Restricted Access Exception?

Basically what's happening is I'm creating a 3D scroll-shooter and I need it to fire every time I press space.
When that happens I add a transform group containing the laser, and it's position to the main branchgroup. Whenever I try to do this however it says I'm only allowed to add a BranchGroup node to it?
Is a branchgroup only allowed to contain one transformgroup before I have to add another?

Restricted Access Exception is thrown when you are trying to add a non-BranchGroup Object to a Live or Compiled Scene Graph
So, in order to fix the Issue you have 2 options:
1) wrap everything you were going to add in a BranchGroup Object and add that
2) or, just add everything you will need(TransformGroup Objects, Behaviors, Lights etc) before adding it to the Locale or SimpleUniverse Object
Hope this helps

Similar Messages

How do I restrict access at the field level in vendor creation XK01

Hello All,
Does anyone know a way to restrict access to a certain group of fields or a screen in vendor create? I know it is possible in vendor change XK02 using the field groups (transactions OBAT and OBAU) but we have a requirement to have one group of users create all vendor information except the bank details and another group of users just to create the bank details.
Thanks for any help you can offer.
rgds,
ian

We have had a similar discussion some while back. please refer to the thread below as it seems to be much similar to your requirement.
[click here|Hide or Encrypt Bank Account Number]

How to restrict access to views for some users in the app?

Hi SDN!
I have an WD application wich embedded in the portal. Appication has 2 iViews (and 2 pages respectively). These iViews consist several views connected with each other (e.g. one view provide list data, second view is add/edit form for this data). I need to restrict access for some users for view with add/edit form. I can't make separate page for this view.
What I've done:
1) create yet another UIContainer for this view in main window and embed view to this container. It was be done for create separate iView for form.
2) in the portal I create iView for this form but don't embedd in any page.
When I try to call my form from list data (that is one iView from another) I get exception:
<b>com.sap.tc.webdynpro.services.exceptions.WDRuntimeException: duplicate usage of view .MyCarRentalAddCity</b>
Is there a way to get needed functional?
Thanks,
Lev

Hi,
do you need to remove the IView from the portal menu or do you just want to make a View container in your WD application invisible if the user doesn't have the rights to see it.
If so, you could create your own roles on the app server:
You need to create a new class that extends NamePermission like:
import com.sap.security.api.permissions.NamePermission;
public class ApplicationAccessPermission extends NamePermission {
           * @param name
          public ApplicationAccessPermission(String name) {
               super(name);
           * @param name
           * @param action
          public ApplicationAccessPermission(String name, String action) {
               super(name, action);
Also, you have to create an Action.XML file that looks like this:
<BUSINESSSERVICE
     NAME="com.vendor.administration">
     <DESCRIPTION
          LOCALE="en"
          VALUE="actions view usage"/>
     <ACTION
          NAME="View Permission">
          <DESCRIPTION
               LOCALE="en"
               VALUE="Show view"
               />
          <PERMISSION
               CLASS="com.vendor.utilities.ApplicationAccessPermission"
               NAME="ShowView"
               />
     </ACTION>
</BUSINESSSERVICE>
If you have created these to files in your packages, you can access this function like:
IUser user ;
try {
          user = WDClientUser.getCurrentUser().getSAPUser();
          if(user.hasPermission(new ApplicationAccessPermission("Show view"))){
               wdContext.currentV_UIElement().setViewVisibility(WDVisibility.VISIBLE);
          }else{
               wdContext.currentV_UIElement().setViewVisibility(WDVisibility.NONE);
     }catch (WDUMException e1) {
          wdContext.currentV_UIElement().setViewVisibility(WDVisibility.NONE);
                e1.printStacktrace();
You have to bind the ViewVisibility attribute of the context to the View Container you want to hide.
The applicationAccessPermission you defined in the XML File will be visible in the UME Manager of you J2EE engine. With this action you can create a new role and group that you can map to the users that should see you view.
But, the exception you get is because you have embedded one view twice, which is not possible.
Hope this helps.
Regards,
Dennis

