Proper user and group rights

Dear readers and admins
My question is about the "correct" setting of the user and group rights, so the following is possible. It relates to Server 10.3 and to 10.4.
Requirements:
Group 1 = "Regular user"
Group 2 = "Administration, Accounting"
User 1 and 2 belong to Group 1, users 3 and 4 belong to Group 2.
User 1 & 2 must have read/write access to files and folders in Group 1, but may not have access to files and folders of Group 2.
User 1 & 2 must be in a position of creation and deletion of file and directory of Group 1, as if they were their own files and directories. I.e. User 2 must be in a position to delete or change files and directories that an other user of Group 1 has created.
User 3 & 4 must have read and write access to files and directories of Group 1 & 2. They must be able to creating and changing such files and directories, as if they were their own files and directories. I.e. User 3 & 4 must be able to create and change files and directories which belong to user 1 & 2.
As I understand it, this can be achieved with ACL's under Server 10.6.
Am I right?
What would such a structure look like with ACL's?
I unfortunately don't have a server 10.6 running, as, down due to technical problems, my server is down.
Thank you in advance for your help.
All a happy new year.
Regards
Thomas Thaler

Yes - and it's pretty easy.
1. You would create whatever share points you would like (very easy to do)
2. You would make sure in Workgroup Manager you have the users assigned to the correct groups that you discussed.
3. On the folders for Group 1 you would add ACL permissions of Full Control for Group 1 and Full Control for Group 2.
4. On the folders for Group 2 you would add an ACL permission of Full Control for Group 2.

Similar Messages

User and group mapping on IPSEC EZVPN.

Hello,
I set up an ASA5520 vpn gateway for ezvpn. one ACS4.2 server is used to authenticate the vpn user.
there are 4 groups in the vpn configuration. each group has different group policy .
everything is working well.
now, one more requirement arise:
the users should be locked in corresponding group, that means, user A belons group A, so, he can only uses group A's profile.
if he uses group B's profile, the authentication will fail. Even though the group profiles are on same ASA5520, and the user information is correct in ACS.
I'd like to solicit you advice on that feature, is there a way to do that?

If I recall correctly, there is no inheritance of user and group rights in PT, at least not in 5.x. If you give some rights on a specific object/folder to a specific group, then it will be for that object only and none of its children.
You do have a choice of propagating of user rights down the ownership tree however. I.e., if you select a community and set some rights for yourself, it will prompt you if you want to propagate the same permissions down the chain, to all of its children. If you say yes, it will replacepermissions on all its children by creating copies. If you say no, you'll have to go and apply different permissions on each child individually.
Ruslan.

User and group security

Not sure if this fits here, but here goes...
I have a subportal folder, with a community in side. Inside the community, I have groups. If I give one group the admin level authority, is it just for that community and all of its content, or is it the whole portal. The admin docs are very granular on user and group security throughout the various ways of applying it. WHat I am trying to do is give a group admin control over a singel community as well as full admin control of all groups in the communities admin folder. BUT just those things.
thanks

If I recall correctly, there is no inheritance of user and group rights in PT, at least not in 5.x. If you give some rights on a specific object/folder to a specific group, then it will be for that object only and none of its children.
You do have a choice of propagating of user rights down the ownership tree however. I.e., if you select a community and set some rights for yourself, it will prompt you if you want to propagate the same permissions down the chain, to all of its children. If you say yes, it will replacepermissions on all its children by creating copies. If you say no, you'll have to go and apply different permissions on each child individually.
Ruslan.

Using users and groups from LDAP in ADF application

Hi there,
I'm using WebLogic Server 10.3.5.0 and JDev 11.1.2.3.0.
I configured my WL server to use the users and groups defined in my LDAP server (they display when I select the Users or Groups tab). So this works fine (I think).
Now I want to use 1 group, let's call the group ApplicationGroup, and all it's users to give them access to my ADF Application.
But I can't find proper/up-to-date info about how to do this.
I tried 2 major things:
1) I configured ADF Security to use Authentication and Authorization. Defined an Enterprise Role with the same name as in my WL server (so ApplicationGroup) then defined a
Application Role with a custom name and added the Enterprise Role to it. That Application Role I gave access to all my TF's and Web Pages. When I deploy this, It just doesn't work (Migrate Users and Groups is not checked).
2) Used the Authentication option in the ADF Security and the rest is the same as in 1). This works +-, I can login with all users so the role mapping isn't configured right I guess?
Any help or documentation that could help me?

