating tables in the HR schema. Only granting select on tables (by schema/user HR to your workschema in html db) can make things more secure.

Execute Permissions denied on Schema

Hi ,
I've created a new schema in production database with some stored procedures and tables tied to it ,I need to grant permissions to execute, insert, select and delete permissions to me. I can access default dbo schema, I want ot knwo if below statements
can below statements grant me appropriate access to me or do I need any additional permissions.
GRANT EXECUTE ON SCHEMA::CCT TO dbo;
GRANT INSERT ON SCHEMA::CCT TO dbo;
GRANT SELECT ON SCHEMA::CCT TO dbo;
GRANT UPDATE ON SCHEMA::CCT TO dbo;
GRANT VIEW DEFINITION ON SCHEMA::CCT TO dbo;
I could not insert / update data within tables with schema for now.
Thanks,
Vishal.

You can give this permissions to DBO but are you the DB Owner? If not give the permissions to your user account or preferably a database role and add yourself as a member of the role.
If you are the DB Owner then you by default would have got these permissions.
Check this link to get better understanding -http://www.mssqltips.com/sqlservertip/2894/understanding-grant-deny-and-revoke-in-sql-server/
Regards, Ashwin Menon My Blog - http:\\sqllearnings.com

Schema Assignment to WORKSPACE

Hi,
I developed Application in one of the custom Schema.
WORSPACE : DEMOSPACE
SCHEMA : DEMO
Can i assign one more existing schema to "DEMOSPACE" like OE,SCOTT,HR..
Best Regards
Perumal Swamy.R

Actualy while adding schema the process is
completed.Eh? You are one confusing person. So you are already able to successfully associate another schema to your workspace?! So why in the world are we talking about that part? Why not focus on your real problem.
Creation Method: As an application on a database
table
Table / View Owner DEMO (LOV Shows only DEMO
Schema which is the Workspace owner).Clearly, you are using HTML DB Version 1.6 (that is something else you should mention up-front to avoid confusion)
That Schema dropdown on that page is supposed to show you all the schemas associated with that workspace.
If it does not, maybe your userid is restricted to access only subset of all schemas available to the workspace.
Log in as a workspace admin and go to
Home>HTML DB Workspace Administration>Manage HTML DB Users>Existing Users>Edit User for the userid that you are logging in as.
Make sure that the "Accessible Schemas (null for all)" box is blank. This will ensure that the user will have be able to build applications using any of the schemas available to the workspace.

Invalid parsing schema for current workspace ID

I have an application that captures different SQL statements (they make use of DB links) and dynamically executes them on demand.
I use apex collections to get the result rows for the SQL and use them to both query on the UI as well as send out emails using the returned data. This is all OK and works fine.
I then added another feature to my application where I support the scheduling of the running the SQL / sending out of the emails. It uses the same logic as I use from within the application but it fails with the following error ...
Invalid parsing schema for current workspace ID
when the SQL is being used to populate the collection.
The scheduling is done using the apex plsql job scheduling package. It's as though the context that the job is running in is different from that of the application I created. The strange thing is that it can still see my tables that I created as the queries return data from my tables but for some reason seems to have an issue with the use of apex collections.
Any ideas or suggestions would be greatly appreciated.

Scott,
Today the error mentioned in the last post occurred 3 times - the highest number in a single day yet. Also, to add to the dilemma, a new one occurred:
ORA-20104: create_collection_from_query_b Error:ORA-20101: Application collection exists
Knowing that the create collection process is called from a post authentication process I don't see how that the collection could exist for that session... Any ideas?
Regards,
Dan
http://danielmcghan.us
http://sourceforge.net/projects/tapigen

Adding "data owner" schema to apex workspace provided unexpected results

Recently I added a "data owner" schema to an existing apex workspace thinking it was a god idea.
As stated...
the schema that I added was a "data owner" schema and I was only suppose to have select capability for apex reporting.
After the schema was added to the workspace I felt I had owner privs on all of the schema objects and
could create objects and insert and update table records.
Needless to say... this is something that I do not want to do with tihs particular "data owner" schema BUT...
this is something that I feel is really good.
i.e. The Object Browser and Model are some excellent examples of the apex tool. :)I would just like to remove/block the insert/update capabilty against this particular schema from my workspace.
Any ideas on how to remove the update capability from my workspace or is it even possible?thanks in advance... :)
v/r
RJones

