Restrict access to show isdn active

I have a number of users which we only want to allow them to use "show isdn active". What would be the correct method to do this conisdering we use Cisco ACS for AAA?
Thanks

Use TACACS+ and command authorization. You will need to set up a generic command authorization set that allows all commands and one command authorization set that rejects any command except "show isdn active". You will also have to configure each network device to handle T+ command authorization.

Similar Messages

Problem with "show isdn active " command AS5400

When i type "show isdn active " to see the actice voice calls , sometimes i dont se the calls , but my network management tool is showing me that there are active calls . I have check on the other side from where im sending the calls and i see the calls
Ewerything else is looking normal.
Details :
AS5400
IOS Version 12.3(4)T
Who knows what happens?
Thx , Cristi

May be due to the bug CSCea54139 which is fixed in 12.3(5.4) 12.3(5.5)T

ToJSONString Showing Up in Restrict Access to Page List

Working in DW CS3 with ADDT using PHP and MySQL. I'm having a issue which I don't think I had before when I use the Restrict Access to Page server behavior. I'm working with user access levels pulled from the 'levels' field in my database and everything appears to be working as expected. I can select any number of available integers to restrict access to those pages. However, I've noticed that if I go back to edit that list of access levels, a new entry appears below the last integer in the list called "toJSONString". (toJSONString does not show up when I initially add the server behavior, only if I go back in to change it).
I did a quick search and turned up this info:"The JSONString interface allows a toJSONString() method so that a class can change the behavior of JSONObject.toString(), JSONArray.toString(), and JSONWriter.value(Object). The toJSONString method will be used instead of the default behavior of using the Object's toString() method and quoting the result." Unfortunately, I don't understand any of that.
I don't know why toJSONString is showing up in the list and if I should be concerned. (Mac OS 10.5.5; DW CS3 (v( Build 3481] and ADDT 1.0.0)

tyler4iq wrote:
> OK. I'm trying to authenticate users through a log in
page, but it always fail.
It's a known bug in MX 2004:
http://friendsofed.infopop.net/2/OpenTopic?a=tpc&s=989094322&f=8033053165&m=324102421
David Powers, Adobe Community Expert
Author, "Foundation PHP for Dreamweaver 8" (friends of ED)
Author, "PHP Solutions" (friends of ED)
http://foundationphp.com/

HT201304 I need to restrict access to Settings on an iPad so settings like VoiceOver cannot be activated while letting them access multiple apps on the device. Is their any way to restrict access to settings without locking the device with a PIN?

I need to restrict access to Settings on an iPad so settings like VoiceOver cannot be activated while letting them access multiple apps on the device. Is their any way to restrict access to settings without locking the device with a PIN?
This is so our guests cannot tamper or disable the device. We are already using Apple Configurator but their does not seem to be a way to lock down settings without a PIN.

There's a lot of restrictions information in Chapter 19 of the 4.2 User Guide.
http://support.apple.com/manuals/#ipad
By the way, a more extensive version of the User Manual is available at no charge through iBooks.

Restrict access to rows in tables using S_TABU_LIN

Hello
Is it possible to use this authorization object to restrict access to rows in data tables, based on role?
Namely, a query is created for table holding financial documents data, and I would like users in charge of one company code, to only be able to see rows relating to that company code when they execute the query.
I have defined and activated an organization criteria, and included it in the role authorization data restricted to only one company code value, but the user is still able to see all rows in the table.
The system trace doesn't show a check for the S_TABU_LIN Object while the user is executing the query.
Can anyone tell me what I'm missing?
Thanks in advance
A.

If you activate S_TABU_LIN, whenever that org criterion is hit with table data being retrieved then the check will be performed. If it is a standard SAP table field then that could potentially become problematic depending how you set it up.
By extending the security in the infoset query you are turning the query from a quick and dirty tool to extract data into something that you can control as you would a bespoke report. Once your dev team have worked out what they need to do, you can apply the standard auth concept to queries with relative ease and without impacting other parts of your security.
Another thing to mention is that if your developers use logical databases to retrieve query data then there is usually auth checks incorporated in there (which don't show up in SU53 or ST01).

ASA WebVPN. How do you restrict access to users in an AD group using LDAP?

