Sharing of MS Access DB and MS Jet Database Engine

We are using MS Access 2003.  We have placed the mdb file on a shared server with the OS being MS Windows Server 2003 standard edition.   Each user has their own version of MS Access 2003 on their local macine. 
Question: Where is the MS Jet Database Engine running?  I know the data, macro's, screens, etc. are stored in the mdb file on the shared server.  When one of the users run a macro, is that running on the server machine
or on their local machine?  In other words, does the server machine have to have a compatible MS Jet Database Engine available within the OS for the macros and database updates to work or is everthing just stored in the mdb file and I
need to move the shared database files to another machine.

Gobi, MS Access is not a true relational database manager product even though it has tables. It would be wise to revisit the basic design to ensure it is in fact relational before moving it to either SQL Server or Oracle.
Each of these database products work very differently internally from Access and from each other so once a choice is made which database manager to use the chosen database should be carefully studied to learn how it works before starting to port the application.
Both products have documentation sets that should be studied by everyone involved.
I work with both products and SQL Server has its strengths and works well with small user loads, but the larger the user load and the more concurrent activity on single tables the more I would lean toward Oracle. Also SQL Server 2005 is vastly superior to SQL Server 2000 in that it can make use of more than 2G of memory by default.
HTH -- Mark D Powell --

Similar Messages

SSIS package "The Microsoft Jet database engine cannot open the file"

Dear all,
I am trying to import data from an excel spreadsheet which is save on application sharing server. When I try to save same file locally (On my desktop) my package has no problem to read it. Problem comes when I change the file path to the share location
I am getting below error message,
"Version 11.0.2100.60 for 32-bit Copyright (C) Microsoft Corporation. All rights reserved. Started: 13:26:46 Error: 2014-12-05 13:26:50.30 Code: 0xC0202009 Source: Incremental MasterStyle DL
Connection manager "Excel Connection Manager" Description: SSIS Error Code DTS_E_OLEDBERROR. An OLE DB error has occurred. Error code: 0x80004005. An OLE DB record is available. Source: "Microsoft JET Database
Engine" Hresult: 0x80004005 Description: "The Microsoft Jet database engine cannot open the file ''. It is already opened exclusively by another user, or you need permission to view its data.". End Error Error:
2014-12-05 13:26:50.30 Code: 0xC020801C Source: Data Flow Task 1 Excel Source [36] Description: SSIS Error Code DTS_E_CANNOTACQUIRECONNECTIONFROMCONNECTIONMANAGER. The AcquireConnection method call to the connection
manager "Excel Connection Manager" failed with error code 0xC0202009. There may be error messages posted before this with more information on why the AcquireConnection method call failed. End Error Error: 2014-12-05 13:26:50.30
Code: 0xC0047017 Source: Data Flow Task 1 SSIS.Pipeline Description: Excel Source failed validation and returned error code 0xC020801C. End Error Error: 2014-12-05 13:26:50.30 Code: 0xC004700C
Source: Data Flow Task 1 SSIS.Pipeline Description: One or more component failed validation. End Error Error: 2014-12-05 13:26:50.30 Code: 0xC0024107 Source: Data Flow Task 1
Description: There were errors during task validation. End Error DTExec: The package execution returned DTSER_FAILURE (1). Started: 13:26:46 Finished: 13:26:50 Elapsed: 3.401 seconds. The package execution
failed. The step failed."
I am trying to run this package as an sql server agent job and server is installed on my Machine. I have created proxy account with my own credential to execute it. I have full excess to the spread sheet and can open it in an excel program. Please
suggest what could be the reason why sql job is not able to access this spreadsheet. I can think of below reasons
File is password protected and I am not using its password to unlock it?
My domain account is a part of It Admin group with high previllages
when I installed my SQL server I installed it as a standalone instance of SQL server?
please advise.
regards
JKH