Restrict access to users in customer line item display FBL5N

Hi all,
We got a requirement from my client that, they want to restrict access of their users to view details of few customers only. The user has a right to view FBL5N transaction code, but he cannot view all customers details.
we created 4 customer account groups,we created like .. SD customers1
                             SD customers2
                             Onetime customers
                             FI customers
These FI customers cannot be viewed by all users except who has authorization in Tcode FBL5N, we need to restrict to display only SD and one time customers details.
we have tried with Basis but its not working and its blocking to view all customers.
anyone got this kind of requirement , Is it possible to restrict....please help me.
Thanks
Nagesh
Edited by: nag on Dec 27, 2011 5:26 PM

It is standard behaviour that the authorization object F_KNA1_GRP(account group authroization) is not checked
in the transacion FBL5N. You can confirm this functionality in trans. SE24.
As a workaround, I would suggest you to use the authorization object F_KNA1_BED Customer: Account Authorization
If you assign an authorization group as the accouting group, perhaps you can get a similar functionality.
Please note that for the 'drill-down' or direct call of FBL5N these objects are checked:
F_BKPF_BLA Accounting Document: Authorization for Document Types
F_BKPF_BUK Accounting Document: Authorization for Company Codes
F_BKPF_GSB Accounting Document: Authorization for Business Areas
F_BKPF_KOA Accounting Document: Authorization for Account Types
F_BKPF_BED Accounting Document: Account Authorization for Customers
F_KNA1_BED Customer: Account Authorization
F_KNA1_BUK Customer: Authorization for Company Codes
Kind Regards
Soumya

Having trouble restricting access to virtual multihosting entry

Hi,
I've created a new proxy instance with all default settings. I'm trying to use virtual multihosting with an ACL to restrict access to this virtual multihost. I'm having troubles and am not able to block it. I thought I could use a template to impose this, but perhaps I'm wrong. Here's how I've done it:
I've created a single template called "testing-access", containing:
http://testing\.mydomain\.com/.*
I've then added a single Virtual Multihost entry as follows:
Source Hostname (alias): testing
Source Domain Name: mydomain.com
Destination URL Prefix: http://testing2.mydomain.com
Use This Template: testing-access
At this stage, the virtual multihost works. I can access testing2.mydomain.com via testing.mydomain.com.
Now I go to implement the ACL to, for testing purposes only, Deny all access to this virtual multihost. Remember this just testing to learn how to apply an ACL to a virtual multihost. Later, my intention is to block all http access (by way of Deny applied to http://.* resource ACL) via the proxy, except for the virtual multihosts. These virtual multihosts will also include access control based on different IP addresses. The thought is to have a different template for each virtual multihost then apply a set of ACE Allow conditions for the template's ACL.
I go into Administer Access Control, select the "The template 'testing-access'" resource. I then click on Edit and add the ACL as follows:
Action: Deny
Users/Groups: anyone
From Host: anyplace
Rights: all
Extra: N/A
Continue: enabled
I restart the server instance then attempt to access the virtual multihost, which I can. I cannot understand why this is not being blocked.
I've tried changing Continue to be disabled but that hasn't helped either. It seems as though the ACL for http://.* (which incidentally by default has no ACL) is taking precedence. I've also tried adding to the template without success: http://testing2\.mydomain\.com/.*
If I were to add an ACL to http://.* resource to Deny it blocks all http://.* requests. This is no good because effectively what I would like to do is block all http://.* access EXCEPT for those virtual multihosts I add. Each virtual multihost will need to have its own ACL to restrict based on IP. This is why I created a template for the one above. The objective would be to add several Allow ACEs depending on host, such that only those who are on this ACL can access the URL in the template (a virtual multihost, remember), anything else is blocked via the http://.*
I only did the test at the top to learn how to successfully implement an ACL on a reverse multihost, by applying a Deny for everyone via the template ACL.
Any ideas?

