Security Profile Not Working

Hi,
I want to restrict persons records based on their assignment - organizations.
Approach 1:
For this i have created a new custom security profile in Organizatin Security tab
Security Type : Secure organizations by organization hierarchy and / or org list
Organization Hierarchy : <gave our primary reporting here>
selected radio button - use the org on the users's assingemnts as the top org
In the next block under organization name, gave org 1 and selected Include radio button and next 5 orgs (org 2 to org 6 ) and choosed Exclude radio button (Classification column left blank for all orgs).
Assigned this Security profile to resposbility (for HR:Security profile)
When i login to this responsbility and query in enter & maintain form; I am able to see all persons belong to org 2 to org 6; My expectation i should see only those persons whose assignment has org 1;
Approach 2:
I have created one more new security profile (in the custom security tab); selected Restrict the people visible to this profile , and gave in command box
ASSIGNMENT.organization_id = 100 (org id 100 is for Org 1)
and assigned this to responsbility; When i login to this resp , my expectaion is it will show only persons who assignments having org1. But it shows all other persons, whose assignment having differents orgs (org 2 to org 6)
In both the above two approaches, I am not getting what i am looking for.
I have even ran Secuirty List Maintanence program also
I am doing some thing wrong? Please help on this?
We are on 11.5.10
Thanks!!

Hi
Is this still aproblem or has Gaurav sorted it out for you. His explanation looks like it will solve the problem, but there might also be a problem in the coding of the custom code. You should be able to achieve what you want without the custom code, by using the organisation tab instead.
Regards
Tim

Similar Messages

Dimension security is not working if user have two roles in SSAS while connecting from Excel

Hello Genius,
I am facing the issue when user trying to connect the cube from excel if user have more than one role in ssas db.
Role 1: Countryuser, I have implemented the dimension security with country
dimension and countrycode attribute.
Role 2: CityUser, I have implemented the dimension security with
city dimension and citycode attribute.
If user is mapped to any one of above role dimension security is working perfectly according to the logic but mapped to both role, cube is exposing all the data in this case dimension security is not working.
Please give me the solution to fix this issue or incase I am wrong kindly advice.
Thanks
Ganesh

This is the expected behaviour as allowed sets in roles are unioned together.
This is not a problem when your roles are restricting across a single attribute.
eg.
US_role = {[Geography].[Country].[USA]
France_role = {[Geography].[Country].[France] }
as someone in both roles ends up seeing {[Geography].[Country].[USA], [Geography].[Country].[France] }
But when you have different attributes:
NY_role = {[Geography].[City].[New York] }
France_role = {[Geography].[Country].[France] }
The first role is unrestricted on countries and the second is unrestriced on cities which is effectively:
NY_role = {[Geography].[Country].AllMembers , [Geography].[City].[New York] }
France_role = {[Geography].[Country].[France], [Geography].[City].AllMembers }
And when you union those two sets together you end up with:
{[Geography].[Country].AllMembers , [Geography].[City].AllMembers }
Which means that someone in both roles can see everything.
So if you want to restrict someone to City = New York and Country = France you have to create a
single role where both attributes are restricted. So if you have a lot of these combinations you will either have to create a lot of "combination" roles or look at dynamic security.
The other thing that might work is make sure that you only give some users access to certain cities and others access to certain countries. It's the mixing of the two for a single person that causes the issues.
http://darren.gosbell.com - please mark correct answers

Secure boot not working with MSI Z77a-G45 And system reserve not showing

Ok so i re did my windows after i did a zero fill on my hard drive as it was showing a corrupted sector on my disk that seemed to fix it for now, until it comes back if it does crossing my fingers it gone for good. But now i can't seem to get Secure boot to work i mean i did not have it before as i just slapped the motherboard in with a existing windows, that was to be expected but this is a clean install of windows 8.1 and i even have secure boot on but its not working and reports as off in windows. Is it because i have my bios set to legacy+UEFI??? would that make secure boot not work??. i even went as far as turning it off and back on again the secure boot setting nothing made a difference. I mean its not a big deal bit would be nice to know why its not working, also another wired thing and i will post pictures of it, as i cant see my system reserved partition in disk management but diskpart says it there, i will post those pictures any ideas??.

fixed it is my legacy+uefi another forum got back to me.