Hi Jahangir,
Based on the error message that "The Microsoft Jet database engine cannot open the file ''. It is already opened exclusively by another user, or you need permission to view its data.", there are two causes:
The account that SQL Agent is using does not have the correct permissions for the file or for the folder that contains the file.
Another process or user has the file open.
The following resolutions correspond to the previous list of causes:
Since you use a network path to the file (UNC), check the account permissions on the share, the file, and the folder.
The "another user" may be Microsoft Visual InterDev. Close any Visual InterDev projects that contain a data connection to the file. Please close all instances of excel file and re-run the package.
Besides, we can use a tool like
SQL Server Profiler to see what is happening when you run the package.
Thanks,
Katherine Xiong
Katherine Xiong
TechNet Community Support

Microsoft Jet database engine

I purchased SatelliteDirrectTV, used it for more than a year and then was suddenly cut off. The company simply would not respond to my emails. I have another company's software "Incline Global" but when trying to install I get a message saying "The Mocrosoft Jet database engine cannot open the file 'C:\Program Files (x86)\ Incline Global\ It is already opened exclusively by another user, or you need permision to view its data" Is there a way to reset this? I have already tried "reset" and "recovery" also upgraded to Windows 8.1 and still get the same message. Any suggetstion would be helpful. PC77

thanks so much for your reply. i have made no changes recently on the site. how do i determine if this is occuring locally or remotely? anyone visiting remove.canchair.com and clicking the submit button receives this error so i suppose remotely?
do you think this needs to be taken up with my site hosting company?

MS Access, SharePoint and Security

Let's say I sign up for Office 365.
I use the SharePoint Site that comes with it to house my MS Access Lists and my compiled database *.accmde file.
Can I set up a separate sub-site with only admin access to house a list of userID's and passwords so that when the user runs the database, it looks up this list and identifies the user, type of user, and which filter for the data in the full access sites.
If that works, then I would also want to put the data in a limited sub-site and have the accmde file retrieve that data behind the scenes. I would like to limit accidental access to the data if at all possible.
Any suggestions on how to design the tool for this?
Frank

Hi FrankHayAlexcander
It seems you have the following questions about hosting Access data on Office 365
Can Access connect to multiple SharePoint sub-site?
Can you store User info in one sub-site to control what data the user sees?
Can you hide these sub-sites so that users can't accidentally see this data?
The short answer is that I'm not sure that what you are trying to do is even possible in a Web database published to SharePoint, and certainly would be very difficult in a traditional database.
If you create a Web database in Access 2010 and publish it to SharePoint, then it is limited to the tables / SharePoint Lists in that sub-site.
In this case the credentials of the user are passed to SharePoint to retrieve data. This means that to read the list the user would have to have permissions and so they could go out the site directly and see the same data.
Using SharePoint permissions you could control what the user can see, but Access isn't going to be able to add much to that.
If you create a traditional database, then you can link to lists in multiple SharePoint site as well as other providers like SQL, and Excel.
When you created the link table here you have the option to store the credentials with the linked table.
If you do not store the credentials the user will be prompted for the credentials to use.
You could store the credentials for an Admin user when you link the table, but the problem is that if a user opens your database in the full version of Access can get to the linked tables, they will be able to see all of the data anyway.
When it comes to security, the best answer is always to secure the data using the native features of the data store such as SharePoint, SQL, etc.
Best Regards,
Nathan Ost
Microsoft Online Community Support
Please remember to click "Mark as Answer" on the post that helps you, and to click "Unmark as Answer" if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Why is the Microsoft Office Access Database Engine data source looking for a workgroup information file?

While trying to import to MSSQL2012 from SSDT using the wizard from an Access 2013 DB (.accdb) which is password protected, I get the following error with the username blank and the password field correctly populated:
Cannot start your application. The workgroup information file is missing or opened exclusively by another user. (MicrosoftOffice Access Database Engine)
But according to this link:
http://office.microsoft.com/en-us/access-help/what-happened-to-user-level-security-HA010342116.aspx
MSA10 and beyond shouldn't need workgroup information files, although it's not clear to me if they are
created/used or not.
I can point the wizard to some local version of system.mdw at Advanced -> All -> Jet OLEDB:System Database, and then the error becomes:
Not a valid account name or password. (Microsoft Office Access Database Engine)
for any username I can think of.
Questions:
1. Why does this data source insist on looking for a workgroup information file even though user-level security should be disabled?
2. Why does the Open dialog box for the Microsoft Access Database Engine have *.mdb as the only selectable filetype?
3. How can I get around these errors for an .accdb that is password protected?
Thanks!