Hi All,
I am trying to configure separate WebVPN connection profiles to give different portal bookmark contents to users based on their AD group membership. This has been very difficult, even though I beleive it should be easy.
The login page of teh ASA by default has a dropdown to allow default users to access the default portal and the SSL VPN client connection.
There are two other portals that I would like to restrict access to based on AD group membership. I have set these up to be selected by URL.
The biggest problem is, I have no way of knowing how to go about this. The AAA LDAP options show a group membership search, which I have configured, but I cannot say "Profile X is restricted to AD group CarpetBaggers", so that if soneone that is NOT a carpetbagger tries to log in, it fails.
I can only do an all or nothing scenario.
It would be nice to use Dynamic Access Policies to do this, and I have created a few, but they do NOT seem to work when the drop down aliases or URLs are in use. So how do I go about using them in this scenario? Turning off the aliases or URLs is not really an option right now.
Scenario 1 would work the best for me. Restrict access to profiles/groups based on AD group membership using LDAP.
Scenario 2 would be an ideal longer term solution.
Any thoughts, ideas or assitance would be greatly appreciated.
Cheers

This is exactly what i was looking for, and Nelson is correct. When you enter the DAP configuration for a profile click on "Advanced" and there is the option to create a logical expression. The guide (ther is a button to access this) is really helpful, with a couple of examples. This is what i used:
assert(function()
   if ( (type(aaa.ldap.distinguishedName) == "string") and
        (string.find(aaa.ldap.distinguishedName, "OU=Users") ~= nil) )
then
       return true
   end
   return false
end)()
from the debug dap you can see what Users relates to;
DAP_TRACE: Username: MyUsername, aaa.ldap.distinguishedName = CN=Mr B,OU=Users,OU=Site ******,DC=CH,DC=Mycompany,DC=com
My admin account fails to get me in to the same profile:
DAP_TRACE: dap_add_to_lua_tree:aaa["ldap"]["distinguishedName"]="CN=Admin Mr B,OU=Admin Users,OU=Site *****,DC=CH,DC=Mycompany,DC=com"
Thanks
Andrew

How to restrict access in 2008?

How to restrict access in 2008?
So, I would like to do the 2 following things:
1. Grant developers access to read all Active Form Comonents
2. Create new Form Groups
3. Not be able to change nS Resticted AFC
and
1. Grant developers rights to Create Ous
2. Add/Rmeove Members to OUs
3. Remove rights to add/remove to/from Site Admin OU
Any suggestions on how to do that?
So far I tried the out of the box Capabilities and Permissions, created custome ones, but still no luck in accomplishing all 3 items.

Your request #1 is not possible. In paticular, you can't create new form groups and still not be able to change all form groups. Please submit an enhancement request, asking that newScale support your desired role configuration.
Similar problem with #2.

How to restrict access to views for some users in the app?

Hi SDN!
I have an WD application wich embedded in the portal. Appication has 2 iViews (and 2 pages respectively). These iViews consist several views connected with each other (e.g. one view provide list data, second view is add/edit form for this data). I need to restrict access for some users for view with add/edit form. I can't make separate page for this view.
What I've done:
1) create yet another UIContainer for this view in main window and embed view to this container. It was be done for create separate iView for form.
2) in the portal I create iView for this form but don't embedd in any page.
When I try to call my form from list data (that is one iView from another) I get exception:
<b>com.sap.tc.webdynpro.services.exceptions.WDRuntimeException: duplicate usage of view .MyCarRentalAddCity</b>
Is there a way to get needed functional?
Thanks,
Lev

Hi,
do you need to remove the IView from the portal menu or do you just want to make a View container in your WD application invisible if the user doesn't have the rights to see it.
If so, you could create your own roles on the app server:
You need to create a new class that extends NamePermission like:
import com.sap.security.api.permissions.NamePermission;
public class ApplicationAccessPermission extends NamePermission {
           * @param name
          public ApplicationAccessPermission(String name) {
               super(name);
           * @param name
           * @param action
          public ApplicationAccessPermission(String name, String action) {
               super(name, action);
Also, you have to create an Action.XML file that looks like this:
<BUSINESSSERVICE
     NAME="com.vendor.administration">
     <DESCRIPTION
          LOCALE="en"
          VALUE="actions view usage"/>
     <ACTION
          NAME="View Permission">
          <DESCRIPTION
               LOCALE="en"
               VALUE="Show view"
               />
          <PERMISSION
               CLASS="com.vendor.utilities.ApplicationAccessPermission"
               NAME="ShowView"
               />
     </ACTION>
</BUSINESSSERVICE>
If you have created these to files in your packages, you can access this function like:
IUser user ;
try {
          user = WDClientUser.getCurrentUser().getSAPUser();
          if(user.hasPermission(new ApplicationAccessPermission("Show view"))){
               wdContext.currentV_UIElement().setViewVisibility(WDVisibility.VISIBLE);
          }else{
               wdContext.currentV_UIElement().setViewVisibility(WDVisibility.NONE);
     }catch (WDUMException e1) {
          wdContext.currentV_UIElement().setViewVisibility(WDVisibility.NONE);
                e1.printStacktrace();
You have to bind the ViewVisibility attribute of the context to the View Container you want to hide.
The applicationAccessPermission you defined in the XML File will be visible in the UME Manager of you J2EE engine. With this action you can create a new role and group that you can map to the users that should see you view.
But, the exception you get is because you have embedded one view twice, which is not possible.
Hope this helps.
Regards,
Dennis

