Profile Type Privilege Assignments through IDM roles are stuck in Pending State

Hi Everyone,
We are getting a strange problem in our project in IDM 7.2 SP8. We use IDM role based concept where backend system specific technical roles, profiles (called as privileges in IDM) combined into IDM roles and these IDM roles are assigned to users.
Events are configured on the privileges level (i,e backend system specific technical roles, profiles) in IDM so that once a IDM role is assigned to a user the corresponding privileges are assigned to user in IDM and these assignments triggers provisioning to associated backend systems.
Now for role type privileges the provisioning is working fine. But for profile type privileges the provisioning status is always showing as pending and nothing happening and even no logs are showing in job log.
I tried with execution of the mc_analyze_assignments stored procedure that came with SP08 to find the logs at least but still no information appearing. Looks like the triggering itself is not happening.
I also compared the member events definition for the profile type privileges with the role type privileges (for which the provisioning is working fine) and looks like the settings are exactly same.
Can any one suggest any other things that we are suppose to check? Any help is highly appreciable.

Hello Venkata,
did I understand correctly: You have business roles, that have SAP-profiles & SAP-roles (both privileges in IDM) assigned. Now you assign such a business role to a user, but only the SAP-roles are provisioned to the backend system and the SAP-profiles are not?
Since you can see them in the UI for the user as pending, it looks like at least the provisioning is triggered, just not completed.
You could check with the following SQL-statement, if they are waiting for the sucessful completion of another task and work your way from there:
select * from mxp_provision where msg like 'Wait for%'
The MSG-column gives you the audit-id of the "blocking" task and you can find more information about that one via
select * from mxp_audit where auditid=<auditid>
to see, what is going on there.
Also do you have access to the Monitoring-tab via http://<portalurl:port>/idm/admin? In the provisioning-audit you might find some clues for those operations, too.
Regards,
Steffi.

Similar Messages

Child CPs are always in PENDING STATE.

Procedure parent_cp (errbuf out nocopy varchar2, retcode out nocopy varchar2) IS
ret number;
i number;
BEGIN
fnd_msg_pub.initialize;
BEGIN ---Block A
req_data := fnd_conc_global.request_data;
if (req_data is not null) then
i := to_number(req_data);
if (i < 5 ) then
errbuf := 'Done!';
retcode := 0 ;
return;
end if;
else
i := 1;
end if;
for j in 1 .. 4 loop
vRequestId(j) := fnd_request.submit_request('CZ', 'Child','Delete Localized Text - Child Number : ' ||TO_CHAR(vChildNo), NULL,TRUE, vChildMdlRange);
fnd_conc_global.set_req_globals(conc_status => 'PAUSED', request_data => to_char(vChildNo)) ;
IF (vRequestId(j) = 0 ) THEN
errbuf := fnd_Message.get;
retcode := 2;
ELSE
errbuf := 'Sub-Request submitted!';
retcode := 0 ;
END IF;
END LOOP;
END;
BEGIN ---block B
For j in vRequestId.FIRST..vRequestId.LAST LOOP
fnd_file.put_line(fnd_file.log,' reuest' || vRequestId(j));
vrequeststatus := fnd_concurrent.get_request_status(vRequestId(j),
NULL,
NULL,
phase,
status,
dev_phase ,
dev_status ,
message );
WHILE (dev_phase != 'COMPLETE') LOOP
fnd_file.put_line(fnd_file.log,' while loop' || vRequestId(j));
vrequeststatus := fnd_concurrent.wait_for_request(vRequestId(j),
60,
10,
phase ,
status ,
dev_phase ,
dev_status ,
message );
END LOOP;
END LOOP;
dbms_output.put_line(' Block after submitting Child CP ');
END;
END parent_cp;
The above procedure was the Parent CP. Here the problem is in fnd_request.submit_request('CZ', 'Child','Delete Localized Text - Child Number : ' ||TO_CHAR(vChildNo), NULL,TRUE, vChildMdlRange); i have given sub_request as True and used fnd_conc_global.set_req_globals(conc_status => 'PAUSED', request_data => to_char(vChildNo)) ; to make parent CP to pause it.
It submits 4 child CPs as expected but the phase as INACTIVE and status NO MANAGER and PARENT CP was always in running state.
If i make sub_request parameter of fnd_request.sub_request to FALSE . It submits 4 child CPs as expected with the phase as PENDING and status NORMAL and PARENT CP was always in running state. But child cps are never changing the Phase to RUNNING. It is always in PENDING STATE.
Please suggest how to use fnd_conc_global.set_req_globals and fnd_concurrent.wait_for_request together.

