SAML assertion Identity provider - SSO for ALL users

Hi ,
If we have a Corp AD configured on Windows 7/ Windows 8
but SAP-EP-UME is hooked up to the Corp AD ( read only ).
Can we consider the Active directory system(Windows ) to be the IDENTITY PROVIDER
and configure the SAP-EP ( portal to be the SERVICE PROVIDER) for SSO ?
Edited by: Franklin Jayasim on Aug 7, 2010 12:47 AM

Hi,
I don't have any experience with AD as IdP but you can find on net that AD can be SAML 2.0 indentity provider. The question is if it's part of standard installation or there is an extra cost. SAP supports only subset of standard but I assume that it covers all basic scenarios so it should be possible.
But if you want to play then have a look at project [Shibboleth|http://shibboleth.internet2.edu/]. It's an open source project and it supports Active Directory as identity store. I want to test it by myself with CE7.2 but I don't know when I'll have time.
Cheers

Similar Messages

SSO installation for all users

Hello,
When I install the SAP SSO, it is being installed just for the current user, which means if I have a laptop that travel between several users on the company I work for, I need to install the SSO for each user individually.
Is there a way of installing SSO for all users?
My scenario is this, I deploy windows using MDT (Microsoft deployment) and install SSO as part of the deployment process.
When i login with the admin user that i used for installing windows, I see SSO in programs and features, but when login with a different user, I don't see SSO in programs and features.
Thanks.

You only need to install it once. Make sure java is in their PATH for their shell's .profile.
HTH

You do not have sufficient privileges to complete this installation for all users of the machine. Log on as administrator and then retry this installation

Hi all
Have seen a couple threads regarding this but unfortunately nothing that solves my problem thus far!
Right now, our developers are using the Domain Admin account to promote their website code using MSI files. I'd like to change this as I feel the Domain Admin account should be on lock down and only used when absolutely necessary, pretty common. The
same goes for my account too, I would like to absolve as much use of the Domain Admin as I can.
Problem is, when they run installers from their own accounts, they receive this error: You do not have sufficient privileges
to complete this installation for all users of the machine. Log on as administrator and then retry this installation
The accounts they are using are part of the Built In Administrators group and the Domain Admins group... I'm not sure what other permission you'd need in a domain? We've gone as far as explicitly giving them local admin access on this server and still
nothing changes.
Is there a Group Policy or something that I can change to provide install rights and possibly remove these accounts as Domain Admin and more along the line of Power User?
Thanks much for your help!
Ryan

Hi,
You could use Software Restriction Policies (SRP’s) or Applocker(supported on Windows server 2008 R2/Windows 7 only) to restrict the running
of the application for specific user.
Description of the Software Restriction Policies
http://support.microsoft.com/kb/310791
HOW TO: Restrict Users from Running Specific Windows Programs
http://support.microsoft.com/kb/323525
How to Implement Group Policy Security Filtering
http://www.windowsnetworking.com/articles_tutorials/Group-Policy-Security-Filtering.htmlPlease remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Read-Only cell for all users

Hi,
We're running an 11.1.1.2 Planning application. A member in the Account dimension is read-only for all users including the Admin account.
The member is read only when accessed through a Data Form or through Smart View.
We addressing the Account dimension at level 0 on the data form.
The member is not Dynamic.
The member is only locked for EUR and GBP currencies.
The member has previously been moved to a new location in the Account dimension however we have run multiple database refreshes since the move.
Let me know if you need any more info. Any help which can be provided would be greatly appreciated.
Thanks
Jim

Hyperion Planning and More...: Why My Data Form is Still Read Only...!!!
See if any of the points mentioned here is any help.
Cheers..
Rahul S.

Adding a domain user to the admin role within the local user management breaks all metro apps for all users!!