Roaming profiles not working from time to time

We have 6 Terminal servers and at random on the servers and at random with the users, the roaming profile will not be delete after the users log off.
The folder that remains in the user folder, this folder however is empty, not even hidden folders or files are present: C:\Users\"username"\AppData\LocalLow\Microsoft\CryptnetUrlCache
What we have tried is to run a log off script that has following in it "net stop CryptSvc" but this also does not work. We have had 6 users again today that had the problem. All on different servers.
We can manually delete the users folders without any problems when the problem occurs but this is not something that we would like to do every day.
I see a lot of similar problems but nowhere a real solution for this.
Ah the event viewer:
Windows cannot delete the profile directory C:\Users\"username". This error may be caused by files in this directory being used by another program.
DETAIL - The directory is not empty.
- System
- Provider
[ Name] Microsoft-Windows-User Profiles Service
[ Guid] {89B1E9F0-5AFF-44A6-9B44-0A07A7CE5845}
   EventID 1533
   Version 0
   Level 2
   Task 0
   Opcode 0
   Keywords 0x8000000000000000
   - TimeCreated
[ SystemTime] 2014-06-06T07:27:05.906799700Z
   EventRecordID 777512
   Correlation
   - Execution
[ ProcessID] 900
[ ThreadID] 6092
   Channel Application
   Computer TS05."domain".be
   - Security
[ UserID] S-1-5-18
- EventData
Folder C:\Users\"username"
Error The directory is not empty.
Services installed:
- File Services
° File Server
° Services for Network File System
- Remote Desktop Services
° Remote Desktop Session Host
All the latest updates have been installed on all the terminal servers. The users are on different servers who have the problems and they aren't always the same users who have the problems so
don't start by asking if everything is configured correctly cause that is the case!

Thank you for your answer.
The entry in that registry key remains indeed there. Is it safe to just remove that registry key when the user is no longer logged into that specific server?
The KB that you have send me is with the following explanation:
Notes
This issue occurs when the Windows Search service is enabled.
When this issue occurs, the registry subkey that represents the stale user profile is deleted. This subkey appears in the following location:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
But we do not have the Windows Search service installed nor is it enabled in the services list? But the subkey does remain in the registry.
With kind regards,
Thijs

The pdf security is not working in Flash Paper

Is anyone facing a similar problem.
The pdf security if applied with a passsword to select the
text & graphics, printing, etc does not work. It selects any
and every text in flash paper and pdf. Does anyone know how can one
prevent to copy any text or graphics ...

I have the same issue. My phone says the files are corrupt and they stay corrupt if I forward then from my phone. It like the phone checks for something in the PDF, when it never did before.

PSE 11 - MacOX 10.7.5 Printing Wide Format Printer and Profiles Not Working Correctly

Macosx 10.7.5
When I start up PSE11 and go to print I set up the paper size then select a Printer Profile. When print the image it is a mess and seem to be black and white it is as if I printed on the wrong side of the paper.
I then go and try to print it again.   Now it all works as it should beutiful colours and spot on. all other print following this works.
Then I shut down PSE11.   Start it up again. Guess what first print is a mess again.   all others after are fine.
I uninstalled PSE11, deleted prefs. and reinstalled PSE11.    Same thing..   first print a mess all others ok.
the issue can be replicated consistantly......
no problems with PSE10 or PSE9
any suggestions?????
cheers elo

Thank You for your suggestions.
I have been printing using PSE for over 14 years going back before the term PSE came up. I have done this professionally using profiles from others and those I generate myself..
All the things you mentioned have been done.
The main point missing in your suggestions is   It is only the first print every time I open up PSE11 that does not work...
at completion of print I immediately go back to the file command and say print and then bypass all settings and print again.   this time and every other print aafter are perfect...      I did not change one single setting...
I know about printer and adobe settings etc.     but thanks for going through the list it was a good reminder of how to remember everything sometimes we rush and forget something...
Finally    It works PSE6, PSE9, PSE10, CS5, Lightroom 4.   I think I have the settings right......
Any suggestions for how to get PSE11 to force the settings for the first print would be appreciated..
Only thing I have not done is upgrade to the latest version of the epson driver. Released less than a month ago to provide support for mountain lion.(iam only on lion) Maybe just maybe???   you never know.   Will try this when I finish by next batch of prints.
I will back up as I do weekly...    Still have the old driver from way back in release 10.5.8   will try to fire up to 10.5.8 and see what happens....
cheers elo
Message was edited by: Elo Laugesen