In the case structure you can replace the 'success' button with the vi that you want to run. If you set the properties of the vi to 'show front panel when called' it will open and run when a log-in is successful.
There are other ways to do this, this is one of the more simple ways.
Ian

Using NAR to restrict access by MAC address

Hello All,
We have a solution where home users connect via ATM onto our network. Currenty their radius requests are passed onto Cisco ACS 3.3 and they are authenticated using RSA SecurID Fobs to an ACE server.
I am trying to look at an alternative to using a SecurID fob and restrict the end user's access based on MAC address.
I found this on the online documentation for ACS 3.3
"About Non-IP-based NAR Filters
A non-IP-based NAR filter (that is, a DNIS/CLI-based NAR filter) is a list of permitted or denied "calling"/"point of access" locations that you can use in restricting a AAA client. However, by entering an IP address in place of the CLI you can use the non-IP-based filter even when the AAA client does not use a Cisco IOS release that supports CLI or DNIS. In another exception to entering a CLI, you can enter a MAC address to permit or deny; for example, when you are using a Cisco Aironet AAA client. The format of what you specify in the CLI boxCLI, IP address, or MAC addressmust match the format of what you receive from your AAA client. You can determine this format from your RADIUS Accounting Log."
If I specify a clients MAC in any of the non IP NAR options (CLI, Port, DNIS)access is refused. I am using radius IETF and the only time I can see the MAC in the radius accounting logs is when I turn on the option to log cisco-av-pair. Nothing is being logged under CLI or DNIS, so I don't think I can restrict access based on MAC using a non IP NAR. Has anyone implemented what is referred to in the documentation above? Is it just applicable to cisco Aironet? Any ideas?
Thanks.

A NAR is a definition, which you make in Cisco Secure ACS, of additional conditions that must be met before a user can access the network. Cisco Secure ACS applies these conditions using information from attributes sent by your AAA clients. So it is not device specific.

Restriction access to single pernr

Hello!
I'd like to restrict access for one pernr without changing of existant roles.
These roles use P_ORGXX (SBMOD) for restriction. SBMOD (Administrator groups) depends from Employee Group and it's automatically filled out (the Feature/PE03).
Is it possible to create the feature for pernr or may be to fill Admin. grout out other way?
TIA
Regards,
Tonya

VI libraries (llb) had certain advantages on older OS, they e.g. supported long filenames, even before W95. Now the advantages are are not as clear anymore except for the built-in distinction between plain and toplevel VIs. They are useful for distributing applications. or e.g. attach an example program containing multiple VIs here as a single file.
> In LabView 4.0, Windows 95, how can I make files from single VIs?
You can always open any subVI for editing, then save it to a plain "single-file" VI. You can also use the "VI library manager" (under tools. I don't remember if LV4 already had that).
Newer version of LabVIEW have an option of "enable windows explorer for llb files". This is nothing more than a new "explorer like" interface that lets you b
rowse inside llb files with a similar look-and-feel as windows explorer. It does not convert anything.
LabVIEW Champion . Do more with less code and in less time .

Restricting access to a cube while it is being maintained

Hi,
We are trying to restrict access via discoverer/excel add in to a CUBE while cube is being maintained. We were able to achieve this by revoking privileges to certain roles before the start of the cube build.
I would like to know if there is any better way or built in functionality(out of box) that restricts access to a cube a while it is refreshing? Any help is appreciated.