How do you restrict access to custom applications?

When I create portlets, there is usually an associated "admin" functionality that needs to be created for each custom application. An example is a shopping cart that we just created, we needed admins to be able to go in and upload photos.
The way that I do this is I create a new portlet "Shopping Cart Admin" and restrict access to it that way. However, because I usually add everything in the /remoteserver/shoppingcart/. folder to the gateway space (its too painful to add one by one), this means that I can't put admin.aspx in that folder. So I usually end up creating a NEW folder /remoteserver/shoppingcartadmin/ for the admin portlet.
Long story short, its a lot of work. I know that I could try to use activity rights, but those seem very global. How do you control edit access to your custom portlets?

Well, there are a few different ways to go about it. You could add a preferences page with the admin functionality, and then an admin would just have to click the little pencil in the portlet titlebar. No admin/edit access, no little pencil.
I have often set the visibility of an ASPX control directly from activity rights, in OnPageLoad, if it isn't postback time. The activity rights should be inherited by the user, through the user's group. Best practise is to create empty groups called Roles, add activity rights to the Roles, and then have the actual groups (that contain users) inherit from one or more Roles.
You already knew that part, I added it for the others. My personal definition of a portlet is 'polymorphous instance of a web service'.
So:
Role: Store Manager (has Edit Shopping Cart activity right)
^
Group: Store Managers (has Store Manager parent group)
User: Vladimir (inherits Edit Shopping Cart activity right)

Restrict access to buttons, regions, etc. on a per user basis?

My application restricts access to buttons, regions, etc. on a per user basis.
Here is my application logic...
1. A User can only edit items they own.
2. A Super-User can edit all items
So, when a user logs in, I use a post-authentication process to set the user ID to an application level item.
Now, for example, to have an edit button display on a page, I need to check the item's owner ID against the application level user ID...and check to see if this user is on the Super User list via a query.(which could be set to another application level item upon login...I guess)
Question...What is the best way to do this? Conditional display? Authorization scheme?
Would something like the following work for a Conditional Display?
Condition: SQL Expression
&USER_ID.=&P6_ITEM_OWNER_ID. OR USER_ID in (select USER_ID from table where USER_ID=&USER_ID.)
How would I do this with an Authorization Scheme? (I like the idea of updating the logic in single location...but I'm not sure if it is possible because I have to check PX_OWNER_ID would be different on each page.)

Hi Denes,
Thanks for your code which allows user to edit (if authorized) and view (if not).
But some how - I do not get the image to show up - instead it show a small underline.
From SQL point of view - here is what I get - when i run the sql
'<img src="/i/ed-item.gif">',2,CR TEST,,,,dune2.cit.cornell.edu,CRDMTEST.CIT.CORNELL.EDU,PSPROD,,,CRDMTEST
Here is my wrap_image function
create or replace function wrap_image(p_user_name in varchar2,p_dm_name_id in number)
return varchar2 IS
v boolean := False;
ret_val varchar2(1000);
begin
dbms_output.put_line('user='||p_user_name);
dbms_output.put_line('dm_name='||p_dm_name_id);
-- Check authorization if the user is super user - return true, else if he has edit priv on dm_name_id - return true - else false
v:=ACL_DMTOOLS_DM_PRIV(p_user_name,p_dm_name_id);
if v then
ret_val := '<img src="/i/ed-item.gif">';
ret_val := ''''||ret_val||'''';
dbms_output.put_line('TRUE');
else
ret_val := '';
dbms_output.put_line('FALSE');
end if;
return ret_val;
end;
Thanks for your great educational site.
Regards
atul

Lock Box setting does not restrict access

I have a folder that is set to restrict access - write only mode for everyone - so when my nephews visit, they cannot access my personal files. This is a single user/logon computer. A couple of times now when I click on the "locked" folder in Finder, it opens for full access. The contents of the finder window wiggled back and forth several times and the folder opened. I could also access the folder contents from application. When I did a get info, the settings were still for write only. I backed out of the folder to the desk top and then back to the folder and it behaved properly. Program access was also once more restricted.
One perhaps unrelated thing. Just before this happened, when I clicked on any application on the dock, I got the appropriate finder window instead of switching to or launching the application. It too now works normally.
Any ideas?