Since we aren't using EM I had to find an other way. And I found it.
In web.xml ADF Security (I suppose) automaticly adds 'valid-users'. In my weblogic.xml I added my enterprise role as a principal to 'valid-users' and this works for me.
Thanks for the help.

How to change default /Users and /Groups to different Volume?

Users are created in /Volumes/<boot>/Users and groups in /Volumes/<boot>/Groups.
We need these to be created on a different volume, eg., /Volumes/External/Users, and /Volumes/External/Groups.
Setup Assistant correctly put user Backups into */Volumes/External/Shared Items/Backups* and also correctly put web services on /Volumes/External/ServiceData -- we want to do the same for Groups and Users.
Groups are the most critical, as the group needs bulk storage. Users we could leave as is if it can't be done.
How can this be configured? We've read File Server Admin, Open Directory Admin, and Advanced Server admin from http://www.apple.com/server/macosx/resources/documentation.html without finding an answer.
Thanks in advance.

1. Create new folders on the external volume to hold users and groups, but to prevent confusion name them something other than "Users" and "Groups". /Volumes/External/NetUsers and /Volumes/External/NetGroups would be reasonable choices.
2. Share both of these folders (in Server Admin -> server name in sidebar -> File Sharing -> Volumes & Browse modes -> select each folder -> click Share near the top right).
3. Enable both folders for automounting on clients (Server Admin -> server name in sidebar -> File Sharing -> Share Points-> select each folder -> Share Point tab under that -> Enable Automount option) with the default options (Directory: /LDAPv3/127.0.0.1, Protocol: AFP, Use for: User home folders and group folders). Be sure to click Save (not just OK in the dialog).
4. To migrate users, run Workgroup Manager, and change the home location for the users you want to move (select Accounts in the toolbar -> /LDAPv3/127.0.0.1 from the hidden pop-up menu under that -> User icon tab at the left -> select the user(s) you want to change -> Home tab on the right -> select the NetUsers option from the "Where" list). Then, for each user, run this command on the server: "sudo cp -Rp /Users/username /Volumes/External/NetUsers".
5. Similarly, move Group folders in WGM (Accounts -> /LDAP... -> Groups icon on left -> select groups to move -> Group Folder tab on right -> NetGroups in the list). Then, for each group, run "sudo cp -Rp /Groups/groupname /Volumes/External/NetGroups".
6. Test to make sure all is working before deleting the old user and group folders from /Users and /Groups (do NOT delete /Users and /Groups themselves, just the individual folders from under them).

WINDOWS 8.1 - System Tools no longer displaying User and Group Settings after adding a new LOCAL user.

I jumped on my parents computer, which is on a domain. I added a new local user(with my live.com login) and gave it admin status. That's when the trouble began.
The main user profile disappeared. I used the command prompt fix (see other fixes) to add the missing user back into admin. I logged back in, and it set up the account for the first time (WTF?). I cannot access any files from the main account
(that I logged into just fine before to get this debacle started.)
When going to Local Computer Management --> System Tools, my users and groups tool is missing.
I ran lusrmgr.msc only to find out that the most current version of Windows 8.1 and this is what it said "This snapin may not be used with this edition of Windows 8.1. To manage user accounts for this computer, use the User Accounts tool in the
Control Panel." <---- Awesome! (that was sarcasm.)
I have spent over two hours in the User Account tool during the course of this problem only to prove that a picture of a computer is more useful that that "tool".
To anyone reading this ticket, the best advice I can offer you (as long as its not a crucial machine) is to back up what you can gain access to, format your hard-drive and reinstall windows and start over again. I wouldn't recommend reinstalling 8.1,
I would say go back to 7 and wait until 10 comes out. Windows 8 is the new Vista. Good luck!