Hi JordanPG,
To connect to Access 2007 or later database, we need the Microsoft ACE 12.0 OLE DB driver. SQL Server only installs the Microsoft Jet 4.0 OLE DB driver which can be used to connect to Access 2003 or earlier database. Besides, the Microsoft Jet 4.0 OLE DB
driver only has 32-bit version, but the Microsoft ACE 12.0 OLE DB driver has both 32-bit and 64-bit version. However, the 32-bit and 64-bit Microsoft ACE 12.0 OLE DB drivers cannot be installed on a single server.
According to your description, you can use the 64-bit SQL Server Import and Export Wizard to load data from the Access database, so the 64-bit Microsoft ACE 12.0 OLE DB driver is installed on your computer. Since the BIDS/SSDT is a 32-bit application, the
64-bit Microsoft ACE 12.0 OLE DB Provider is not visible in BIDS/SSDT. So, when you said that you select “Microsoft Access (Microsoft Access Database Engine)" in the SQL Server Import and Export Wizard (it is actually the 32-bit version) started by the SSDT,
I think it should be “Microsoft Access (Microsoft Jet Database Engine)”. Because the Microsoft Jet 4.0 OLE DB driver only supports Access 2003 or earlier format, it threw the error “Test connection failed because of an error in initializing provider. Unrecognized
database format 'C:\myDB.accdb'”.
In this situation, you have two approaches to avoid this issue:
Launch the SQL Server Import and Export Wizard (64-bit), and select “Save SSIS Package” to “File System” on the “Save and Run Package” page. Then, the package will be saved to a specified directory. After that, you can add this existing package to a SSIS
project. The status of the corresponding OLE DB Connection Manager should be Work Offline, or the OLE DB Source will throw an error about 32-bit driver if the Connection Manager is not in Work Offline status, you can ignore that and the package can run successfully
in SSDT as long as the project is set to run in 64-bit runtime mode.
However, for the SSDT 2012 integrated with Visual Studio 2012, the 64-bit runtime mode is disabled. In this situation, to run the package in SSDT, you have to uninstall the 64-bit Microsoft ACE 12.0 OLE DB drivers and install the 32-bit one. Here is the
download link:
http://www.microsoft.com/en-in/download/details.aspx?id=13255
Regards,
Mike Yin
TechNet Community Support

Accessing music and photos from shared libraries in imovie and other apps

ihave a problem that i'm not sure is solvable. i have a mac mini that i use to hold all my music in itunes, photos in iphoto and share this with my other mac by turning on the sharing in itunes and iphoto. this means on my other mac, i can access music and photos using the shared music and photos facility in those programs. however, when i want to add music or photos into imovie using the media tab in imovie on my other mac, it doesn't show the shared libraries. i also have the same problem in final cut pro. is there anyway to make these programs see shared libraries of photos of music that sit on another mac on the network?

Mac on Andy,
If you copy the photos you wish to use to your iPhoto local library you'll then have access in to them in the media pane of iMovie.
However, iTunes will not allow you to do the same thing with songs.
As a workaround you could enable File Sharing and then mount the mini as a server. In the Finder you'll need to then rummage around in the mini's iTunes library to find the tracks you need, but it should work.
More information here:
http://docs.info.apple.com/article.html?artnum=106461
Matt

Each time I try to access music and photos on Apple TV it asks me to turn sharing on in iTunes. When I go to sharing it says it's on and I have to turn it off then on again to get it to work. Is there a way to avoid this?

Each time I try to access music and photos on Apple TV it asks me to turn on sharing. Sharing is on and I have to turn it off then turn it on again to get it to work. Is there a way to avoid all this work every time I wish to play iTunes through my TV?