Ragnar is correct, the best way to do this is to attach the AW in exclusive mode. You can either do this manually yourself before starting your load job, or automatically by scheduling the job and using mutiple processes to load and solve the cube.
The problem is removing users currently viewing data via Excel/Disco when the job starts. If you can ensure there will be no users accessing the AW when the job starts, then the exclusive attach mode will prevent any users from attaching the AW during the processing. If you cannot guarantee this, then there is a problem because the job will fail when it tries to attach the AW in exclusive mode. Obviously you could put this in a loop and wait until a user exits the front end application and releases the AW. Alternatively, you could write a SQL script to disconnect/kill all sessions accessing the AW - not very nice for the users though if they are building a report because they will lose all their unsaved changes.
When the AW is attached in exclusive mode, bad news is that Discoverer/Excel will probably generate a nasty Java error message when a user tries to connect using Discoverer/Excel.
Therefore, overall not an ideal situation. But I cannot think of a really good way to manage this at the moment. Sorry I can't be more helpful.
Keith Laker
Oracle EMEA Consulting
OLAP Blog: http://oracleOLAP.blogspot.com/
OLAP Wiki: http://wiki.oracle.com/page/Oracle+OLAP+Option
DM Blog: http://oracledmt.blogspot.com/
OWB Blog : http://blogs.oracle.com/warehousebuilder/
OWB Wiki : http://wiki.oracle.com/page/Oracle+Warehouse+Builder
DW on OTN : http://www.oracle.com/technology/products/bi/db/11g/index.html

Restricted access to attachments in SRM 7.0 web applications

Hi,
We have a very specific problem regarding the handling of attachments with SRM 7.0 web applications. The system is configured to use ArchiveLink for storing documents on a remote content server, which is working fine.
Now we have a requirement which should restrict access to certain documents to specific user groups. As an example you could say that a Purchase order has (besides others) two documents attached, e.g.
- signed contract
- meeting minutes
The contract should only be visible to a limited number of people, whereas the Meeting Minutes are accessible to everybody.
Our problem is that apparently only one Content Category ("BBPFILESYS") is used by the SRM web applications for an upload. When granting authorizations on this content category, we cannot distinguish between contracts and meeting minutes anymore.
Comparing this with the config in ECC we can freely define document types which can be used in AUTH profiles. Is there any similar solution that can be used in SRM 7.0?
Any help would be greatly appreciated.
Cheers,
Mark

Hello,
Have a look at note 1334202. It provides some inputs.
Regards,
Ricardo

ASA WebVPN. How do you restrict access to users in an AD group using LDAP?

Hi All,
I am trying to configure separate WebVPN connection profiles to give different portal bookmark contents to users based on their AD group membership. This has been very difficult, even though I beleive it should be easy.
The login page of teh ASA by default has a dropdown to allow default users to access the default portal and the SSL VPN client connection.
There are two other portals that I would like to restrict access to based on AD group membership. I have set these up to be selected by URL.
The biggest problem is, I have no way of knowing how to go about this. The AAA LDAP options show a group membership search, which I have configured, but I cannot say "Profile X is restricted to AD group CarpetBaggers", so that if soneone that is NOT a carpetbagger tries to log in, it fails.
I can only do an all or nothing scenario.
It would be nice to use Dynamic Access Policies to do this, and I have created a few, but they do NOT seem to work when the drop down aliases or URLs are in use. So how do I go about using them in this scenario? Turning off the aliases or URLs is not really an option right now.
Scenario 1 would work the best for me. Restrict access to profiles/groups based on AD group membership using LDAP.
Scenario 2 would be an ideal longer term solution.
Any thoughts, ideas or assitance would be greatly appreciated.
Cheers

This is exactly what i was looking for, and Nelson is correct. When you enter the DAP configuration for a profile click on "Advanced" and there is the option to create a logical expression. The guide (ther is a button to access this) is really helpful, with a couple of examples. This is what i used:
assert(function()
   if ( (type(aaa.ldap.distinguishedName) == "string") and
        (string.find(aaa.ldap.distinguishedName, "OU=Users") ~= nil) )
then
       return true
   end
   return false
end)()
from the debug dap you can see what Users relates to;
DAP_TRACE: Username: MyUsername, aaa.ldap.distinguishedName = CN=Mr B,OU=Users,OU=Site ******,DC=CH,DC=Mycompany,DC=com
My admin account fails to get me in to the same profile:
DAP_TRACE: dap_add_to_lua_tree:aaa["ldap"]["distinguishedName"]="CN=Admin Mr B,OU=Admin Users,OU=Site *****,DC=CH,DC=Mycompany,DC=com"
Thanks
Andrew

SSH login- how do I restrict access to a shared folder?