Hello AhavahOlam,
I can understand your feelings.
If my understanding is right, after adding a new local user in domain-joined Windows 8.1, you can’t open the local users and groups.
Can you still add account by going to Control Panel\User Accounts and Family Safety\User Accounts\Manage Accounts?
As this computer is domain-based, it is recommended to contact the domain administrator to see if the option is blocked.
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

WLS Users and Groups interface questions / observations

I'm new to WLS, having just installed OBIEE 11g for the first time. There are some oddities in WLS around setting up Users that I'd like to ask about, to see if I'm just missing something, or if the interface really IS this bad. Please feel free to comment in any way, or to correct any statements that are erroneous. Here goes:
1. The use of Previous and Next buttons instead of a vertical scroll bar for finding users and groups in their respective lists. What if you have several hundred users, and the one you want to modify starts with the letter 'Z'? That means clicking the Next button several dozen times. (Security Realms … myrealm … Users and Groups … Users) Not only is there no scroll bar, there's no search box either. The only way to get to a user near the end of the alphabetical listing is the Next button. Is that correct?
2. After adding a new user, what's the next most logical thing to want to do? How about assigning that user to Groups? So why do I have to click Next several times to find that new user in the alphabetical list? I don't see a sortable 'Date Modified' field for the table of users, nor a link to the "Most Recently Added" user. Nor can I assign groups during the same action as creating the user. In the example in #1, I might have to click Next several dozen times to get to the user I just added. Is that correct?
3. When creating a new User, immediately after clicking New, where is the most likely place that I'd want to go? How about the Name field? Right now, the cursor rests in some indeterminate location. I have to hit the Tab key 14 times, or move the mouse into the Name box and click it. The active cursor position does not default to the Name box when creating a new user. Is that correct?
4. I don't see a 'Create Like' button for creating Users, so that existing group membership can be easily replicated. I'd like to be able to add a new employee by clicking to highlight an existing user from the same department, clicking a 'Create Like' button, then entering a new user name and password, with all group memberships assigned automatically based on the source user. The same could be said for replicating groups. I don't think that exists. Is that correct?
5. I don't see a clean way to return to the User list on the page on which I clicked a user name. Imagine that I'm going through my entire list of users one at a time to set an attribute. I click on the user JSMITH and set the attribute. The only way to get back to JSMITH's page and select the next user list is to hit the browser's back button three times, or to click the Users and Groups breadcrumb at the top of the screen and use the Next link multiple times to find that page again. Is that correct?
6. I don't see a way to bring up a Group and assign Users to it from a list. It appears that the only way to assign a User to a Group is to access a User profile and click Groups. If we're creating a new group that has 200 users selected from a list of 500 users, that could potentially represent somewhere between 5000 and 10000 mouse clicks. It would be much more efficient to be able to bring up a group, then select its members from a list of users. That does not appear to be possible. Is that correct?
7. It also appears that when assigning groups for Users, the list of Available Parent Groups sorts the lowercase entries after all uppercase entries, so that groups that start with the letter 'a' fall after groups that start with 'Z'. That is not the case with the list of users. The User table uses a case-insensitive sort. Is that correct?
8. When I want to delete more than one User, and the ones that I want to delete are on different pages, there appears to be no way to select those users from multiple pages at the same time. So, imagine that I have 500 users, and I want to delete two users, one of whom is listed on page 48, and the other on page 50. I would have to click the Next button 47 times to find the first user and delete it. At that point, the interface returns to page 1, and I have to click the Next button 49 times to reach the second user. Is that correct?

Hi,
Regarding your first question, you might want to press the "Customize this table" button, then select the maximum allowed amount of rows in "Number of rows displayed per page:" that would resolve some of the problems you're having with the interface. I do think this is not a great graphical tool, and there are some usability issues.
Regarding the adding of users to groups, it seems the way you describe is the only way of doing it, however you could try using a script instead of the graphical console, the easiest way of making it is adding a user to a group while using the "Record" button on the top of the screen to get a wlst script to use as a model, then create a new script with all new users you want to add/modify.
Regards,
Franco.