Hi,
I have posted this in another large thread under the "Windows 8 General" group but have not had any appropriate feedback from MS.
After hours of testing and working with other users I have managed to isolate a simple situation that breaks all metro ui applications within Windows 8 for all users on the machine. Here are my exact steps and notes.
Before continuing if you are running Avast then your solution may be to turn of the behaviour shield functionality as this also breaks metro apps. This is NOT the problem we are having!
I have performed 3 cleans installs after isolating the problem and am able to reproduce the issue every time using the same steps on two different machines.
First thing to say is that for us it has nothing to do with simply joining the domain, domain/group policies nor does it appear to have anything to do with the software we installed, the problem here is much more simple but the result is pretty terrible.
Here are my exact steps of what I did to reproduce our problem:
Complete format of HDD in preperation for a clean install
Clean install performed
Set up the machine initially with a local account
Test metro apps - all working fine
Open control panel from the desktop, click on System, change the system to join the domain, click reboot
Log into the system using my domain account
Test metro apps - all working fine
Here's were the problem starts. I need my domain account to have admin rights on the local machine so I can install programs without the IT men having to come over and enter their password every 5 mins.
I go to control panel via the desktop and click on User Accounts. From with here I then click on "Manage User Accounts". This requires the IT guys to enter their details to give me access to such functionality. This is fine
In the dialog box that opens I can only see the local user that was initially created during setup. The "Group" for this local account shows as "Administrators" - Image included below (important to note that metro apps are working at this point)
I click add and then add my domain account - also giving it administrator access
Sign off or reboot to ensure the new security is applied
Sign back in to the domain account
Test metro - ALL BROKEN
Sign out
Sign in as local account
Test Metro - NOW ALL BROKEN FOR THIS USER ALSO
So as soon as I add my domain account to the local user accounts and set it as admin it breaks all metro apps for all users. This is on a totally clean install with nothing at all installed other than the OS.
Annoyingly if I go back and change the domain account to a standard user or if I totally remove the domain account from the local account management system the problem does not go away for either user. basically it is now permanently broken. The only fix I
could fathom was a full re install and not giving the domain user admin access to the local machine.
Screen one - this is the local user accounts window AFTER joining the domain and logging in with my domain account (All metro apps working at this point)
Screen 2: User accounts AFTER joining the domain and AFTER adding domain account to local user management (METRO BROKEN)
I have isolated my machine from all group policies so nothing like that is affecting me. Users I have spoken to in different companies have policies that automatically add users to the local user management. This means that metro apps break as
soon as they join the domain which leads them to wrongly think it is group policies causing the error. Once they isolate themselves from this they can reproduce following my steps.
Thanks

Hi Juke,
Thank you for the response and apologies for the delay in getting back to you. My machine was running a long task so I couldn't try your suggested solution.
I had already tried running the registry merge suggested at the top of the thread to no avail. I had not tried deleting the OLE key totally so I did that and the problem still exists. I will post all the errors I see in event viewer below. For
your info, since posting my initial comment I have sent out my steps to 7 different people and we can all reproduce the problem. This comes to 10 different machines (3 of them mine then the other guys) in 3 different businesses / domains. We see the same errors
in event viewer.
Under "Windows Logs" --> "Application" : I get two separate error events the first reads "Activation of app winstore_cw5n1h2txyewy!Windows.Store failed with error: The app didn't start. See the Microsoft-Windows-TWinUI/Operational log for additional
information." The second arrives in the log about 15 seconds after the first and reads "App winstore_cw5n1h2txyewy!Windows.Store did not launch within its allotted time."
Under "Windows Logs" --> "System" : I get one error that reads "The server Windows.Store did not register with DCOM within the required timeout."
Under "Applications And Services Logs" --> "Microsoft" --> "Windows" --> "Apps" --> "Microsoft-Windows-TWinUI/Operational" : I get one error that reads "Activation of the app winstore_cw5n1h2txyewy!Windows.Store for the
Windows.Launch contract failed with error: The app didn't start."
If you require any further information just let me know and I will provide as much as I can.
Thanks

How to set up new enviroment variables permanently for all users?

Hi.
I downloadad Apache Tomcat, and need to set enviromental variables for all users.
I tryed setenv commad, but it is not found.
for example # JAVA_HOME="/opt/jre1.6.0" Solaris remembers this variable only for one session and I need for all users permanently.
Thanks.

Thank you.
This file contains a script. Is there difference in putting that line in beginning or end of the file?
#ident     "@(#)profile     1.19     01/03/13 SMI"     /* SVr4.0 1.3     */
# The profile that all logins get before using their own .profile.
trap "" 2 3
export LOGNAME PATH
if [ "$TERM" = "" ]
then
     if /bin/i386
     then
          TERM=sun-color
     else
          TERM=sun
     fi
     export TERM
fi
#     Login and -su shells get /etc/profile services.
#     -rsh is given its environment in its .profile.
case "$0" in
-sh | -ksh | -jsh | -bash)
     if [ ! -f .hushlogin ]
     then
          /usr/sbin/quota
          #     Allow the user to break the Message-Of-The-Day only.
          trap "trap '' 2" 2
          /bin/cat -s /etc/motd
          trap "" 2
          /bin/mail -E
          case $? in
          0)
               echo "You have new mail."
          2)
               echo "You have mail."
          esac
     fi
esac
umask 022
trap 2 3
# Intel Server Control - The following lines
# let the LRA daemon access the X server
if [ -f /usr/bin/X11/xhost -a -f //isc/lra ]
then
     ttyname=`tty`
     ttyname=`basename $ttyname`
     ttykind=`tty | egrep "console|vt"`
     whereami=`finger -s | grep $ttyname | cut -c61-`
     if [ "$whereami" = "" -a "$ttykind" = "" ]
     then
          CURDIS=$DISPLAY
          DISPLAY=unix:0.0
          export DISPLAY
          /usr/X/bin/xhost +unknown 2>/dev/null 1>/dev/null
          DISPLAY=$CURDIS
     fi
fi