ADF security logout not working

Hi,
Using ADF Faces and JDeveloper 11.1.1.1.0 (5407).
I have a secure ADF application, my login is working fine, however once I attempt to perform a logout using methods indicated in both the Fusion Developer's Guide and various blog posts my application begins to act strangely.
Using the Forms based authentication I have login.html and error.html setup and working.
I have a home.jspx (unsecured, no bindings whatsoever) as my landing page, and welcome.jspx as my successful authentication redirect page, both on my adfc-config diagram and with a control flow case 'login' between them.
In my jazn-data.xml file I have granted the 'authenticated-role' access to the welcome page.
The web.xml file includes the login.html and error.html files listed.
The above works, I can login and am successfully redirected to the welcome page with a user account I have specified, and if I use wrong login information I am redirected to error.html.
Now, I have tried 2 methods to get LOGOUT working properly and both are not working.
Firstly and most simply I tried using the following on my welcome page:
<af:commandNavigationItem text="Logout" id="cni1" destination="/adfAuthentication?logout=true&end_url=faces/home.jspx"/>When I click the link, this does redirect me to the home page and there are no warnings/errors in the server log.
However... when I then click on the Login link on the home page that should prompt me to login again, the home page just flickers and nothing happens. Again no warnings/errors in logs.
I am then forever stuck on the home page.
The second method I tried involves using a backing bean, which I have registered in my adfc-config.xml file with 'request' scope.
On my welcome.jspx:
<af:commandLink text="Logout" id="gl1" action="#{loginBean.doLogout}"/>My link calls the doLogout() method in my backing bean containing:
import java.io.IOException;
import javax.faces.context.ExternalContext;
import javax.faces.context.FacesContext;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
public String doLogout() throws IOException {
    ExternalContext ectx = FacesContext.getCurrentInstance().getExternalContext();
    HttpServletResponse response = (HttpServletResponse)ectx.getResponse();
    HttpSession session = (HttpSession)ectx.getSession(false);
    session.invalidate();
    response.sendRedirect("home.jspx");
    return null;
}The application DOES redirect me to home.jspx however I get the following error in the logs:
java.lang.IllegalStateException: Cannot forward a response that is already committed
     at weblogic.servlet.internal.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:122)
     at com.sun.faces.context.ExternalContextImpl.dispatch(ExternalContextImpl.java:410)
     at org.apache.myfaces.trinidad.context.ExternalContextDecorator.dispatch(ExternalContextDecorator.java:44)
     at org.apache.myfaces.trinidad.context.ExternalContextDecorator.dispatch(ExternalContextDecorator.java:44)
     at org.apache.myfaces.trinidad.context.ExternalContextDecorator.dispatch(ExternalContextDecorator.java:44)
     Truncated. see log file for complete stacktrace
AND...the same thing happens as with my other attempt, I am stuck on the home page and clicking the login link just flickers the page.
I feel as if I have followed the Fusion Developer's Guide on how to do this down to a T, however I am not getting a working solution.
Any help would be greatly appreciated.
Thankyou,
Matthew.