Could we have same name's for User and Groups in Active directory

When iam trying to create a user name " Logistics " under a OU, I am getting a error
"The pre-windows 2000 logon name you have chosen is already in use in this domain. Choose aother pre-windows logon name, and then try again"
We already have a group by the name " Logistics "
Could we have same name's for User and Groups in Active directory?
Thanks in Advance

sAMaccountName attribute is unique. So, the short answer is you cannot.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Why do I have so many Users and Groups (RDN) on my computer?

I have had trouble viewing certain documents. I've been told I don't have permission. When I checked the Users, I find a list of Users and Groups that I'm unaware of. My computer should only be used by myself and my daughter. How do I know which Users to
keep, and which to get rid of? How do I delete unwanted users? I do belong to a group. My computer was given to me by my former employer. Does he still have access to my files?
These are the additional users and Groups listed on my computer...
Account Manager 101
Administrator
Administrators
ANONYMOUS LOGON
Authenticated Users
Backup Operators
Batch
CONSOLE LOGON
CREATOR GROUP
CREATOR OWNER
Cryptograph Operators
Dialup
Distributed COM Users
Event Log Readers
Everyone
Guest
Guests
Homegroupusers$
HomeUsers
IIS_IUSRS
INTERACTIVE
IUSR
Local Account
Local Account and Member of Administrators Group
LOCAL SERVICE
Mackenzie Victor
NETWORK
Network Configuration Operators
NETWORK SERVICE
OWNER RIGHTS
Performance Log Users
Performance Monitor Users
Power Users
Remote Desktop Users
REMOTE INTERACTIVE LOGON
Replicator
SERVICE
SYSTEM
TERMINAL SERVICE USER
This Organization Certificate
Users
Some of which have access to my folders, others do not. Is this something that should concern me?

I have had trouble viewing certain documents. I've been told I don't have permission. When I checked the Users, I find a list of Users and Groups that I'm unaware of. My computer should only be used by myself and my daughter. How do I know which Users to
keep, and which to get rid of? How do I delete unwanted users? I do belong to a group. My computer was given to me by my former employer. Does he still have access to my files?
These are the additional users and Groups listed on my computer...
Account Manager 101
Administrator
Administrators
ANONYMOUS LOGON
Authenticated Users
Backup Operators
Batch
CONSOLE LOGON
CREATOR GROUP
CREATOR OWNER
Cryptograph Operators
Dialup
Distributed COM Users
Event Log Readers
Everyone
Guest
Guests
Homegroupusers$
HomeUsers
IIS_IUSRS
INTERACTIVE
IUSR
Local Account
Local Account and Member of Administrators Group
LOCAL SERVICE
Mackenzie Victor
NETWORK
Network Configuration Operators
NETWORK SERVICE
OWNER RIGHTS
Performance Log Users
Performance Monitor Users
Power Users
Remote Desktop Users
REMOTE INTERACTIVE LOGON
Replicator
SERVICE
SYSTEM
TERMINAL SERVICE USER
This Organization Certificate
Users
Some of which have access to my folders, others do not. Is this something that should concern me?
I have something the same only mine is a new pc who can I trust