Welcome to the Apple Community and a merry Christmas.
Start here, and reset your security questions, you will receive an email to your rescue address, use the link in the email and reset your security questions.
If that doesn't help or you don't have a rescue address, you might try contacting Apple throughiTunes Store Support

MS Access Freezes and Closes when I save a draft email via Outlook 2013

I have Access 2013 Office 365. When I email a report from access via Outlook 2013 I have problems. Outlook opens fine. If I hit send everything is fine. However if I save the email as a draft Access freezes and then closes after a 10- 15 sec delay.
The email is saved as a draft in Outlook but very annoying to have to reopen my Database .
The message I get is : MS Access has stopped working. A problem caused the program to stop working correctly. Windows will close the program and notify you if a solution is available
I tried compact and repair but that didn't help. Also tried turned of add ons. That didn't work.
Never had this problem with office 2010. What can I do?
I just discovered the same thing is happening in Excel and Word.

Hi all,
Thanks for visiting our forum and sharing your experience here. It'll be benefited to our communicator.
Have a good time.
Regards,
George Zhao
TechNet Community Support

How do I setup a wireless file sharing network with a desktop and laptop?

Here are the specs.
Desktop, 1 Ethernet, hooked to Wireless router and is my main computer. XP Professional
Router, Wireless Linksys WRT54GL
Laptop, Wireless card and Ethernet. XP Home
Both the Desktop and Laptop can use the internet. The internet can be accessed by both computers. I have tried everything from creating a network via windows, messed with that for a couple days, tried programs and messed with them for a few hours.
I can sometimes see the other computer, when I deleted the programs I had to redo it, and so on. I made the folders I wanted shared, through the share menu when you right click on them, and they show up on the other computer, but I can't access them. It says I don't have access rights and to contact the administrator, but IM the administrator.
So, what do I do?

Disable all firewall on both the computers ....
Try to ping one computer to another ... see if it works ....
Also you can try this link ..... useful for enabling the sharing of files in a network ...

How to configure Time Capsule etc as a local network server with remote access server and for backups

I'm trying to set up new 3TB Time Capsule as a wireless network server (with remote access) and for backups for use in a small office (of two Macs). We have a late 2011 Intel MBP and a brand new MBA both running 10.8.3. We have two external 1TB hard drives that until now have been attached the MBP for storage and backing up that computer, which up until now was the only machine in use. The MBA is for a new employee and we need to share and work on the same files, both here in the office and ideally remotely too via Back to my Mac. The MBP needs constant access. The MBA only occasional. The TC has 7.6.3 firmware and we've set it up using AirPort Utility 6.2. It is currently attached to the MBP via ethernet and it has internet access via a Sagemcom router attached to TC's WAN port.
We've managed to set up a wireless network and both have wireless internet access through the TC
But there are so many issues I don't know where to begin - so I'll start with a description of what we're trying to achieve:
I planned to use the TC as the main server drive and place all the key folders and files there so that both of us can access them wirelessly and remotely. The MBP would back up to the TC and to one or two of the external hard drives - one being attached to the Mac via USB and the other being attached to the TC's USB port. We would back up the important data on the TC using SuperDuper and copy it to both external USB drives.
So , first of all, is that a sensible configuration? Should the 'server' be the one of the external hard drives attached to the TC USB port, backed up regularly to the TC using SuperDuper?

But when you say 'So using USB drive does make sense if you want to use it as a file store', do you mean a USB drive plugged into the TC? I hope that I can attach an external drive to the TC so we can all access and read/write the content wirelessly via the TC network or remotely.
Yes, USB.. as it prevents the sparsebundle mixing with data files. I guess it does depend on how much data you are talking about.. you can use the TC internal disk if you are careful and setup the sparsebundle with fixed sizes once you create them..
And to be clear, I wasn't planning on backing up remotely via BTMM - only to access the shared folders on the TC data drive or USB external drive attached to it. I'm assuming that's ok?
Yes, that is fine. Sorry I got the impression you were going to do backup over internet.
What is the alternative? Having a Mac Mini that's always on? Do I need OS X Server etc.?
A mini would be great.. you don't need server edition.. but I would see how the TC goes.. since you have it and it is much lower power consumption device. It is just that its design is not really for file storage.
One big problem I have is to do with the sharing permissions. For everything on the TC or attached external drive attached to it, it says I have only custom access and every time I try to change permissions it says I don't have the permission to do that. And if I try to change the owner it says my user name is not valid.
How is the security setup on the TC?
The security is a bit tricky.. I must admit since I run windows computer in the network, that I simply turn on the guest account to read and write access. For a business setup that might not be adequate but it allows me full access to all the files.
If you setup the TC with user accounts then you are in trouble. That makes it very difficult to access, especially if one person already has the file open you may find a second user cannot login. I am not sure as I have avoided the security. IMHO it is meaningless.. since anyone with physical access to the TC can press the reset for one second and has full access.. and can add or change passwords.