Ah, thanks I didn't see that section before.
I put the procedure details in the box; declaring the variables and the code to determine the context values
Logged in as a user and again as the schema owner (both with admin privs) I get this error back:
ORA-01031: insufficient privileges
Error ERR-1181 Unable to set VPD security context on page show.
This is my procedure:
Declare
V_COUNT NUMBER;
V_PRJ_USERNAME VARCHAR2(30);
V_USERID NUMBER;
V_PRJROLE VARCHAR2(30);
BEGIN
-- sets user name
V_PRJ_USERNAME := v('APP_USER');
V_PRJROLE := 'NO_ACCESS';
BEGIN
--gets user id from staff table
SELECT staf_id
INTO V_USERID
FROM PRJ_STAFF
WHERE staff_oracle_name = V_PRJ_USERNAME;
Select count(*)
into v_count
FROM DBA_ROLE_PRIVS
WHERE GRANTEE = V_PRJ_USERNAME
AND GRANTED_ROLE='PRJJ_GUEST_RL';
if v_count > 0 then
V_PRJROLE := 'GUEST';
end if;
Select count(*)
into v_count
FROM DBA_ROLE_PRIVS
WHERE GRANTEE = V_PRJ_USERNAME
AND GRANTED_ROLE='PRJJ_DEVELOPER_RL' ;
if v_count > 0 then
V_PRJROLE := 'DEVELOPER';
end if;
Select count(*)
into v_count
FROM DBA_ROLE_PRIVS
WHERE GRANTEE = V_PRJ_USERNAME
AND GRANTED_ROLE='PRJJ_MANAGER_RL' ;
if v_count > 0 then
V_PRJROLE := 'MANAGER';
end if;
Select count(*)
into v_count
FROM DBA_ROLE_PRIVS
WHERE GRANTEE = V_PRJ_USERNAME
AND GRANTED_ROLE='PRJJ_ADMIN_RL' ;
if v_count > 0 then
V_PRJROLE := 'ADMIN';
end if;
DBMS_SESSION.SET_CONTEXT('PRJ_SEC_PKG','USER_NAME','V_PRJ_USERNAME');
DBMS_SESSION.SET_CONTEXT('PRJ_SEC_PKG','USER_ID','V_USERID');
DBMS_SESSION.SET_CONTEXT('PRJ_SEC_PKG','USER_ROLE','V_PRJROLE');
END;
END;
Is there something wrong with my procedure?
Edited by: JodyMorin on Mar 27, 2009 6:23 AM

Can multiple OracleIDs be used to access datatase in a single HTMLDB app?

Hi,
In one of the apps we're looking to put together (w/ HTMLDB), we currently control database access using Fine-Grained-Access (with policies on tables that generate WHERE predicates based on the Oracle UserID in the session context). The way we currently have HTMLDB set up, it seems to be using a single "proxy" ID (HTMLDB_PROXY_USER) as the means of accessing the database, which means FGAC can't work.
Can this be configured to use other UserIDs when accessing/querying the db?
And...if so, can those IDs be specified somehow, either programmatically or at login time?
Thanks,
Jim Carter