Custom User and Group classes

Hi,
I have a login custom module which does the authentication for my application.
Till now I was using WLSUserImpl and WLSGroupIpml and everything was working fine.
Now to make the LoginModule weblogic independent , I replaced the User and Group
classes with my own classes which extend from java.security.Principal.
But for some reason this isnt working. Am I missing something obvious.??
This the exception stack trace which I get
java.lang.SecurityException: [Security:090398]Invalid Subject: principals=[com.isone.security.providers.authentication.ISOUser@1698cbe,
com.isone.security.providers.authentication.ISOGroup@9719f4, com.isone.security.providers.authentication.ISOGroup@28ebb4,
com.isone.security.providers.authentication.ISOGroup@8ab721, com.isone.security.providers.authentication.ISOGroup@fcf06c,
com.isone.security.providers.authentication.ISOGroup@c7539, com.isone.security.providers.authentication.ISOGroup@1e41830,
com.isone.security.providers.authentication.ISOGroup@1f01b29, com.isone.security.providers.authentication.ISOGroup@8721bd,
com.isone.security.providers.authentication.ISOGroup@1b81d4f, com.isone.security.providers.authentication.ISOGroup@8c6e04,
com.isone.security.providers.authentication.ISOGroup@18aeabe, com.isone.security.providers.authentication.ISOGroup@13968f1,
com.isone.security.providers.authentication.ISOGroup@18c28a, com.isone.security.providers.authentication.ISOGroup@18bff68,
com.isone.security.providers.authentication.ISOGroup@2d2da4]
     at weblogic.security.service.SecurityServiceManager.seal(SecurityServiceManager.java:682)
     at weblogic.security.service.RoleManager.getRoles(RoleManager.java:279)
     at weblogic.security.service.AuthorizationManager.isAccessAllowed(AuthorizationManager.java:694)
     at weblogic.servlet.security.internal.WebAppSecurity.hasPermission(WebAppSecurity.java:567)
     at weblogic.servlet.security.internal.SecurityModule.checkPerm(SecurityModule.java:134)
     at weblogic.servlet.security.internal.FormSecurityModule.checkUserPerm(FormSecurityModule.java:327)
     at weblogic.servlet.security.internal.SecurityModule.beginCheck(SecurityModule.java:182)
     at weblogic.servlet.security.internal.FormSecurityModule.checkA(FormSecurityModule.java:181)
     at weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:145)
     at weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:3539)
     at weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2585)
     at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:197)
     at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:170)

And this will explain you why there is no way to do this right now:
(CR125681 -- although it says 7.0SP1 it is not fixed even in 8.1 SP2 and
there is no time frame for the fix)
http://support.bea.com/application?namespace=askbea&origin=ask_bea_answer.jsp&event=link.view_answer_page_clfydoc&answerpage=solution&page=wls/S-21705.htm
We've had the same issue and even have an open support case and for now
the only way to workaround the bug is to
use the WLSUserImpl and WLSGroupImpl classes.
HTH,
Dejan
Pavel wrote:
See if this will help:
http://edocs.bea.com/wls/docs81/dvspisec/pv.html
Pavel.
"Anil" <[email protected]> wrote:
I actually extended PrincipalValidatorImpl and returned java.security.Principal
as the base class.
But still I got the same exception.
PaulF <paulf@reply_in_newsgroup.com> wrote:
On 25 Feb 2004 06:45:50 -0800, Anil <[email protected]> wrote:
Hi,
I have a login custom module which does the authentication for my
application.
Till now I was using WLSUserImpl and WLSGroupIpml and everything was
working fine.
Now to make the LoginModule weblogic independent , I replaced the
User
and Group
classes with my own classes which extend from java.security.Principal.
But for some reason this isnt working. Am I missing something obvious.??
This the exception stack trace which I get
java.lang.SecurityException: [Security:090398]Invalid Subject:
principals=[com.isone.security.providers.authentication.ISOUser@1698cbe,
com.isone.security.providers.authentication.ISOGroup@9719f4,
com.isone.security.providers.authentication.ISOGroup@28ebb4,
com.isone.security.providers.authentication.ISOGroup@8ab721,
com.isone.security.providers.authentication.ISOGroup@fcf06c,
com.isone.security.providers.authentication.ISOGroup@c7539,
com.isone.security.providers.authentication.ISOGroup@1e41830,
com.isone.security.providers.authentication.ISOGroup@1f01b29,
com.isone.security.providers.authentication.ISOGroup@8721bd,
com.isone.security.providers.authentication.ISOGroup@1b81d4f,
com.isone.security.providers.authentication.ISOGroup@8c6e04,
com.isone.security.providers.authentication.ISOGroup@18aeabe,
com.isone.security.providers.authentication.ISOGroup@13968f1,
com.isone.security.providers.authentication.ISOGroup@18c28a,
com.isone.security.providers.authentication.ISOGroup@18bff68,
com.isone.security.providers.authentication.ISOGroup@2d2da4]
     at
weblogic.security.service.SecurityServiceManager.seal(SecurityServiceManager.java:682)
     at weblogic.security.service.RoleManager.getRoles(RoleManager.java:279)
     at
weblogic.security.service.AuthorizationManager.isAccessAllowed(AuthorizationManager.java:694)
     at
weblogic.servlet.security.internal.WebAppSecurity.hasPermission(WebAppSecurity.java:567)
     at
weblogic.servlet.security.internal.SecurityModule.checkPerm(SecurityModule.java:134)
     at
weblogic.servlet.security.internal.FormSecurityModule.checkUserPerm(FormSecurityModule.java:327)
     at
weblogic.servlet.security.internal.SecurityModule.beginCheck(SecurityModule.java:182)
     at
weblogic.servlet.security.internal.FormSecurityModule.checkA(FormSecurityModule.java:181)
     at
weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:145)
     at
weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:3539)
     at
weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2585)
     at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:197)
     at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:170)
I think that you need to extend WLSAbstractPrincipal I think instead
of
WLSPrincipal if you aren't going to implement your own
PrincipalValidator. The default PrincipalValidator is going to expect
a
principal that extends WLSAbstractPrincipal.
PaulF
Using M2, Opera's revolutionary e-mail client: http://www.opera.com/m2/