How to embed fonts in document for all users

Hello,
we are using a custom font for our documents. I know it's possible to embed fonts in document when saving.
Is there an option to enforce this setting with a policy?
I cannot find the right policy in the Office Policy templates.
We are using Office 2013 x86.
Thanks in advance.

Hi,
Based on my knowledge, the option is document-based, we can't control this on the Policy level.
If your request is to turn on this option for all new created documents. Since all new documents are based on the Normal.dotm template, a workaround is to create a new Normal.dotm template in which this option is checked:
Browse to C:\Users\Username\AppData\Roaming\Microsoft\Templates, open Normal.dotm, tick the option and save it as Normal_1.dotm, save it in the same location.
Then rename the old Normal.dotm to Normal.old, rename Normal_1.dotm to Normal.dotm.
Open Word and create a new blank document, you will see this option is ticked.
To deploy this file for all users, we can write a startup script. The process is like: 1. Remove the old Normal.dotm, 2. Copy the new Normal.dotm template from a network shared location to C:\Users\Username\AppData\Roaming\Microsoft\Templates.
I hope the information is helpful to you.
Regards,
Melon Chen
TechNet Community Support
It's recommended to download and install
Configuration Analyzer Tool (OffCAT), which is developed by Microsoft Support teams. Once the tool is installed, you can run it at any time to scan for hundreds of known issues in Office
programs. Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

How to suppress a Security Notifcation for all users

How can we suppress the notification If you open this document, anonymous usage data will be sent securely to this remote server: To learn more about what this means for you, please click on the 'Privacy and Security' button. check box - Allow collection of detailed usage data check box - Do not show again _________________________________________________________________________________________ __________________________________ I'm looking for a way to tick the box 'Do not show again' for all users perhaps through a registry setting that can be set via GPO? Thanks, Brian

Well as a workaround you can create an email address/folder and provide this in SOCT and then from this mail folder , setup a rule to forward the mail to all receipients.

Default Color, Size and Font for all user.

Hi
I have been looking around for the correct way to set some default styles for all Word users in a domain thrugh GPO. I just have some questions.
So far i can only get it working if it set a "Workgroup templates path" under "User Configuration/Administrative Templates/Microsoft Office 2013/Shared paths". Then the users are able to select it when they say "New" - "Shared"
and then the template
But i would like it to be default for all users, like in the Normal.dotm. But without making a script to replace the file for every users APPDATA.
Then i saw the "User Configuration/Administrative Templates/Microsoft Office 2013/Shared paths/Enterprise templates path", how and what does that do?

Hi,
As far as I know, if we want to distribute the Normal.dotm to users in a domain through GPO, we could
use GPP file extension to
distribute Normal.dotm to the path "C:\Documents and Settings\user name\Application Data\Microsoft\Templates." for every user. For more detailed steps, please refer to the following link:
http://technet.microsoft.com/en-us/library/cc772536.aspx
Similar issue:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/87ab10d3-1cb6-4269-9334-1e0c37527e0a/move-location-of-normaldotdotm-to-central-file-server-best-solution?forum=winserverGP
If you want to config Enterprise templates path, please read this thread:
https://social.technet.microsoft.com/Forums/office/en-US/c4e5c872-402c-4339-9c02-cfa91e949e41/office-2013-templates-group-policies?forum=officesetupdeploy
If you have further question about the GPO, I recommend you post it to GPO forum:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/home?forum=winserverGP
Regards,
George Zhao
Forum Support
Come back and mark the replies as answers if they help and unmark them if they provide no help.
If you have any feedback on our support, please click "[email protected]"