Problems with a shared calendar using Outlook 2007 and Exchange 2010

Hello all,
We are having a problem with sharing a calendar using Outlook 2007 and Exchange 2010.
I will start with some background. I have just started my position with this company. I have been working with networks for awhile at the small business level. I have not had much production experience with exchange. There is only myself and my supervisor
who has inherited a midsized network which was built by five previous techs that are no longer with the company. Of course, the previous techs did not leave much documentation, so the original hows and whys for our system setup has been lost.
One of the managers has a calendar she shares with some of our users. I believe this calendar has been in use since sometime in 2006. A mailbox was created to hold this calendar to keep it separate from the managers calendar. I am not sure what version
of exchange they were using at that time, but I assume there was one or two migrations of it getting to its current state on our exchange 2010 server. At some point it was observed that the other workers she was sharing with were not able to access it correctly.
I am not fully sure what the original problem was (possibly some people not being able to see or connect to the calendar), but it was decided to give everyone who needed access to this calendar full access permissions through exchange. Correct me if I
am wrong, but I believe that gave everyone connected the ability to do anything with the calendar. Of course the manager was not happy about that. This is where I started working on the problem.
I removed everyone, except the manager who wants to control the calendar, from having "Full Access Permissions". This did have the effect of making some people just able to see the calendar and not make changes. Though there were others that were
able to connect to the calendar who I thought would not be able to. The manager that originally created the calendar did try to manage access to it through the Outlook interface, though it currently does not seem to be fully in effect.
So, to get to the point of what we are trying to do, is there a way to get the original manager back into control of the calendar though Outlook? It would be preferred to be able to keep the history of what they tracked of this calendar, so starting a new
one would be something we would rather avoid. After that, getting all of the users that need to connect to the calendar reconnected with the correct access permissions and making sure they are all synchronized.
I realize this is a big mess, and your help would be greatly appreciated.

Hi Nigel,
How is the impact, just one user or all users, Outlook or OWA?
If just one user, it seems like an issue on the Outlook Client side.
Please trying to re-create new profile to fresh the caches.
Please runing Outlook under safe mode to avoid some AVs, add-ins and firewall.
Found a similar thread for your reference:
Calendar Sharing not available error message
http://social.technet.microsoft.com/Forums/exchange/en-US/d9b33281-d7bb-4608-8025-16fb26643d0d/calendar-sharing-not-available-error-message?forum=exchangesvrclientslegacy
Hope it is helpful
Thanks
Mavis
Mavis Huang
TechNet Community Support