I have had a few developments...
I found out that after I have been redirected to home.jspx where my Login link just refreshes the page on click... if I instead manually change the end of the URL in the address bar of my browser to /welcome.jspx, then it works...I get prompted to login again. This proves that I am actually being logged out, if I change the URL manually before I click my logout link (calling the logout method) it does not request for me to log in again.
So it seems that the problem lies with my action reference on my login link.
<af:commandLink text="Enter" id="cl1" action="login" inlineStyle="font-size:small;"/>the action 'login' works UNTIL i logout, then it does not work anymore...
Second to this, I tried a different LOGIN method using:
<af:commandNavigationItem text="Login" id="cni1" inlineStyle="font-size:small; text-decoration:none;"
                                        destination="/adfAuthentication?success_url=faces/welcome.jspx"/>When using this way to login, I can login, logout AND LOG BACK IN successfully...
However as soon as I click on ANY component that uses a control flow case it just refreshes the page.
re-proving from the first example that the problem is that control flow cases stop working after a logout.
so basically, once I log out and then try to navigate a control flow case, the page I am on just refreshes and the navigation does not occur.
Surely someone now can elaborate on this.
Regards,
Matthew.

Icc Profile not working

Hi,
This is on a 2011 macbook pro with mountain lion. I have tried to use two new icc profiles, put them in:
library-colorsync-profiles-recommended
and while they work in preview, and illustrator, they will not work in photoshop. I go through the print dialog, with photoshop managing colors, select icc profile. Hit print, try to open pdf in preview, and it's all white (this only after blanks were printed out). I have tried, tested, and no luck.
Please help, thanks!

Ah-the driver is name is: mcpd-mac-pro9000ii-10_68_1-ea11.dmg
First thing I tried to do is delete and re-download new driver, but no luck.

Oracle 10g RAC SQL profiles not working for both the nodes

We have identified a long running sql.
Used Advisor to tune the sql
Applied the suggested sql_profile as per the recommendation.
when we re-run the sql from application, due to RAC setup the sql hit the other node, used the sql profile as indicated by v$sql but was long running.
it generated a new sql_id due to which we think it was not working.
Could you please advice how to apply sql_profile for both nodes?

HI Arun
Would you please post that in the GRID RAC section of this forum please ?
Please consult the following documents to get support on your question:
http://download.oracle.com/docs/cd/B19306_01/rac.102/b14197/votocr.htm#sthref211
http://download.oracle.com/docs/cd/B19306_01/install.102/b14205/undrstnd.htm#RISOL2610
Thanks

IOS Device-Sensor and ISE profiling not working

Hello,
I configured IOS device-sensor on one 2960CG-8-TCL switch. IOS is 15.2(2)E.
Switchconfig:
device-sensor filter-list dhcp list dhcp-list
option name host-name
device-sensor filter-spec dhcp include list dhcp-list
device-sensor accounting
device-sensor notify all-changes
Switch does DHCP-Snooping and "show device-sensor cache all" shows the DHCP name:
Device: b2b5.2fff.sa43 on port GigabitEthernet0/1
Proto Type:Name                       Len Value
DHCP    12:host-name                   17 0C 0F 11 31 22 41 50 43 33 31 32 30 30 30 37 38
                                          38
RADIUS probe on ISE is activated and TCPdump shows the accounting packets from the switch (see attachment).
I configured a profiling rule ot check for DHCP-Hostname with "contains". This rule does not work however. The device is getting profiled with a MAC-OUI via RADIUS-probe but the DHCP-Profile is not working.
Is this supposed to work?

That is interesting. I haven't worked with the "Device Sensor" much so I am running out of ideas. I really thought the certainty level was going to fix your issue as I have had issues similar like yours in the past where the certainty level of my custom rule was the same as a default one so mine custom rule was never hit. . I thought this was the case with you since your device was hitting the parent policy of "HP-Device" but not moving any further. With that being  l would still recommend keeping your custom conditions with higher certainty levels to avoid such situations.
Couple of more things:
1. What profiling probes do you have enabled?
2. Have you tried retrieving the DHCP hostname via another sensor/method. For example, via the DHCP probe and ip-helper?
3. Do you have the following commands entered on your switch:
access-session template monitor
no macro auto monitor
device-sensor accounting
device-sensor notify all-changes