Import user and group from dump.txt to ACS Solution Engine 3.3

I have export the user and group using the CSUtil -d on my acs v2.6. But ACS Solution Engine 3.3 does not have the CSUtil command to import the user and group database. Can anyone advise me?

I'm trying to do the same thing with no luck so far.
Documentation seems to indicate you can do this using RDBMS Synchronization but we haven't got it to work yet.
I read the doco as saying you create a csv and place it on an FTP server and ACS will read from that file. When we've tried, it rights its own file with a different extension and says it can't find the one we place in that same directory.

Manage users and groups on 10.5 client like 10.5 server?

can anyone recommend software for managing local users and groups on 10.5 client? we only need filesharing and don't need the added expense of OS X Server.
thanks

oh, right. we can add users with the File Sharing pref pane and can add groups under the Accounts pref pane.
i'm assisting a friend reconfigure a 'server' (os x client box) that was damaged.
i'd like to create a new group and then add a handful of users to that group for filesharing. these users don't really need to access the mac for local login.
they are using Windows Vista from the clients and the way it's set up now, if a user connects and modifies/creates a file, no one else can then modify the file. we have to run chmod on the file/directory for everyone to be able to change it. i'd like to configure it so the permissions work correctly without having to do this.

Hi I do not want iTunes to open up automatically when I turn on my macbook pro. I tried going to System Preferences Users and Groups Login Items and then I took iTunes off the list but it still opens up automatically when I turn on my laptop.

Hi I do not want iTunes to open up automatically when I turn on my macbook pro. I tried going to System Preferences>Users and Groups>Login Items and then I took iTunes off the list but it still opens up automatically when I turn on my laptop. What should I do?

Hi r,
Make sure you close iTunes before shutdown. And you're quite welcome.

I am trying to stop programs from opening automatically when I turn my computer on. I tried system preferences users and groups login items...then I deleted them from the list but it did nothing.

I am trying to stop programs from opening automatically when I turn my computer on. I tried system preferences>users and groups>login items...then I deleted them itunes and emial from the list but it did nothing. They continue to open up every time I turn on my Macbook Pro.

Hi r,
It sounds like you're running Lion?
Have you tried running Verify and/or Repair Disk?
Have you tried running Repair Permissions?
Do you have at least 15% free space available on your HD?

Generate report to show all users and groups in Shared Services in EPM 11x

Hi,
Is there any way to generate a report (like a migration report or job status report) which can be generated through workspace/shared services 11.1.1.3 so that my admin can look at all the users and groups created. Something that I can view and probably print out? Any suggestions?
~Adeeba

Yes, I knew this one. This basically shows me the users and groups assigned specific provision access. Is there any way to view a report that shows which users and groups have access to dimensions of an individual planning application?
~Adeeba

Proper user and group rights

Similar Messages

Maybe you are looking for