Permissions repairs apply only to items that leave receipt information, essentially only items installed by Apple's installer. As far as stated features working correctly, the permissions system is designed around the user account concept. If you are trying to use it otherwise, you will be disappointed. The computer can't possibly know who is using it, only what account is trying to access something.
Admin users have more privileges than other user accounts. This is necessary to managing the computer. If you want reliable privacy, you must create a less privileged account for others to use; otherwise they will have the same privileges you do. This is no different from leaving your front door unlocked because you want it to function for your convenience.
Regarding folders with system as owner, none should be in your home directory, nor should you be able to change the owner's permissions to write only, whatever the owner is. You can change the permissions of another user added to the list to write only, or those of a group or others, but the owner must always have read privileges. The Finder should not let you violate this rule.
Likewise, you should not have any folders with just admin, wheel, & everyone entries in the list. Admin & wheel are both groups (indicated by the two-headed silhouette icon) -- groups cannot be the principle owner (indicated by the one-headed silhouette icon). Missing entries indicate no access privileges for that entity & should never apply to the principle owner.
One potential source of confusion is that non-owner users added to the permissions list also appear with the single-headed silhouette (these permissions are controlled by ACL entries, not the main owner/group/others settings) & sometimes the list in Get Info is not in strict owner/group/others sequence. There are also some anomalies associated with accounts migrated from Tiger.
Because of all this, it is best not to trust the Get Info permissions info to give you the full permissions picture. For that, the Terminal is a better tool. You can use the "ls" command with the "-l" option to show expanded preference info, or with the "-l@e" option to show still more, including extended attributes & the ACL. (Note that the "l" character is a lower case ell, not a capital eye or a one.) If necessary, see the Mac OS X Manual Page For ls(1) for more info about how to use the command.

How to clear show isdn history

Hi,
show isdn history command will give active and inactive calls details. I wanted to clear this command output. Shall I know the relevant command for this. IOS is 12.2(8)T5
Regards
Sivakondala Rao

Hi
can you try clear interface brix/x ?
regds

Problem with Restrict Access to Page with access level using ASP

I'm using Dreamweaver CS3 with ASP-VBScript and an Access
database. The pages were created from scratch for this project,
using those tools all the way through.
I've created a login page, an admin homepage, and add, edit,
and list records pages for three tables. The login page uses the
Server Behavior "Log in User", all other pages use the Server
Behavior "Restrict Access to Page". All of these are based on an
Access Level.
Login seems to work correctly, and redirects to the admin
homepage. From the admin homepage, I can open any other page as
expected, and they initially display correctly. On the add and edit
pages, however,
submitting the form often results in getting logged out, but
not always.
Once this happens, I can log back in, but other problems will
sometimes occur during that second login session. Sometimes,
logouts will occur on pages that worked fine during the first login
session. Sometimes, another session variable that I've setup
manually will change when it shouldn't...as if there were two
values stored for my session variable, and reloading the page
changes to the other value.
This
post seems closest to my experience, but it doesn't look like
there was really an answer beyond "I had to fight with it for a bit
to get it to work":
I suspected that there is some problem with session settings
on the server. We have an almost identical tool on the same server
that was developed with an older version of DW that works more
reliably; it sometimes has problems with the initial login, but
never has a problem after that.
Has anyone experienced problems like this? Any suggestions
for what to check? I'm really pulling my hair out since it's so
unreliable...the kind of problem that goes away when you try to
show someone and comes back when they leave.

Hello,
I was thinking that all I would need would be the username, although username and paswsword would be more secure. There are about 50 users and no groups or levels. They are all equal ... same level.
The website is private and there is a general content area for all users and then there will be private areas for each user where proprietary documents will be held. I need to be able to ensure that user 'A' can only see the user 'A' pages, user 'B' can only see user 'B', etc.
I don't really understand what the Dreamweaver script is doing, but the overview sounded like it was the right tool to accomplish what I'm trying to do.
Any assistance greatly appreciated.
thanks.