Roaming profile not working anymore

hi
im definitely shure, in a earlier version of ZCM 10.0, the Roaming Profile to the Home directory did work and so, i never checked this since then.
now i updated to 10.3.1 and roaming profile does not work anymore. the local profile gets not copied to the Home-Directory on the server, it doesnt depends, if i have the "Edir Home" set or the real path to the directory.....
where can i start to search for this problem ? i was so shortly to go "productiv".......but no, there is again a delay after 6 Months waiting and testing....:-(
it's so sad ! Zenworks is not that quality product it was.....
Sascha

hi craig
sorry, about not enough informations.....
- no, all clients are only in the E-Dir
- Clients are Windows XP SP2 with Novell Client 4.9 SP2, but tested also higher ones...
- Home-directory is on a Netware 6.5 SP8
- ZCM Server is SLES 10 SP3 without OES
thanks
Sascha
>>> craig wilson<[email protected]> 27.08.2010 17:36 >>>
Are your devices a member of a Windows Domain?
What Client OS?
What type of Server do the Home Directories reside?
On 8/27/2010 11:17 AM, Sascha Oetiker wrote:
> hi
> im definitely shure, in a earlier version of ZCM 10.0, the Roaming
> Profile to the Home directory did work and so, i never checked this
> since then.
> now i updated to 10.3.1 and roaming profile does not work anymore. the
> local profile gets not copied to the Home-Directory on the server, it
> doesnt depends, if i have the "Edir Home" set or the real path to the
> directory.....
> where can i start to search for this problem ? i was so shortly to go
> "productiv".......but no, there is again a delay after 6 Months waiting
> and testing....:-(
> it's so sad ! Zenworks is not that quality product it was.....
> Sascha
Craig Wilson - MCNE, MCSE, CCNA
Novell Knowledge Partner
Novell does not officially monitor these forums.
Suggestions/Opinions/Statements made by me are solely my own.
These thoughts may not be shared by either Novell or any rational human.

USB security key not working with Mac

Hello! I have a windows compatible medical program that I am trying to run on parallels on my mac. The program uses a USB security key to work. Mac nor parallels (i have win XP running on it) is detecting my security key. The key is recognized on a different windows XP PC though. any thought??? greatly appreciated!

Hi OGELTHORPE,
My USB stick was originally formatted as MS-DOS (FAT) as default and out of the box. As I understand this is the same as FAT32 on Win (?)
MS-DOS (FAT) configuration was however what led to all of my problems stated above.
That is why I'm confused.
Before writing to the discussion board, I reconfigured the stick to ExFat, based on some similar research, but an article discussion advised the ExFat not to be a stable nor reliable configuration. I do not know why this issue was mentioned, but several users logged this as an issue of the ExFat.
If you have a USB stick meant for Mac use only, not cross-platform, do you alter configuration from MS-DOS (FAT)?
(Primary use is for Mac backup only, I'm willing to give up the cross-platform requirement)
I also don't understand why my Mac didn't detect a second USB stick, prior used on a different Mac.
Thanks!

Profiles not working as expected

I have created a simple publication for a webi report using efashion uiniverse. It's in BO 4.0. I have created 2 profiles. One is State=California and another is Month= 2. If I add any one of the profile to the publication, it works fine.
Example:
Case 1: when I add the profile state=california to the publication, i get data for only state=California.
Case 2: If i remove the profile state=california and add profile month= 2 to the publication , then i get data only for month=2.
Case 3: Now if I add both the profiles state=california and month=2, i get data for sate=california and for all the months. The profile month=2 doesn't get applied.
what's happening is that the profile which is added first is getting processed while the profile added second is not working. If I add the profile month=2 first and then profile state=california, then only month =2 gets applied and not state=california.
Is there any settings that may be causing this behaviour?
Below is the log :
2012-01-17 01:57:44,072 INFO [PublishingService:RunInstancePool-1] BusinessObjects_PublicationAdminLog_Instance_48714 - [Publication ID # 48714] - Running publication instance.
2012-01-17 01:57:44,519 INFO [PublishingService:RunInstancePool-1] BusinessObjects_PublicationAdminLog_Instance_48714 - [Publication ID # 48714] - The global delivery rule for this publication was met; publication processing will now begin.
2012-01-17 01:57:46,168 INFO [PublishingService:HandlerPool-0] BusinessObjects_PublicationAdminLog_Instance_48714 - [Publication ID # 48714] - Document jobs started for scope batch 48,721 [recipients "PGOWDA" to "PGOWDA"].
2012-01-17 01:58:31,695 INFO [PublishingService:HandlerPool-0] BusinessObjects_PublicationAdminLog_Instance_48714 - [Publication ID # 48714] - Distribution jobs started for scope batch 48,721 [recipients "PGOWDA" to "PGOWDA"].
2012-01-17 01:58:42,272 INFO [PublishingService:HandlerPool-0] BusinessObjects_PublicationAdminLog_Instance_48714 - [Publication ID # 48714] - Distribution to destination CrystalEnterprise.Managed was successful. Recipient: PGOWDA, Document Scope: Sales Revenue by Sates : 48730 (Excel) : (AND (IN_LIST Month "3" )(IN_LIST State "California" )).
2012-01-17 01:58:42,797 INFO [PublishingService:RunInstancePool-1] BusinessObjects_PublicationAdminLog_Instance_48714 - [Publication ID # 48714] - Publication scheduling complete.