Pl do not post duplicates - Parent Concurrent Program executes rest of the logic before PAUSED STATE.

Development Provisioning Profiles Stuck on PENDING

Hi Guys,
I have just recently added an iPad3 to a provisioning profile.
Can anyone explain why my certificates are stuck on pending? Is this one for apple support?
Thanks.

I've spent all day on this and haven't progressed an iota. I am in provisioning profile h*ll.
It's not like I'm a rank beginner - my friend and I have 8 apps up at the app store already and have been doing this since September. But since these certs expired, I just haven't been able to get moving again.
Everything works just fine in the simulator, but I can't generate a build for the iPhone or the app store without the error mentioned in my first message occurring.
Nobody else is having problems after their certs or developer provisioning profiles expire when they try to generate and install new ones?
I downloaded the most recent iPhone Developer Program User Guide v2.4 and went page-by-page, step-by-step doing everything from scratch, but it just doesn't seem to work anymore.
...sigh...
doug

Portal Roles Intial load and Provisioning through IDM UI

Dear All,
I am trying to assign portal roles to Users in IDM 7.1 SP5.
For this two activities needs to be performed:
1) Portal roles Initial load in IDM Identity store
2) Provisioning of Portal roles to Users through IDM UI
Please suggest about the configuration guide or steps required for both points mentioned above.
Thanks
Honey

Dear Christoph,
Thanks for the reply.
Now I am able to assign Role / Privileges to Users from IDM to UME.
Require one clarification on User / Identity creation:
Where can I can set initial password for all the new user created from IDM UI ?
I am able to create new User and assign roles as well from IDM UI and all is available in EP UME also.
But when I am logging in with new user it is not taking the default password mentioned in Global Constant in IS.
Do I need to mention the password somewhere else.
Pls suggest.
Thanks
Honey
Edited by: Honey Gyanani on Oct 6, 2010 9:10 AM

IDM roles creation / updation and deletion via workflows

Hi,
We are in IDM 7.1. I wanted to know if there is any way to create / update / delete IDM roles using in the workflow / rules on a data driven logic rather than using the IDM admin page (Roles tab) and creating them with LDAP group attributes assingned and making them pre-defined.
I've read in most of the postings that most of the time it has been retreived but no other options being done.
Anyone having ideas???
Regards
Krishna

Hi,
check these FM , i dont know it will work for u or not.
BAPI_USER_ACTGROUPS_ASSIGN     User: Change entire activity group assignment
BAPI_USER_ACTGROUPS_DELETE     User: Delete entire activity group assignment
BAPI_USER_CHANGE               Change User
BAPI_USER_CLONE                Create User with Template in Another System
BAPI_USER_CREATE
BAPI_USER_CREATE1              Create a User
BAPI_USER_DELETE               BAPI to Delete a User
BAPI_USER_DISPLAY              Display Users
BAPI_USER_EXISTENCE_CHECK      Check a user exists
BAPI_USER_GETLIST              Search for Users
BAPI_USER_GET_DETAIL           Read User Details
BAPI_USER_INTERNET_CREATE      Create a user in the Internet
BAPI_USER_LOCACTGROUPS_ASSIGN Change Activity Group Assignment for Dependent Systems from Central Sy
BAPI_USER_LOCACTGROUPS_DELETE Delete Activity Group Assignments in the Dependent Systems
BAPI_USER_LOCACTGROUPS_READ    Change Activity Group Assignment for Dependent Systems from Central Sy
BAPI_USER_LOCK                 Lock User
BAPI_USER_LOCPROFILES_ASSIGN   Change Profile Assignment for Dependent Systems from Central System
BAPI_USER_LOCPROFILES_DELETE   Delete Profile Assignments for Dependent Systems
BAPI_USER_LOCPROFILES_READ     Change Activity Group Assignment for Dependent Systems from Central Sy
BAPI_USER_PROFILES_ASSIGN      User: Assign profiles
BAPI_USER_PROFILES_DELETE      User: Delete All Profile Assignments
BAPI_USER_UNLOCK               Unlock user
Reward points if useful..
Regards
Nilesh