Helps some more...tks...
So - is it safe to assume that the "v()" function is an element of HTMLDB that is installed and made public when HTMLDB is installed then?
Reason I ask is because we are thinking we could modify our existing predicate logic to check for the existence of the APP_USER value, and if it exists, use that instead of the SYS_CONTEXT() call, in our predicate generation function. However, seems like we'll also need some check as to whether the "v" function exists (ie. whether HTMLDB is installed), since the policy might be running in an environment where the HTMLDB app wasn't installed. But to even be able to compile Or, even where HTMLDB was installed, the query could be coming from a connection outside of the HTMLDB app. Does that sound reasonable?
Further, whether we use the existing SESSION_USER context var or the APP_USER one is really no big deal. The bigger question seems to come from mgmt of the user accounts used to access the application. Ideally, we want to be able to support access to the tables, either from the HTMLDB app or from external points (SQL*plus, Discoverer, etc). So the least common denominator seems to be Oracle (database level) UserIDs. However, can an HTMLDB app authenticate
using actual Oracle database UserIDs? That is, delegate the authorization to the database itself? And if it does, will the UserID be available via the APP_USER var, or some other...?
Tks,
Jim
BTW - If your willingness to help is any indication of the support on this board, that could well be the final selling point in deciding to use this technology - in other words, thanks a lot!

SharePoint 2013 - Site Settings - Users and permissions - "Access Request and invitations" link missing

I am site collection administrator and have configured the outgoing email in Central administration but "Access Request and invitations" link is missing, pl advice any additional configurations for this link to show up
I was though able to configure access requests by going to Site Settings->Users and permission and on the ribbon selected "Access Request Settings"
What is the difference in either of the approaches?
Thanks
Abhishek

Hi there,
I noticed this post, and didnt really find an appropriate solution to your issue. I noticed the same issue when dealing with Access Requests. First of all to make sure that the Request feature is enabled, you need to access
Site Settings -> Site Permissions -> Access Request Settings -> Make sure the
'Allow access requests' option is enabled.
The Allow access screen just allows you to enable the feature and also to specify a email address that notifications are sent to. Whereas the 'Access Requests and Invitations' section provides a screen to manage Access Requests and request history.
I noticed then that the Access Requests and Invitations link under 'User and Permissions' didnt actually appear until someone actually requests to join the site. It seems that this is needed to display the screen. Once actioned once, the option stays there.
Hope it helps

RE: Accessing multiple Env from single Client-PC

Look in the "System Management Guide" under connected environments page
72. This will allow services in your primary environment to find
services in your connected environment. However, there is a bug
reported on this feature which is fixed in 2F4 for the HP and H1 for all
other servers. The following is from Forte:
The connected environments bug that was fixed in 2F4 is #24282. The
problem
was in the nodemgr/name server source code and caused the following to
occur:
Service1 is in connected envs A and B.
Client has env A as primary, B as secondary.
Envmgr A dies before the client has ever made a call to Service1.
Afer env A is gone, client makes a call to Service1 which causes Envmgr
B to
seg fault.
You should upgrade your node manager/env manager nodes to 2F4. The 2F2
development and runtime clients are fully compatible with 2F4 servers.
Kal Inman
Andersen Windows
From: Inho Choi[SMTP:[email protected]]
Sent: Monday, April 21, 1997 2:04 AM
To: [email protected]
Subject: Accessing multiple Env from single Client-PC
Hi, All!
Is there anybody has any idea to access multiple environments from
single client-PC? I have to have multiple environments because each
environment resides geographically remote node and network bandwidth,
reliability are not good enough to include all the systems into single
environment.
Using Control Panel for doing this is not easy for those who are not
familiar with Windows. The end-user tend to use just single application
to access all necessary services.
I could consider two option to doing this:
1. Make some DOS batch command file to switch different environment
like, copying back/forward between environment repositories and
set up forte.ini for changing FORTE_NS_ADDRESS. After then, invoke
proper client partition(ftexec).
2. Duplicate necessary services among each environment.
But, these two options have many drawbacks in terms of system
management(option 1), performance(option 2) and others.
Has anybody good idea to implement this? Any suggestion would be
appreciated.
Inho Choi, Daou Tech., Inc.
email: [email protected]
phone: +82-2-3450-4696