FERC Code of Conduct - Restricting access for employees

hello - I am project lead for an effort to separate market and transmission data from certain employees in our company. I'm finding this to be a monumental task, since we have a large SAP implementation. FI/CO, MM, HR (postion-based security), Customer (IS-U-CCS), PM, PS, xRPM. We have implemented SOD for SOx compliance, but this is an entirely different effort. Unlike SOx, we need to totally restrict transactions that could contain non-public market and transmission data, so we need to separate the data behind the transactions. Does anyone have experience with this? Would love to hear what approach you took and swap ideas.
Annette M Alboreo, FirstEnergy Corp.

Hi Annette,
First of all, good luck! Data segregation is always a tricky one to manage and needs to be carefully thought out. This sort of activity has a large security and functional overhead and you need to make sure you have access to them.
When I've worked on this sort of thing in the past, there are a few things that you need to identify
- What data is sensitive? The business should ID <b>all</b> sensitive data and the functional team translate that into fields etc. What data needs to be legally segregated, what data is nice to have segregated. A set of rules should be drawn up to say who get's what in which circumstances.
- How are people accessing data? What transactions give access to sensitive data? Standard SAP tx, custom tx (which may need auth checks changing), access to SE38/SA38, SQ01, SQVI etc. All of the routes to the data need to be identified.
Once it is known what data needs to be restricted then it is possible to address how to restrict access to it. A reasonable amount of it should be able to be catered for in the standard auth concept. It's also likely that there will be the requirement for additional config & customising (e.g hide fields, change screens, user exits) to meet these new control needs. I think it goes without saying that the more that you can fix with the standard auth concept, the easier it tends to be. If this means removing some transactions from users then in some cases it may be less costly than knocking up a whole load of custom code to solve the problem - of course this is dependent on the situation.
Hope that is of some use
Cheers
Alex

Having trouble restricting access to virtual multihosting entry

Hi,
I've created a new proxy instance with all default settings. I'm trying to use virtual multihosting with an ACL to restrict access to this virtual multihost. I'm having troubles and am not able to block it. I thought I could use a template to impose this, but perhaps I'm wrong. Here's how I've done it:
I've created a single template called "testing-access", containing:
http://testing\.mydomain\.com/.*
I've then added a single Virtual Multihost entry as follows:
Source Hostname (alias): testing
Source Domain Name: mydomain.com
Destination URL Prefix: http://testing2.mydomain.com
Use This Template: testing-access
At this stage, the virtual multihost works. I can access testing2.mydomain.com via testing.mydomain.com.
Now I go to implement the ACL to, for testing purposes only, Deny all access to this virtual multihost. Remember this just testing to learn how to apply an ACL to a virtual multihost. Later, my intention is to block all http access (by way of Deny applied to http://.* resource ACL) via the proxy, except for the virtual multihosts. These virtual multihosts will also include access control based on different IP addresses. The thought is to have a different template for each virtual multihost then apply a set of ACE Allow conditions for the template's ACL.
I go into Administer Access Control, select the "The template 'testing-access'" resource. I then click on Edit and add the ACL as follows:
Action: Deny
Users/Groups: anyone
From Host: anyplace
Rights: all
Extra: N/A
Continue: enabled
I restart the server instance then attempt to access the virtual multihost, which I can. I cannot understand why this is not being blocked.
I've tried changing Continue to be disabled but that hasn't helped either. It seems as though the ACL for http://.* (which incidentally by default has no ACL) is taking precedence. I've also tried adding to the template without success: http://testing2\.mydomain\.com/.*
If I were to add an ACL to http://.* resource to Deny it blocks all http://.* requests. This is no good because effectively what I would like to do is block all http://.* access EXCEPT for those virtual multihosts I add. Each virtual multihost will need to have its own ACL to restrict based on IP. This is why I created a template for the one above. The objective would be to add several Allow ACEs depending on host, such that only those who are on this ACL can access the URL in the template (a virtual multihost, remember), anything else is blocked via the http://.*
I only did the test at the top to learn how to successfully implement an ACL on a reverse multihost, by applying a Deny for everyone via the template ACL.
Any ideas?

In the case structure you can replace the 'success' button with the vi that you want to run. If you set the properties of the vi to 'show front panel when called' it will open and run when a log-in is successful.
There are other ways to do this, this is one of the more simple ways.
Ian

Restrict access to show isdn active

Similar Messages

Maybe you are looking for