Short Name for same user results in different service authorization

New to Mac Server. Not new to Unix, command line, or sys admin.
I have a Mini Server, with two users; me and my wife.
Both Accounts have two short names each: Initals+Lastname, and First Name only
With iChat on the server, my account can login using both short names.
Her account can only login to iChat using the Initals+Lastname, not First Name.
Actually her account can log in to iChat using any variation of short names (I've added extra ones), but not the short name of just her first name.
Both users have identical permissions everywhere I can see, both are authorized for iChat.
The short name works if I remove permissions on iChat (I don't want to do this)
Both users are OD users, not local. I only have an admin account for local access.
Here is a snippet of the Jabber log:
jabberd/c2s[40845]: [11] SASL authentication succeeded: mechanism=DIGEST-MD5; authzid=[email protected], TLS negotiated
jabberd/c2s[40845]: odauth_check_servicemembership: checking user "kaarinas" access for service "chat"
jabberd/c2s[40845]: odauth_check_servicemembership: mbrcheck_servicemembership returned 0
jabberd/c2s[40845]: odauth_check_servicemembership: user "kaarinas" is authorized to access service "chat"
jabberd/c2s[40845]: [11] SASL authentication succeeded: mechanism=DIGEST-MD5; authzid=[email protected], TLS negotiated
jabberd/c2s[40845]: odauth_check_servicemembership: checking user "kaarina" access for service "chat"
jabberd/c2s[40845]: odauth_check_servicemembership: mbrcheck_servicemembership returned 0
jabberd/c2s[40845]: odauth_check_servicemembership: user "kaarina" is not authorized to access service "chat"
I'm stumped as to why one short name would work, the other not. Looking for hints on how to hunt down and solve the problem.

This isn't working for me. There was never a local "intern2" account, but I deleted the one in the ldap anyway, made and removed the local intern2 account. I then remade the intern2 account in the ldap directory(which increased the uid), rebooted the server, and the error remains the same as what you report.
Jun 8 13:36:00 server jabberd/c2s[212]: od_auth_check_service_membership: user "intern2" is not authorized to access service "chat"
There are 12 other accounts connected just fine. The issue is with this new intern account only.
Server 10.6.6.

Similar Messages

Is it possible to setup a BB mailbox for one user and a different user's calendar on the same BB?

Is it possible to setup a BB mailbox for one user and a different user's calendar on the same BB?

No, not if your connected to a BES server.

Engineering and Manufacturing Org has different name for same item

Dear All,
I have an Engineering department generally Create items and configure bills, routings then, transfer all to Manufacturing org.
My client has typical requirement as follows...
Engineering and manufacturing department has different name for same item.
Eg: Item A in Manufacturing org may be called as Item AA in Engg org. I have to maintain 2 names for same item. How to map this requirement in R12.
Regards,
Saravanan

Can oyu not make it an organization level item and specify the proce there instead of keeping it a master level item?
Regards,
Utsav.

Exchange 2010 disconnect AD user from mailbox and reconnect the mailbox to a new copy of the same user with a different username

How can i get the following done:
Exchange 2010 disconnect AD user from mailbox and reconnect the mailbox to a new copy of the same user with a different username?
i nmust do this for 16 users TODAY, SO PLEASE HELP ME OUT HERE.
Thanks in advance!!
kind regards,
Rene Veldman
System Administrator Teidem bv, The Netherlands.

Rene,
Why are you not changing the username of the existing account, instead of deleting the existing one and creating a new one?
If you truly need to delete and create new, you can save the GUID for the mailbox (Get-MailboxStatistics <mailbox alias> | Fl MailboxGuid), mail disable the existing account (Disable-Mailbox <mailbox alias>
will work), clean the mailbox database it was hosted on (Clean-MailboxDatabase
<database name>), then create your new account and recover the existing mailbox to that new account (Connect-Mailbox -Identity <Guid from before> -Database <Database name> -User <SAM account name of new account> -Alias
<what you wish to set the alias to>). In PowerShell, for all steps, you would do the following:
$MbxAlias = <mailbox alias>
$NewMbxAcct = <SAM Account Name for new account>
$NewMbxAlias = <new alias for mailbox>
$DomCtrl = (dir env:\LOGONSERVER).Value.Substring(2)
$MbxGuid = (Get-MailboxStatistics $MbxAlias -DomainController $DomCtrl).MailboxGuid
$MbxDb = (Get-Mailbox $MbxAlias -DomainController $DomCtrl).Database
Disable-Mailbox $MbxAlias
Clean-MailboxDatabase $MbxDb
Connect-Mailbox -Identity $MbxGuid -Database $MbxDb -User $NewMbxAcct -Alias $NewMbxAlias -DomainController $DomCtrl
You will need to supply the information in bold in the above commands, and you will need to create the new account before you run the above commands. I include direct use of a specific domain controller so you won't need to worry about replication.
If you are changing the account from one domain to another, this will not help, and you will need to wait for replication throughout the process, running the commands individually.