Look in the "System Management Guide" under connected environments page
72. This will allow services in your primary environment to find
services in your connected environment. However, there is a bug
reported on this feature which is fixed in 2F4 for the HP and H1 for all
other servers. The following is from Forte:
The connected environments bug that was fixed in 2F4 is #24282. The
problem
was in the nodemgr/name server source code and caused the following to
occur:
Service1 is in connected envs A and B.
Client has env A as primary, B as secondary.
Envmgr A dies before the client has ever made a call to Service1.
Afer env A is gone, client makes a call to Service1 which causes Envmgr
B to
seg fault.
You should upgrade your node manager/env manager nodes to 2F4. The 2F2
development and runtime clients are fully compatible with 2F4 servers.
Kal Inman
Andersen Windows
From: Inho Choi[SMTP:[email protected]]
Sent: Monday, April 21, 1997 2:04 AM
To: [email protected]
Subject: Accessing multiple Env from single Client-PC
Hi, All!
Is there anybody has any idea to access multiple environments from
single client-PC? I have to have multiple environments because each
environment resides geographically remote node and network bandwidth,
reliability are not good enough to include all the systems into single
environment.
Using Control Panel for doing this is not easy for those who are not
familiar with Windows. The end-user tend to use just single application
to access all necessary services.
I could consider two option to doing this:
1. Make some DOS batch command file to switch different environment
like, copying back/forward between environment repositories and
set up forte.ini for changing FORTE_NS_ADDRESS. After then, invoke
proper client partition(ftexec).
2. Duplicate necessary services among each environment.
But, these two options have many drawbacks in terms of system
management(option 1), performance(option 2) and others.
Has anybody good idea to implement this? Any suggestion would be
appreciated.
Inho Choi, Daou Tech., Inc.
email: [email protected]
phone: +82-2-3450-4696

Accessing multiple Env from single Client-PC

Hi, All!
Is there anybody has any idea to access multiple environments from
single client-PC? I have to have multiple environments because each
environment resides geographically remote node and network bandwidth,
reliability are not good enough to include all the systems into single
environment.
Using Control Panel for doing this is not easy for those who are not
familiar with Windows. The end-user tend to use just single application
to access all necessary services.
I could consider two option to doing this:
1. Make some DOS batch command file to switch different environment
like, copying back/forward between environment repositories and
set up forte.ini for changing FORTE_NS_ADDRESS. After then, invoke
proper client partition(ftexec).
2. Duplicate necessary services among each environment.
But, these two options have many drawbacks in terms of system
management(option 1), performance(option 2) and others.
Has anybody good idea to implement this? Any suggestion would be
appreciated.
Inho Choi, Daou Tech., Inc.
email: [email protected]
phone: +82-2-3450-4696

Hi, All!
Is there anybody has any idea to access multiple environments from
single client-PC? I have to have multiple environments because each
environment resides geographically remote node and network bandwidth,
reliability are not good enough to include all the systems into single
environment.
Using Control Panel for doing this is not easy for those who are not
familiar with Windows. The end-user tend to use just single application
to access all necessary services.
I could consider two option to doing this:
1. Make some DOS batch command file to switch different environment
like, copying back/forward between environment repositories and
set up forte.ini for changing FORTE_NS_ADDRESS. After then, invoke
proper client partition(ftexec).
2. Duplicate necessary services among each environment.
But, these two options have many drawbacks in terms of system
management(option 1), performance(option 2) and others.
Has anybody good idea to implement this? Any suggestion would be
appreciated.
Inho Choi, Daou Tech., Inc.
email: [email protected]
phone: +82-2-3450-4696