If I'm not wrong there are some considerations you must apply in your publication. Check in this guide:
http://help.sap.com/businessobject/product_guides/boexir31/en/xi3-1_bip_admin_en.pdf
Page: 942 Chapter Managing profiles
regards
Erika

Security Profile not taking effect.

Hi,
I created a new responsibility such is pretty much a cut down version of Oracle standard ' Manager Self Service' responsibility.
I have created a new security profile which I want it to restrict the list of employees to a particular person i.e 'John Smith'. The user of this responsibility should only be able to process manager self service function for John Smith.
I have then attach the security profile to the responsibility and bounched Apache. But after testing the responsibility it is producing the list of employees who the user is supervisor of. I dont't want it to list the user's employees, I want it to bring up just John Smith.
Please what am I missing? Why is it base on supervisor hierarchy and not my security profile?
Regards
TL

Vignesh,
What I am saying is when I create security profile and attach it to the responsibility my security changes is not reflecting at all. The responsibility I created is similar to seeded 'Manager Self Service'.The list of employees it shows on self service is based on supervisor hierarchy.I want to know how it knows to produce employees using supervisor hierarchy and why its not producing the list of employees as defined in the security profile.
I have even made a change to another security profile, by changing the top organisation. After I assign this security profile to the seeded 'HR Profession V4' responsibility it doesn't reflect the change. This responsibility is still able to see everyone in the business and not restricting it to the top organisation.
Is there a step I'm missing? Is there a menu function that is overriding my security profile?
Regards
TL

HR PD profile not working

Dear Experts
the below solution earlier it is worked but after system refresh it is not working?????????????????????????????/
We have created the below PD profile based on the given requirement but when I assigned to person and check on" i" button in OOSB to see how many objects that he can able to see ..value is nill
1. Req : create only one PD profile that should be assigned to the chief positions in org so that chiefs can see only the data that of positions/orgunits that are assign under him..
Name : Manager
No : 0
Plan Ver : 01
Obj type : O
Object : 0 "here we dont maintaining any values, this values is pulled using the funtional module that assign"
maintain : yes
Eval Path : o-o-s-p
status vector = 12
depth = 0
sign =
period =
function module = RH_GET_MANAGER_ASSIGNMENT

Try executing following tcodes instead which calls the reports:
Step 1. S_PH0_48000112 - Check and Compare T77UU
Step 2. S_PH0_48000110 - Regeneration INDX for Struct.Auth
But if HRP1001 doesnot has entry then you might need to assign the org units to your users again via tcode PP01/PO13. To automate you can use a eCatt or LSMW script and use PP02 to assign org units to mass users by inputting the mapping of User ID/Position to Org units with appropriate relationship.
Let me know how it looks like after running the above tcodes.
P.S: Sorry for the typo, the reports are RHBAUS02 and RHBAUS00. Also change value of field "Threshold Value" to 1 for report RHBAUS02/tcode- S_PH0_48000112 before executing it
Thanks,
Sandipan
Edited by: Sandipan Choudhury on Jan 3, 2011 12:02 PM

Security Profile Not Working

Similar Messages

Maybe you are looking for