Retrieving user detail, group name for all users

Hi,
How can I retrieve User name, email, authentication, user group name
for all users using SDK.
It is possible to create this report in webi or CR?
Thank you for reply,
Gregor

Use the following code to retrieve this information:
IInfoObjects users = oInfoStore.query("select * from ci_systemobjects where si_kind='user'");
for (int i=0; i<users.size(); i++)
         IUser user = (IUser)users.get(i);
         // user.getTitle(); for user name
         // user.getFullName(); for user's full name
         // user.getEmailAddress(); for user's email address
         // for authentication type:
         IUserAliases alises = user.getAliases();
         for(int j=0; j<aliases.size();j++)
                   IUserAlias alias = alises.get(j);
                   // alias.getAuthentication() for authentication associated with this alias, since same user can have more than 1 authentication. e.g. Enterprise and Ldap.
         // for user group memberships:
         java.util.Set groups = user.getGroups();
         // the groups Set object will contain SI_ID of all the user groups that this uses is member of. You need to query by the SI_ID of the usergroup to get the group names.
// e.g.
//    oInfoStore.query("select si_id, si_name from ci_systemobjects where si_kind='usergroup' and si_id in (a,b,c....)");
where a,b,c are the SI_IDs of the usergroups.
To create a report based on the above fetched data, there are several methods such as:
you can use Java resultset where in you create the report structure in designer and push the data at runtime using java result set objects. Another way is to push this info in Excel or Access and design your report based on that excel\access.

Need help in setting up Group Policy for same user in local system and Terminal server

Hi All,
Currently our remote users are using our network using VPN client over internet.
They are generally at their home computer and doing VPN as they have to work only in one RDP server for application.
We actually have a OU created for these RDP users and assign then some strict policy like they can not use any other .exe,they can not user any explorer ,they can not even use windows explorer when they are on RDP they just use one exe of their application.
Now what my management want is they want their home computers in Domain and want them to login via their same credentials they are using for RDP but they don't want them to restrict in their home computers with any strict policy.
Now my confusion is how can I configure different policies for same users or same OU.
Can any one guide me please...

you can achieve this fairly easily with group policy.
create an OU and put your remote desktop servers in that OU.
configure both user and computer policies in a group policy and link it to that ou.
you need to enable loopback mode - you may want it in merge or replace depending on your other policies you have. Probably replace though I would guess. this is set in the computer configuration > admin templates > system / group policy section.
now remove the policy you have currently setup for your users on the users OU containing the rdp users. If you want you can move these users back to your main users OU.
when your users login to the RDP server the settings in the user section of the GPO linked to the RDP Servers OU will apply.
when the user logs in to their own computer the policies from the user OU and computer OU will apply - but not the more restrictive RDP OU.
hope that makes sense.
Regards,
Denis Cooper
MCITP EA - MCT
Help keep the forums tidy, if this has helped please mark it as an answer
My Blog
LinkedIn:

"Subscriptions limit reached for same user" validation error when trying to create a subscription to a product - wha can cause this?

Hi,
I've created a third product level called "partner" other than the two that come as standard.
I'm running through the process of taking an existing user from the starter product to the partner product, and am subscribing the user to partner before removing the starter subscription. There seems no problem with a user having both a starter and unlimited
subscription, but am getting the following error when subscribing to partner.
"Subscriptions limit reached for same user"
This is using a subscriptions put. The same code works fine when upgrading to unlimited.
What can cause this?
Andy