Multiple privilege assignments execute multiple CreateUserTasks

Hi all
I have set up a CreateUserTask which has an "Send Passwort Mail"-Task in "Execute Task on OK result".
My procedure to create a user is quite simple: I go to the WebUI, use task "Create Identity" and (for testing) assign 2 privileges from the same ABAP-System it.
When the provisioning tasks start I can see in the JobLog that each job (SetTempAccountFlag, custom_SetPassword, CreateABAPUser, custom_SendEmail & custom_UnSetPassword) is executed twice (if I assign 5 privileges or a role which contains 5 privileges the jobs are run 5 times).
My problem is that the "Send Password Mail" task is also executed that many times, so the end user receives 2 (or 5) emails from the IdM system.
How can I implement the "Send Email" Task into my task chain so that it is executed only once?
BR
Michael

First my Task was part of the OrderedGroup "CreateABAPUser". Then I moved it to the task result action on OK, but it is still executed x times.
I made a copy of the SAP-PF for my purposes so you are able to follow my task-names and task-flow there.
I tried to use the on OK result in Task "ProvisionABAPAccountToSystem" but the email is sent twice (for two privilege-assignments). I can't go higher in the task-order because the next-level task would be ProvisionABAPUser which is executed too often.
So I will try to use Flags as you recommended - although I never used flags before and thus this will be a little tricky and confusing I suppose
Any other thougths are still welcome...
BR
Michael

Cleaning up privilege assignments

Hi there
the scenario is as follows: during initial load the privilege-assignments have been loaded into IDM directly from the target systems as direct assignments. Now, some Business Roles (MX_ROLE) were created and some of the privileges were assigned to those roles. The business roles were assigned to the identities in IDM. As expected, the identities end up in having the privilege directly assigned due to initial load and indirectly assigned via business roles.
Now we would like to clean up the identity store so that privileges coming from a business role are only inherited but not directly assigned. My first thought how to solve this was to query the MXI_LINK table: mcAssignedDirect > 0 && mcAssignedInheritCount > 0. With this result I'd have an toIdentityStore pass with MXREF_MX_PRIVILEGE = {D}{LINKID=%link%}%mskey%
Is this a good idea? I hope that deprovisioning won't start here? Is there any other concept to clean this up?
Best regards
Matthias

Hi Matthias,
Yes it will work, but I will suggest with this MXREF_MX_PRIVILEGE = {D}{LINKID=%link%}%mskey% to use a bypass, so you won't trigger provisioning in IdM.
Example:
MXREF_MX_PRIVILEGE = {D}{BYPASS_MEMBER_TASK=1!!BYPASS_MODIFY_TASK=1!!LINKID=%link%}%mskey%
BR,
Simona

Users are created but Roles are not Provisioned in the Target System

Hi,
It would be great if somebody would provided solution to my problem. The problem is when I try to create the Users in Identity Managment UI then the Users are created in the Target systems but the Roles are not provisioned to the Users.
In the provisioning job SetABAPRole&ProfileForUser,
It is says In the Error putNextEntry failed storing
Exception from Modify operation:com.sap.idm.ic.ToPassException: User does not exist
MSKEY 58437
Please note the When we create the User, the user is created however the Roles is not provisioned to the user.
Regards,
Hakim

Hello Nits,
since this thread is from 2010 and the OP was logged on last in 2012 (as you can see in the profile), I don't think you'll get an answer here.
Please create a new thread to explain your problem (with version and SP numbers, logs etc). You can add a link to this thread to show, that the problem is similar.
Regards,
Steffi.