Strange Permissions Behavior with Public/Private Drop Box

Strange Permissions Behavior with Non-Course Drop Box
In an effort to promote iTunes U on campus this semester (and to get people working with audio and video more) we're having a contest in which people can submit personal or group audio/video projects.
This being an iTunes promo, we intend for students to submit their contributions via a drop box.
To that end, I began experimenting with drop boxes in iTunes U, which I haven't done much of previously. I've created a course called "iTunes U Drop Box Test" under "Campus Events". Within that, I have two tabs: "Featured Submissions" and "Dropbox". My goal with this drop box was to allow faculty, students and college folks the ability to use the drop box ("college" being a role I've defined for those who don't fit into the faculty/student roles).
When I first started experimenting, access to the "iTunes U Drop Box Test" course looked like this:
--- Credentials (System) ---
Edit: Administrator@urn:mace:itunesu.com:sites:lafayette.edu
Download: Authenticated@urn:mace:itunesu.com:sites:lafayette.edu
Download: Unauthenticated@urn:mace:itunesu.com:sites:lafayette.edu
Download: All@urn:mace:itunesu.com:sites:lafayette.edu
--- Credentials ----
Download: College@urn:mace:lafayette.edu
Download: Instructor@urn:mace:lafayette.edu
Download: Instructor@urn:mace:lafayette.edu:classes:${IDENTIFIER}
Download: Student@urn:mace:lafayette.edu
Download: Student@urn:mace:lafayette.edu:classes:${IDENTIFIER}
For the "Featured" Submissions tab, I gave the non-system credentials the "download" right, and for the "Dropbox" tab I gave the non-system credentials the "dropbox" right.
My understanding of this setup is that everyone should have had the ability to view the course and the contents of the "Featured Submissions" tab and that those in the College/Instructor/Student roles would be able to upload files via the "Dropbox" tab ... but not see the contents of said tab after the files were uploaded (aside from any files they uploaded themselves).
This is not the behavior we saw however. While the College/Instructor/Student roles could upload files to the dropbox, everyone (including the unauthenticated public) was able to see all of the contents of the dropbox.
The only way I could get this to work as advertised was to change all of the system credentials save the "Administrator" to "No Access":
--- Credentials (System) ---
Edit: Administrator@urn:mace:itunesu.com:sites:lafayette.edu
No Access: Authenticated@urn:mace:itunesu.com:sites:lafayette.edu
No Access: Unauthenticated@urn:mace:itunesu.com:sites:lafayette.edu
No Access: All@urn:mace:itunesu.com:sites:lafayette.edu
Once I did this, everything worked as advertised: College/Instructor/Student roles could upload tracks, and the "Dropbox" tab would only display tracks they uploaded.
So my question is ... is this the correct behavior for the drop box? It looks like when the system credentials are in play, they're simply overriding whatever the normal "view" rule is for the drop box, which doesn't seem right.

Your current configuration where things work as you wanted does seem correct to me. You are not using any System Credentials to accomplish the functionality and that's fine.
Here's some more info to clarify how / why this is working for you and why you had to set "No Access" for the System Credentials:
The System Credential "Authenticated@..." is going to get assigned to any user that goes through your transfer script. Even if you transfer script assigns no credentials to a user, upon entering iTunes U they will have at least 1 - the "Authenticated@..." credential. Therefore, unless you block access using "No Access", any user that passes through your transfer script is going to be able to access the area in question.
When you change values for "Unauthenticated@..." or "All@..." you are defining what someone that DOES NOT pass through your transfer script can do. You want both of those to be "No Access" at the top level of your site if you do not want unauthenticated visitors.
The distinction between "Unauthenticated" and "All" is that "All" applies to all users whether they pass through the transfer script or not.
Here's another way to remember things:
User passes through your transfer script, iTunes U automatically assigns:
Authenticated@....
All@....
User does not pass through your transfer script and instead access your iTunes U site through derivable URL*, they get assigned:
Unauthenticated@....
All@....
*The derivable URL for a site is: http://deimos.apple.com/WebObjects/Core.woa/Browse/site-domain-name
Mac OS X (10.4.6)

Select permissions for different schemas

I am trying to create an application that is tied to a schema (ISR_CAT) with full permissions in another schema (ISR). When I try to run a query from ISR_CAT that selects tables in ISR, I get a "Table or View not found" error. The query works fine if I run it from ISR.
The permissions are all correct, and the query works if I run it in Toad, so it must be something with HTML DB.
Does anyone have some ideas of what could be wrong?
Thanks,
Scott

Scott,
Make sure that the object permissions are granted directly to ISR_CAT and not through a role. Roles are not enabled within stored procedures which is the context in which everything in HTML DB happens.
Scott

Permit access withing schemas in single workspace?

Similar Messages

Maybe you are looking for