Install Access 97 and Office 2007 on Windows 7

Hopefully this is a useful discussion for anyone wanting to run Access 97 on Windows 7 especially if the intention is to also load Office 2007
or 2010 in addition to Access 97.
I have successfully installed Access 97 SR-2 starting from the Office 97 Professional CD for SR-1.
The level of Windows 7 (64 bit Professional Version) was as installed on a new Dell machine in July 2010.
I then loaded Office 2007 as the main office system. As mentioned elsewhere the requirement to also load Access 97 is often dictated by the need to maintain
legacy applications which continue to be run very successfully at this level of software under Windows XP or similar.
The full procedure and list of problems overcome is as follows:-
1)
Make a custom installation of Office 97 into an Office97 folder selecting only Access and its associated data utilities.
2)
The error message CTL3D32.DLL not correctly installed – must be installed in the Windows System Directory can be ignored. Should find it is already in the
Windows\System32 directory.
3)
If you now run the SR-2b update (SR2bOF97.EXE) for Office 97 it will fail unless you do the following:-
a.
create two new temporary folders – say folder97 and foldersavefonts
b.
copy the windows fonts relating to tahoma and comic (4 files) from \windows\fonts to foldersavefonts.
c.
extract the files from SR2bOF97.EXE to folder97 using Winzip or similar.
d.
select the four font files relating to Tahoma and comic and right click to then install these fonts in Windows 7.
e.
if you do not do the above the SR-2 install fails because of a version problem with the fonts.
f.
now run SR2bOF97.EXE in the normal way. It should be successful – if not the situation is different to mine and the log will need to be viewed to troubleshoot
the problem
g.
finally go to foldersavefonts and install these fonts back into Windows 7.
4)
It is now recommended to run the Jet3 patch
Jet35sp3.exe which can be downloaded from Microsoft.
5)
At this point you should have a fully working Access 97 system. This procedure should also work for Word, Excel and Powerpoint but not Outlook.
6)
Now install Office 2007/10 as required preferably a custom installation into an Office20xx folder.
7)
If you have installed Access 20xx there will be a conflict between the Access 97 and 20xx installations. Both version work fine (ignore the message to rerun setup)
once loaded but Access 97 will need to be run with Administration permissions (right click the short cut and click administrator) after running Access 20xx. In a similar way Access 20xx will rerun its registration processes after running Access 97. This situation
occurs whenever you move between the versions unless you follow the following steps.
8)
Load Access 20xx to ensure that it is registered.
9)
Use notepad to create an empty file MSACCESS.SRG – suggest in folder97
10)
find the Microsoft supplied MSACCESS.SRG – this is installed in the folder name specified in the custom install of Office 20xx. Rename this file to MSACCESS.SRG.SAV.
11)
Copy in the empty MSACCESS.SRG from folder97 to replace the correct version.
12)
This trick seems to prevent the conflict between Access 97 and Access 20xx. Remember if any reinstall work is needed for Office 20xx to reinstate the Microsoft
supplied version.
13)  There
is a documented problem
http://social.technet.microsoft.com/Forums/en/w7itproappcompat/thread/4f729cea-aafb-4d4a-b863-705a13de486a relating to a UAC issue but this seems to have been corrected in currently shipped builds of Window 7. If the problem does appear there
is a Microsoft supplied fix for the problem.
http://support.microsoft.com/kb/978591/
14)
Finally, in case anyone needs to make a clean start in new folders. I have also found that the above procedures are still repeatable after standard uninstalls
of both Office 97 and Office 20xx
15) If ISAM problems occur with txt or .xls files it is likely that the .DLLs need to be manually registered. To do this use
the command line and type C:\windows\syswow64\regsvr32.exe c:\windows\syswow64\mstext35.dll. This will register mstext35.dll. Then type:- :\windows\syswow64\regsvr32.exe c:\windows\syswow64\msexcl35.dll. This will register msexcl35.dll
If anyone finds additional problems or information would be pleased to see them posted here.

Hi,
Thanks
for
sharing your effort and
experience in forums,.
Hope your information would help more community members facing the same situation.
Best Regards,
Alex zhao

Can't access loops and samples

Hi,
I have posted this on the regular SoundTrack discussion list and have not received an answer.I am not really sure which list this belongs on since it is SoundTrack Academic. Here's the issue: My computer is shared. I am the administrator and can access SoundTrack and all its features. Other users who are not administrators can not access the loops and samples. I did create another admin account and that account also can not access the loops and samples. How can I make the loops and samples available to who ever uses this computer? Thanks.

Logged in on one of the other accounts, open STP and under the Search tab, click the Setup... button at the top right. See if you can browse to the folder where the files are located (probably something like: /Library/Audio/Apple Loops/Apple Loops for Soundtrack Pro, and /Library/Audio/Apple Loops/Apple/Apple Loops for GarageBand). If so, just add that/those folder(s) to the Folders Indexed list.
Try that, then report back.
tim

Controlling access (copying and Trashing)

We currently have our Studio database on the OS X Server (v.10.3) that allows our employees to access and enter & edit data simultaneously.
How can I ensure that an employee does not accidentally trash the folder they have access to that houses our database or copies the folder?
Any suggestions would be appreciated.
P.S. I tried locking the folder, but then you cannot write to the database.