I have created Shares in WGM for SMB and AFP access on my OS X 10.4.8 Server. However when I connect via SSH it's not restricting access to the folder based on the User Name I login with- I see the entire volume! How do I restrict access to a specific folder based on a user name setup in WGM? ACL's?

Hey George,
It sounds like you are trying to limit ssh/sftp users to a specific area, aka jails. The FTP server lets you 'chroot' users to a certain area making it appear as the root thus preventing them from navigating up the hierarchy, which is what I think you, and me and many others are trying to accomplish.
The ssh compiled into OS X is missing this very needed feature. There have been a few documented workarounds, but they've either been too insecure or too clunky for me.
I've dealt with the fact that my users can get to the root of the hard drive, and have just been very careful about my privileges (by using ACLs), thus preventing them from getting inside areas they shouldn't.
There's a good write up here: http://www.schwie.com/brad/macosxsftpchroot/ and if you include the term 'chroot' in your searches, you should find a bit about it here too.
And Roger, I think George meant the file sharing protocol used by ssh. man sftp.

How can I restrict access to add. internal hard drive by account?

Hello! Okay, so I am my computer's administrator, and I have a secondary 'guest' account that anyone else can use. So, I know that all my data on my main, OS hard drive is secure from the guest account accessing it, but what about the additional hard drive that I have installed?
I have a good deal of sensitive data and files stored (and aliased) on my second internal drive that I do not care for 'guest' users to stumble upon. How can I restrict access to the secondary storage hard drive from my Guest login account, and/or just plain hide it from it? Surely, there is a need for this that has brought about a solution. Any tips/advice/solutions?
Thanks!!!
=)

Click here and follow the instructions followed by placing the folders and files on the image; if the password is in the keychain, it will be supplied whenever you're logged in.
(41018)

HT201304 Is it possible to restrict access to specific IOS apps based on the WIFI profile that a user has connected to?

Is it possible to restrict access to specific IOS apps based on the WIFI profile that a user has connected to?

you might be able to block it if the app uses Internet access
and depending on your wireless you might be able to block a specific user
accessing the backend host that the app uses
some firewalls offer application filtering but I'm not aware of any that work with ios apps

HT1178 How do I restrict access to my network to mac addresses?

I am setting-up a new Time Capsule and wish to restrict access to my wireless network to only those mac addresses of my equipment. I can't find instructions on how to do this. Any help in pointing me to the correct resource would be appreciated.

Suggest that you check the Help area in AirPort Utility for instructions.
Open AirPort Utility
Click the Help menu at the top of the screen
Click AirPort Utility Help
Wait for Help to load
Click Setting up a Wi-FI network on the left side of the main page
Click Control when a user can access your network
Click Control access to your wireless network

How do I restrict access to USB Disk connected to Airport Extreme

I have attached a USB HDD to my Airport Extreme Base Station. The drive is divided into 4 partitions, which I did with the HDD connected directly to a MBP before plugging into the AEBS. All the Macs on the network seem to be able to read and write into all 4 partitions. Is there anyway to restrict which Macs can access with partition? Or, if I went to a single partition, is there a way to restrict access on a folder by folder basis?
I've tried searching, but the best answer I've found so far is that the AEBS will only support a single partition/volume.... which doesn't appear to be true anymore.
Thanks in advance

You can put a filter on your wifi or use something like the K9 browser.

Restricted Access Exception?

Similar Messages

Maybe you are looking for