HOW MANY ROLES ARE ELGIBLE FOR THE USER

hello gurus,
how many roles can we assign to the user... what is the maximum limit of the roles and profiles for the user.
thanks in advance!
sri

Dear Srinivas,
About roles it's indeed not to easy to tell..just imagine the scenario:
1. Maximum number of profile is 312 ... (however due to some known bug system reads about 300). So, let's say 300 profile maximum can be assigned to an user
2. Now you can have single ABAP role which generally one-to-one to profile. So, this theory says if you are only assigning single ABAP roles, you can assign maximum 312 (or 300) roles.
3. But, you might also have Composite ABAP role. A composite ABAP role can have one or more Single/Composite ABAP role. So, one Composite ABAP role can correspond to any number of Profile which is determined by number of individual Single roles under than composite role. So, when you are assiging Composite ABAP role, you have to take care underlying number of profiles and make sure total does not exceed 312 (or 300 without note correction)
4. Now, last part of complication (and my favourite one). Sometimes, there is an empty Role which does not have any ABAP authorization assigned to it. But, this type of roles are used to map a authorization role in JAVA system. These roles does not have any Profile (as it does not have any ABAP authorization). Now, that brings my confusion ..What happens you assign 300 ABAP profiles via ABAP Roles and another 20 empty role for JAVA system without profile. You see my point
Hope this clarifies a bit
Cheers !!
Satya.

Roles are not found after client refresh

Dear Friends,
Yesterday night i had refreshed our 210 client by 220 client in same system by using SCCL Transaction code by logging into target system. I got message as client copy completed successfully. For that i choose profile SAP_CUST.(Because requirement is they need all customization data only).
But after this activity i observe that all user present in system, but some roles are not fount which was present before.
So users face authorization issue.
So please help.
What are post activity after client copy?
Thanks,
Regards,
Sachin

when you mean "the contact is still in the Address Book" you mean you can see in the list on the left hand side column? but you just cannot see it if you search for it via the search field. is that correct?
i have had issues with syncing contacts added to my iphone, in these instances the contact or the info added to the existing contact would not flow through to the mac's AB. I solved this by doing a reset of the iphone in itunes and then syncing again, and from then on things started to work.
also there is an option in itunes in the info pane that let's you select which group a contact is added to on the iphone, if indeed you have and use groups in AB, and of course which groups you would liked synced if you decide not to sync all contacts. you may want to check that these settings are correct and do not somehow screw up a contact added top iphone during the sync... just an idea.
hop this helps

Unable to reset password of user through IDM UI (IDM 7.1)

Hello,
We are unable to reset password of users in SAP Backend System through IDM UI.
The moment we enter new password and submit, we are getting below dump.
Any idea???
java.lang.NullPointerException
at com.sap.idm.wd.wf.task.TaskCompView.onActionSave(TaskCompView.java:172)
at com.sap.idm.wd.wf.task.wdp.InternalTaskCompView.wdInvokeEventHandler(InternalTaskCompView.java:223)
at com.sap.tc.webdynpro.progmodel.generation.DelegatingView.invokeEventHandler(DelegatingView.java:87)
at com.sap.tc.webdynpro.progmodel.controller.Action.fire(Action.java:67)
at com.sap.tc.webdynpro.clientserver.window.WindowPhaseModel.doHandleActionEvent(WindowPhaseModel.java:420)
at com.sap.tc.webdynpro.clientserver.window.WindowPhaseModel.processRequest(WindowPhaseModel.java:132)
at com.sap.tc.webdynpro.clientserver.window.WebDynproWindow.processRequest(WebDynproWindow.java:335)
at com.sap.tc.webdynpro.clientserver.cal.AbstractClient.executeTasks(AbstractClient.java:143)
at com.sap.tc.webdynpro.clientserver.session.ApplicationSession.doProcessing(ApplicationSession.java:333)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doApplicationProcessingStandalone(ClientSession.java:741)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doApplicationProcessing(ClientSession.java:694)
at com.sap.tc.webdynpro.clientserver.session.ClientSession.doProcessing(ClientSession.java:253)
at com.sap.tc.webdynpro.clientserver.session.RequestManager.doProcessing(RequestManager.java:149)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doContent(DispatcherServlet.java:62)
at com.sap.tc.webdynpro.serverimpl.defaultimpl.DispatcherServlet.doPost(DispatcherServlet.java:53)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
at java.security.AccessController.doPrivileged(Native Method)
at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Thanks
Aditi

Hello Aditi,
In AS Java 7.1 and higher you go to short link /nwa and navigate
to Configuration -> Infrastructure -> Java System Properties – Switch to
application tab in second section (Details about <InstanceName>) ->
search for tc~idm~jmx~app.
For 7.0 you have to do that in Visual Admin but I would need to read docu to know where it is too.
But you can find that all in UI installation guide http://service.sap.com/~sapidb/011000358700001233082010E
Regards
Norman

Cluster resource 'Analysis Services' of type 'Generic Service' in clustered role 'SQL Server' failed.