Hi Miao,
The function to promote someone to partner is:
public async Task<ActionResult> ToPartner(string id)
//add partner subscription
var prodId = await APIMHandler.GetProductIdFromName("Partner");
var subscriptionId = Guid.NewGuid().ToString();
//set apim role to partner
var partnerId = (await APIMHandler.GetGroups()).First(a => a.name == "Partners").id;
await APIMHandler.AddUserToGroup(id, partnerId);
if (await APIMHandler.SubscribeToProduct(subscriptionId, id, prodId))
//disable starter subscription
await ApimDelegationController.HandleFreeSubscriptionRemoval(id);
//set local role to partner
await UserManager.AddToRoleAsync(id, "Partners");
return RedirectToAction("Index");
Where subscribetoproduct is:
public static async Task<bool> SubscribeToProduct(string subscriptionId, string UserId, string productId)
//The REST API and the delegation are inconsistent in how they represent ids.
if (!UserId.StartsWith("/users/"))
UserId = "/users/" + UserId;
if (!productId.StartsWith("/products/"))
productId = "/products/" + productId;
var client = new HttpClient();
client.DefaultRequestHeaders.TryAddWithoutValidation("Authorization", "SharedAccessSignature " + CalculateAcessToken(ApimIdentifier, ApimPrimaryKey));
var uri = ApimBaseUrl + "subscriptions/" + subscriptionId.ToString() + "?api-version=" + ApiVersion;
var response = await client.PutAsJsonAsync(uri, new { userId = UserId, productId = productId, state = "active" });
if (response.StatusCode == System.Net.HttpStatusCode.Created)
return true;
if (response.StatusCode == System.Net.HttpStatusCode.Conflict)
var error = await response.Content.ReadAsStringAsync();
return false;
if (response.StatusCode == System.Net.HttpStatusCode.BadRequest)
var error = await response.Content.ReadAsStringAsync();
return false;
var errorf = await response.Content.ReadAsStringAsync();
throw new Exception(string.Format("Error in SubscribeToProduct: return status {0}. Content: {1}", response.StatusCode.ToString(), errorf));
The status code is "BadRequest" and the error provided earler is returned.
So at this time the user is added to the "partners" group, but I can't subscribe them to the Partner subscription, which is accessible to members of the partner group.
Andy

Change (rename) short names on existing Users

Working on the Workgroup Manager with the Apple XServer 10.4.10, and I wonder if there was a code or script to change the “short name” of the users accounts as well as having the new (rename)“short name” stay the default short name. I don’t want the “old” short name to exist on the user account. Is there a process through the terminal program I can make this change?
Thank you,

The simple answer is 'no.' But if you're really bent on it, Apple documents the process of creating a new user and integrating the old user's files. http://docs.info.apple.com/article.html?artnum=106824 (updated 2005 so i assume the process has not changed)
I believe this is targeted at OS X client, as a standalone. The process for an OpenDirectory account may differ.
Also, there is a utility called ChangeShortName that supposedly automates this process at www.danfrakes.com. I haven't run it and I believe it's intended for standalone OS X clients -- I have no idea what it'd do on a server. I think it's one of those "run at your own risk" things.

Name in Find User Results Form

Hi:
I need to hide (or quit) the first column (Name) in Find User Results Form. It is possible?. There is a function that indicates all of columns, but the first column is not there.
If is not possible to hide or quit it, can i move it to another position?
Any idea?
Thanks.
MJ.

Here is the summary:
To set attribute view visibility/query indexing/accounts list view,
edit in UserUIConfig.xml ->
SummaryAttrNames
QueryableAttrNames
AppletColumns
To modify Accounts Find Users and search results,
edit idm/sample/userSearchDefaults.xml
getSearchableAttrs
getResultColumns
If you do this method, you will not need to edit
Find User Form
OR
Find User Results Form !
This simplifies the problem greatly.
I hope this helps somebody, because i didn't get any info from the forums.
-jason

My account names for iCloud and iTunes is different, is this why my Iphone4 is not syncing with my iMac?

My account names for iCloud and iTunes is different, is this why my Iphone4 is not syncing with my iMac?

No, perfectly normal to have a separate iTunes account for music/app purchases to the one you use for iCloud syncing of contacts, notes, etc.

How to find Application short name for an application?

Hi ,
How to find Application short name for an application?
Eg: what query will give me output as PER when I give input as Human Resources?
Regards,
Neeraj

Try the following:
SQL> select application_id, application_short_name, basepath
from fnd_application
order by application_id;

For my user id, I have the authorization for the transaction, but still iam getting the error that, you don't have authorization, plz suggest?