Getting tasks for all users in a role

Hi,
We need to get all users in a Role, and out of those, find out which one has the least tasks in their UWL using a WebService. Saw some example codes and here's my attempt at it. Doesn't quite work, I'm getting the Logged in users context or session doesn't exist Exception. Any help on this will be GREATLY appreciated.
public class LeastTasksBean implements LeastTasksLocal {
     public String getUserLeastTasks( String sRole )
          try{
               Map<String, String> users = new HashMap<String, String>();
               Map<String, String> tasks = new HashMap<String, String>();
               final int sessionIdleTimeout = 60;
               String Users[] = UMFactory.getRoleFactory().getUsersOfRole( sRole, true );
               if( Users != null ){
                    for( int i = 0; i < Users.length; i ++ ){
                         UWLContext uwlContext      = new UWLContext();
                         IUWLService uwlService      = findService();
                         uwlContext.setAllowBackEndConnections( true );
                         IUser uwlContextUser        = UMFactory.getUserFactory().getUser( Users[0] );
                         uwlContext.setUser            ( uwlContextUser );
                         Locale loc                  = new Locale( "ES" );
                         uwlContext.setLocale          ( loc );
                         HttpServletRequest request = getHttpRequest();
                         uwlContext.setOriginRequest   ( request );
                         IUWLSession session         = uwlService.beginSession( uwlContext, sessionIdleTimeout );
                         uwlContext.setSession         ( session );
                         IUWLItemManager itemManager = uwlService.getItemManager( uwlContext );
                         QueryResult result          = itemManager.getItems( uwlContext, null, null );
                         users.put( String.valueOf( i ), uwlContext.getUserName() );
                         tasks.put( String.valueOf( i ), String.valueOf( result.getItems().size() ) );
                         uwlService.endSession( uwlContext );
                    int userTasks = 0;
                    int leastTasks = Integer.valueOf( tasks.get( 0 ) );
                    int userKey = 0;
                    for( int i = 0; i < Users.length; i ++ ){
                         userTasks = Integer.valueOf( tasks.get( Integer.toString( i ) ) );
                         if( userTasks < leastTasks ){
                              leastTasks = userTasks;
                              userKey = i;
                    return users.get( Integer.toString( userKey ) );
               else{
                    return "No users exist for this role";
          //Exception Handling
     private IUWLService findService() throws NamingException
          Properties properties = new Properties();
          properties.put( InitialContext.INITIAL_CONTEXT_FACTORY, "com.sapportals.portal.prt.registry.PortalRegistryFactory" );
          InitialContext ctx = new InitialContext( propiedades );
          IUWLService uwlService = ( IUWLService ) ctx.lookup( IUWLService.ALIAS_KEY );
          return uwlService;
     private HttpServletRequest getHttpRequest() throws Exception
          Properties properties = new Properties();
          properties.put( "domain", "true" );
          ApplicationWebServiceContext wsContext =
               (ApplicationWebServiceContext) new InitialContext( propiedades ).lookup( "/wsContext/" + ApplicationWebServiceContext.APPLICATION_WSCONTEXT );
          HttpServletRequest request = wsContext.getHttpServletRequest();
          return request;

Hi David,
I have a similar requirement on our project. I need to get a count of pending workitems for all user but I'm getting similar message when I try to access UWL context of any other user.
Did you find any solution for this? Is it possible to get the workitems for all users using webservice or wendynpro?
I would appreciate if you can provide some inputs on this.
Thank you in advance.
Regards,
Seema Rane

SNR License Issue. How Can I Disable SNR for all Users?

Hi,
I Have an issue with SNR on CUCM 10.5 and with assignement of license type
I have a cluster with 400 users.
200 users use ip phone 3905 and should be use an Essential License.
When system check for assignement of license type , itassign a Basic License instead of an Essential License, because it see that users have SNR Enabled.
All users in my system have SNR enabled, and I can not disable it. All my user have Enable Mobility unchecked, and all my phone have Device Mobility Off, but system however see SNR enable.
How can i disable SNR for all users? This is a feature that client don't need.
I dont' have a sufficent number of licenses for support all 3905 in Basic License.
thanks for help.
Andrea

Well actually, Mobile Identity wouldn't apply to a 3905 unless those phones had another line on a Dual-Mode device like an iPhone or Android phone. So unless you have either of those in your system you can scratch that idea. Someone else may chime in here and try to help a bit more as RD/RDP are the main SNR culprits.

Report all activations of Office 365 ProPlus for all users

Hello:
I know that I can open my Office 365 Settings, Software, and see how many devices I have activated Office 365 Pro-plus on.
What I am looking for is a way for an Admin to run a Powershell script (or command) to retrieve the activations for ALL users in a tenant.
Thanks
Tim

Hi Tim,
As far as I know, this is not possible. We can use Get-msoluser command to get the license status. But we can’t get details of all users’ activated computer name list for the Office 365 tenant with a Powershell script.
By the way, this forum focuses on questions and feedback for Microsoft Office Client. There is not so much about Office 365
console/hosted/cloud aspects here. For your case, I would suggest you to post in the forum of Office 365 Community, where you can get more experienced responses:
http://community.office365.com/en-us/f/default.aspx
The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.
Regards,
Ethan Hua
Forum Support
Come back and mark the replies as answers if they help and unmark them if they provide no help.
If you have any feedback on our support, please click
here

Set-casmailbox command for all users?