Windows Server 2012 R2
SQL Server 2012
After a recent cluster failover from node 1 to node 2, the Analysis Services role is in a failed state, with the service stopped. When attempting to start the service, there are two error messages captured in Failover Cluster Manager:
Log Name:      System
Source:        Microsoft-Windows-FailoverClustering
Date:          4/10/2014 11:48:49 AM
Event ID:      1042
Task Category: Generic Service Resource
Level:         Error
Keywords:
User:          SYSTEM
Computer:      HQ-HASQL-1.sbgnet.int
Description:
Generic service 'Analysis Services (HASQL)' failed with error '1067'. Please examine the application event log.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-FailoverClustering" Guid="{BAF908EA-3421-4CA9-9B84-6689B8C6F85F}" />
    <EventID>1042</EventID>
    <Version>0</Version>
    <Level>2</Level>
    <Task>16</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-10T15:48:49.752168200Z" />
    <EventRecordID>26212</EventRecordID>
    <Correlation />
    <Execution ProcessID="9036" ThreadID="14748" />
    <Channel>System</Channel>
    <Computer>HQ-HASQL-1.sbgnet.int</Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data Name="ResourceName">Analysis Services (HASQL)</Data>
    <Data Name="Status">1067</Data>
</EventData>
</Event>
Log Name:      System
Source:        Microsoft-Windows-FailoverClustering
Date:          4/10/2014 11:48:49 AM
Event ID:      1069
Task Category: Resource Control Manager
Level:         Error
Keywords:
User:          SYSTEM
Computer:      HQ-HASQL-1.sbgnet.int
Description:
Cluster resource 'Analysis Services (HASQL)' of type 'Generic Service' in clustered role 'SQL Server (HASQL)' failed.
Based on the failure policies for the resource and role, the cluster service may try to bring the resource online on this node or move the group to another node of the cluster and then restart it. Check the resource and group state using Failover Cluster
Manager or the Get-ClusterResource Windows PowerShell cmdlet.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
    <Provider Name="Microsoft-Windows-FailoverClustering" Guid="{BAF908EA-3421-4CA9-9B84-6689B8C6F85F}" />
    <EventID>1069</EventID>
    <Version>1</Version>
    <Level>2</Level>
    <Task>3</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2014-04-10T15:48:49.752168200Z" />
    <EventRecordID>26213</EventRecordID>
    <Correlation />
    <Execution ProcessID="6464" ThreadID="9076" />
    <Channel>System</Channel>
    <Computer>HQ-HASQL-1.sbgnet.int</Computer>
    <Security UserID="S-1-5-18" />
</System>
<EventData>
    <Data Name="ResourceName">Analysis Services (HASQL)</Data>
    <Data Name="ResourceGroup">SQL Server (HASQL)</Data>
    <Data Name="ResTypeDll">Generic Service</Data>
</EventData>
</Event>
With just these generic error messages being present, this has been difficult to diagnose. Some research has yielded possible resolutions of the Event Viewer log being full, .NET corruption, missing registry entries, but none of those seem to be the issue
(Event Viewer logs cleared, Analysis services is working on the same physical servers in a different cluster, and the registry entries was only a supported issue for SQL Server 2008 and 2008 R2).
Any help would be greatly appreciated.

Bring up Configuration Manager, look at binary path for SSAS. Make sure BOTH folders exist. Sometimes with failovers mappings get screwed up.

Can KM Document iView be used through Remote Role in Federated Portal?