Hello ,
For my user id, I have the authorization for the transaction, but still iam getting the error that, you don’t have authorization, plz suggest?????
Thnks

Hello Sampath,
after you have received the error message about the no authorization, run transaction SU53.
This transaction shows which authorization has failed last time.
Best regards,
Laszlo

Network drive volume name for same folder by multiple users

I am using a 1TB USB hard disk attached to a ASUS RT-AC68U wireless router as network drive. There are multiple user accounts created on the same MacBook Air and they need to access the same folders on the network drive. For example, we have folder called "iTunes" created on the network drive.
The following steps resulted in some problems encountered.
Step 1: When user1 mounts the iTunes folder as a network drive, the general info shows:
General:
Kind: Volume
Server: smb://rt-ac68u/iTunes
Name & Extensions:
iTunes
Step 2: When user2 mounts the same iTunes folder as a network drive, the general info shows:
General:
Kind: Volume
Server: smb://rt-ac68u/iTunes
Name & Extensions:
iTunes-1
Question: Why does OS X assign "iTunes-1" as the name of the same network folder on the network drive for user2? Is there a way to retain the same original folder name for user1 and user2, such as "iTunes", so that it can be access as "/Volumes/iTunes" by both these users?

tastyrico wrote:
Hi Drew,
Thanks for the recommendations. They are useful tips to have in the arsenal, thanks. However, the preferences discussed are intended for directly attached external hard disks and the specific discussion was to make it available to the network on a Mac that is powered up with no user logged in (like a OS X Server but user still need to log in).
That's correct, I'm sorry I am wrong.
I do remember another defaults write option for detaching network drives on 'switch to loginwindow' because I needed the same thing - eventually I gave up & disabled fast user switching, it reduced the amount of issues for the clients. Sorry for confusing the two.
Have you considered mounting it via a startup script. At the moment it is failing because the path exists when User2 mounts it. If you try a script (at the level of the system) it should mount only once. Obviously sticking usernames & passwords into a script is not the best for security.
I think this issue is what NFS mounts can overcome, but I haven't used them for so long. They should be able to mount with no user interaction, but they are less flexible with permissions IIRC.
If your NAS supports NFS look at that, I think you both need to remove the user as the agent that mounts the disk. If the OS does it once (& permissions are correct) it should remove the 'diskname-1' issue.
When it works you end up with volumes in /Network/diskname.
I don't have a good place to start with NFS, so take a look around here…
https://discussions.apple.com/thread/4144999
@ElisabethBraut, do you get this error form MS…
http://support.microsoft.com/kb/2712085
MS apps fall apart when you have disks mounted like this, it's a consequence of MS apps using an older way to represent filepaths.

Can Exchange have 2 different mailboxes for same user

hey guys,
I need to know whether Exchange 2010/2013 can have two mailboxes for the same user e.g.
1st mailbox is configured to send and receive emails for: xxxxpride.co.ke and
2nd mailbox is configured to send and receive emails for: xxxxsolutions.co.ke
is this possible? if not how should i go about this scenario?
will it mean I have to run two different exchange and AD servers which will have a different public IP?

No you can not have 2 mailbox for one user. Because, mailbox is associated with AD account and you need authentication to send emails.
In this case you can do following
1. Create a different user account with 2nd email address and Forward that 2nd email to first one. So User is reading 2 email in one mailbox. TO send email from 2nd mailbox assign the send as permission to first account.
2. Add the Alias email address in your first mailbox. (By doing so) User will recieve the emails for both address but cant send from 2nd email address.
You can have multiple domains configured to recive and send emails in one exchange server.Yes certainly
we can create multiple recipient for multiple domains.. Under authoritative domains section of hub transport. External Relay and Internal relay and authoritative domains can be created. you can create email address policies for each domain as well. See the
link below to understand more.
http://technet.microsoft.com/en-us/library/aa996314%28v=exchg.150%29.aspx
UMESH DEUJA MCP,MCTS,MCSA,CCNA

Configuring IDM menus for different roles for same user?

Looking forward to Sun IDM 8.x and Sun Role Manager 4.1 installation. Couple of points before the decision are -
1. If a user A has two roles R1 and R2 (for Sun IDM) then how does Sun IDM decide how the IDM console should appear (menus etc.) to the user based on whether he's logging in with Role R1 or R2? The login screen doesn't contain any input entry for choosing the role with which to log-in. With that in mind, is it even possible to have multiple roles for same login id? Or does the user have to maintain two seperate login identities?
2. Same question for Role Manager
3. Does Sun Role Manager 4.1 provide Roles merging feature?
Thanks,
AG

IDM combines the two roles. So if a user has the two roles and role R1 grants access to menu items 1,2,3 and role R2 grants access to menu items 3,4,5, the user will have access to menu items 1,2,3,4,5. If you want to separate these two roles, you will need two different login users - but what exactly are you trying to achieve there?
Can't help you with Role Manager, sorry.

Short Name for same user results in different service authorization

Similar Messages

Maybe you are looking for