Hi
By 'program' I’m guessing you mean how would ACLs be applied?
In Tiger Server (10.4) you enable the volume with desired share points to use ACLs followed by a restart. Thereafter its a simple matter of using the relevant Access section in WorkGroup Manager and defining permissions from there. In Leopard Server (10.5) Apple moved File Sharing away from WorkGroup Manager and made it part of Server Admin. There is no need to enable ACLs this time as they are already enabled by default.
You could download the relevant admin manual from here:
http://images.apple.com/server/macosx/docs/FileServices_Adminv10.5.pdf
Hope this helps, Tony

Access List and Conflict Resolution Problem!

My configuration for Allow and Deny is not allowing me to load images and CSS files through the gateway on a URLScraper channel.
I'm trying to figure out how to control access to resources using the Access List service, and I'm running into trouble. The Sun ONE Portal Server, Secure Remote Access 6.0 Administrator's Guide (Doc 816-6421-10) states:
Setting the Conflict Resolution Level
You can set the priority level for the dynamic attributes. If a user inherits multiple attribute templates, say from an organization and a role assignment, and there is a template conflict between the attributes in the two templates, the template with the highest priority is inherited. There are seven settings available ranging from Highest to Lowest.
See the Administration Guide, iPlanet Directory Server Access Management Edition for more details on conflict resolution.
Unfortunately the referenced Adminstration Guide for DSAME contains exactly 0 occurances of the word "conflict" in its 136 pages, so that reference was less than helpful. Chapter 17 of that document (Doc 816-5620-10) describes URL Policy Agent Attributes, which sheds some light on what the URL Deny and URL Allow settings mean. The key sentence is, "An empty Deny list will allow only those resources that are allowed by the Allow list."
So, I've set up my Access List services as follows:
o URL Deny is blank on all Access Lists
o URL Allow set as follows
---- isp
------- http://portal.acme.com/portal/* (company name changed to protect the guilty!)
---- acme.com organization
------- Conflict Resolution: Highest
------- http://portal.acme.com/portal/* (same as above)
---- Acme Customers Role - shared role for all Acme customers
------- Conflict Resolution: Medium
------- http://www.acme.com/*
------- http://support.acme.com/*
------- http://support2.acme.com/*
---- RoadRunner role - specific role for a specific customer
------- Conflict Resolution: Medium
------- http://roadrunnerinfo.acme.com/*
The Desktop services in each of the above two roles includes channels from the hosts in the URL Allow lists.
The behavior I'm seeing with this configuration is that the desktop channels include information from the scraped HTML, and the URLs are rewritten for the included images and CSS files and such. However, the gateway is denying access to the images referenced by the rewritten URL. That is, an image with a URL of https://portal.acme.com/http://roadrunnerinfo.acme.com/images/green.gif shows up as a broken image on the desktop. Attempting to access the URL to the image directly results in an "Access to this resource is denied !! Contact your administrator" error message.
If I set the conflict resolution on the acme.corp organization to Medium (or anything lower than the two role conflict resolution levels) results in the same error message as soon as the customer logs in (no desktop rendered). The same error occurs if I set the conflict resolution in the two roles to Highest (same as the top level organization), again with no desktop rendered on login.
If I put all the above referenced URLs in the acme.com organization Access List service, then I am successfully able to fetch all the resources (images, CSS, etc.) in the URLScraper HTML. Likewise if I put "*" in that Access List. However, this is less than ideal, as it would potentially allow other customers to view data that isn't theirs (Wile E. Coyote user should not be able to get to Road Runner data, and vice versa, and neither one of them should get at Acme private information!).
So, what am I doing wrong? Also, does anyone have any leads on where I can read up on how Access Lists and conflict resolution are supposed to work, since Sun neglected to include a valid reference in the Administrator's Guide, Portal Server 6.0 SRA?
Thanks!
-matt

Did you ever get anywhere with this. My experiments seem to inidicate that you cannot successfully combine Access and Deny directives, across roles or organizational defaults and a role.

Sharing of MS Access DB and MS Jet Database Engine

Similar Messages

Maybe you are looking for