I want to disable the feature in OWA that allows a user to edit their photo. I got the following command to work but I want to run this for all users and the following command requires me to add a name. We have 5 different databases.
Is this possible?
Set-CASMailbox John.Doe -OwaMailboxPolicy "Default".
Ex2013sp1
PennyM

At its simplest you could do something like this:
Get-Mailbox -ResultSize unlimited | Set-CASMailbox -YourOptionGoeshere
Cheers,
Rhoderick
Microsoft Senior Exchange PFE
Blog:
http://blogs.technet.com/rmilne
Twitter:   LinkedIn:
  Facebook:
  XING:
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Remove Following people from mysite for all users

[System.Reflection.Assembly]::LoadWithPartialName("Microsoft.Office.Server")
$web = Get-SPWeb https://www.contoso.com/teams/yourteam
$context = [Microsoft.SharePoint.SPServiceContext]::GetContext([Microsoft.SharePoint.SPSite]$web.Site)
$upm = New-Object Microsoft.Office.Server.UserProfiles.UserProfileManager $context
$users = $web.AssociatedMemberGroup.Users | where IsDomainGroup -eq $false
$useraccounts = $users | select loginname | Foreach {"$($_.loginname)"}
foreach ($user in $users) {
$profile = $upm.GetUserProfile($user.UserLogin)
#$objectToFollowRelativeToWeb = "/"
if ($profile)
#Create a Social Manager profile
#SPSocialFollowingManager
$followManager = New-Object Microsoft.Office.Server.Social.SPSocialFollowingManager($profile, $context)
$following = $followManager.GetFollowed([Microsoft.Office.Server.Social.SPSocialActorTypes]::Users)
for ($i=$following.Count - 1; $i -ge 0; $i--) {
$followed = $following[$i]
$acctname = $followed.AccountName
#if claims:
$acctname = 'i:0#.w|'+$acctname
if ($acctname -iin $useraccounts ) {
[Microsoft.Office.Server.Social.SPSocialFollowResult]$res = $followManager.StopFollowing($followed)
Write-Verbose "$($user.UserLogin) stop following $acctname result is $res"
I have the above script from one of the technet solution to remove followeronly for Contributors from MySite. I want this script to run for all user and remove all existing association. Can someone help me update this script.
Thanks Ba$va

Hi Basva,
According to your description, my understanding is that you want to remove all existing association for all users
The $users = $web.AssociatedMemberGroup.Users | where IsDomainGroup -eq $false is to get all users in Contributors group. You can change the line to
$users = $web.AllUsers, then run the script, compare the result.
Here is an post for getting all users using PowerShell, please take a look at:
http://www.sharepoint2013.me/Blog/Post/160/Get-all-the-unique-users-in-a-farm-using-PowerShell-script
Best Regards,
Wendy
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]
Wendy Li
TechNet Community Support

I need to CHANGE my SAML Claims Identity Provider from Siteminder to Okta

I went ahead and got specific on the title .... but, the question is a general question actually.
I currently have SAML-provider-A. I need to move my Sharepoint Claims Webapplication from SAML-A over to SAML-provider-B. I THINK that I should be able to simply remove SAML-A TIP and add SAML-B tip and as long as I retain
the same TIP-NAME - I think that my profiles shoudl not have to be migrated etc. etc.
When I DELETE the connection for UPA - and reCREATE the connection to AD via the TIP.
My fear is that there is something that will cause the UPA to duplicate the profiles. But, I dont THINK that'll happen.
Does anybody know?
if my post is helpful - please click on the green arrow. (please excuse, in advance, any perceived sarcasm/humor - as I often forget it does not translate through text) :)

Hi ,
According to your description, my understanding is that you need to change your SAML Claims Identity Provider from Siteminder to Okta.
For achieving your demand, you can refer to the steps as the guide:
https://support.okta.com/entries/55886993-Microsoft-SharePoint-On-Premises-Deployment-Guide#setup
And you need to associate your existing web application with the Okta identity provider and perform IIS Reset:
http://technet.microsoft.com/en-us/library/hh305235(v=office.15).aspx#CreateWebApp
Thanks,
Eric
Forum Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support,
contact [email protected]
Eric Tao
TechNet Community Support

SAML assertion Identity provider - SSO for ALL users

Similar Messages

Maybe you are looking for