I have a Producer Portal and a Consumer portal using Remote Role Assignment. In the same remote role, the KM Navigation iView is working fine, but the KM Document iView is giving http 400 error (The webpage cannot be found). I understand normally we should put KM on the consumer. But some of our KM document iViews are used in the roles in the BI portal, which is the producer.
I cannot find SAP document or notes that tells "If KM Document iView is supposed to work through Remote Role". If you could clarify for me, I will know if it's worthwhile to troubleshoot the issue.
Thanks,
Fubo Liu

Hi Fubo,
There are no restrictions regarding the KM documents iView in the Central Note regarding FPN: [880482|https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/oss_notes/sdn_oss_ep_pin/~form/handler%7B5f4150503d3030323030363832353030303030303031393732265f4556454e543d444953504c4159265f4e4e554d3d383830343832%7D]
So this should work fine.
Best regards,
Robert

Grant privileges to subprogram via role: should not work?

I bought Selftestsoftware for 1z0-147 for 9i and 10g. Selftestsoftware is endorsed by Oracle, should be high quality.
But its below sample question and answer seem to be wrong: It says that privilege for subprogram can be granted via role. But from Urman 9i book, all roles are disabled inside stored procedures.
Did Selftestsoftware made a mistake? Or the question did not mention or assume that the subprogram is based on invoker rights not definer right?
Question:
All users in the HR_EMP role have UPDATE privileges on the EMPLOYEE table. You create the UPDATE_EMPLOYEE procedure. HR_EMP users should only be able to update the EMPLOYEE table using this procedure.
Which two statements should you execute? (Choose two.)
GRANT UPDATE ON employee TO hr_emp;
GRANT SELECT ON employee to hr_emp;
REVOKE UPDATE ON employee FROM hr_emp;
REVOKE UPDATE ON employee FROM public;
GRANT EXECUTE ON update_employee TO hr_emp;
Explanation:
The two statements you should execute are:
REVOKE UPDATE ON employee FROM hr_emp;
GRANT EXECUTE ON update_employee TO hr_emp;
Unless you are the owner of the PL/SQL construct, you must be granted the EXECUTE object privilege to run it or have the EXECUTE ANY PROCEDURE system privilege. By default, a PL/SQL procedure executes under the security domain of its owner. This means that a user can invoke the procedure without privileges on the procedures underlying objects. To allow HR_EMP users to execute the procedure, you must issue the GRANT EXECUTE ON update_employee TO hr_emp; statement. To prevent HR_EMP users from updating the EMPLOYEE table unless they are using the UPDATE_EMPLOYEE procedure, you must issue the REVOKE UPDATE ON employee FROM hr_emp;
All of the other options are incorrect because they will not meet the specified requirements.
Edited by: user13270686 on Jun 7, 2010 9:22 PM

The answer is correct, and the explanation complete.
Inside stored procedures roles are disabled. This is because privileges are checked at compile time and roles can change between compile time and execute time.
However, privilege to execute the procedure can be granted to a role. During execution of the procedure the privileges of the procedure's owner apply.
This is because you want to have encapsulation: when tables and procedures are in the same schema, you won't have any privilege problem, as the owner of a set of tables will always have privilege (you can not revoke them).
Sybrand Bakker
Senior Oracle DBA

Cluster resource 'SQL Network Name (SQLCLUS1)' of type 'Network Name' in clustered role 'SQL Server (DB1)' failed.

Cluster resource 'SQL Network Name (SQLCLUS1)' of type 'Network Name' in clustered role 'SQL Server (DB1)' failed.
Based on the failure policies for the resource and role, the cluster service may try to bring the resource online on this node or move the group to another node of the cluster and then restart it. Check the resource and group state using Failover Cluster
Manager or the Get-ClusterResource Windows PowerShell cmdlet.
I keep getting this error message. Can someone please help. Thank You.
Kranp.

Hi Kranp,
As the issue is more related to Windows Server high availability
, I recommend you post the question in the
Windows Server High Availability (Clustering)
forum. It is appropriate and more experts will assist you.
Besides, there are similar threads regarding to the above error for your reference.
2012 Cluster service name failing
SQL 2012 Failover Cluster - unable to start because
of 'Network Name' failed
Issues with resource creation on W2K12 SQL
failover cluster, confirm procedures
Thanks,
Lydia Zhang
Lydia Zhang
TechNet Community Support

Profile Type Privilege Assignments through IDM roles are stuck in Pending State

Similar Messages

Maybe you are looking for