Single Sign On and user security with IS

We have installed Information Steward 4.1 SP1 Patch 1 with Data Services 4.1 SP1 Patch 2 on Information Platform Services 4.0 SP 5 patch 6. The Information Steward system is installed on it's own server. We are connecting IS to our SAP Netweaver 7.3 system.
I have set up Single Sign On using Windows AD authentication. The connection to the SAP system uses a service account.
Because the SAP system has our payroll information on it, we want to restrict Information Steward users based on their SAP security profiles. We don't want to have to maintain security settings in both SAP and Information Steward.
Does anyone know if there's a way to set up Single Sign On so it passes the user credentials from SAP to Information Steward? Then restrict the users on Information Steward based on their SAP security settings?
Any advice would be appreciated!

Hi,
You can use Windows AD or SAP Authentication and configure it with SSO. However this should be done in the BI/IPS plaftorm and not IS. See the BI admin guide (http://help.sap.com/bobip40) section "Authentication options in BI platform". Please let me know if that's what you wanted.
thanks

Similar Messages

Single Sign-On and Data Visibility Rights

Hello,
I was wondering whether anyone has any best practices for implementing single sign on and user identification with Excelsius.
More specifically, I need to interrogate user role, and limit certain data visibility based on that role.
For example, a sales rep may only see certain data for their own territories, but the regional and national managers can see more.
With the emphasis in improving enterprise integration with the new version coming up, I'm also wondering if there are any improvements included for this aspect.
Thanks in advance.
Derick

Hi Derick,
I want to make our discussion into 2 parts
1) Sign on
2) Viewing data based on the Heirarchy
1)Before discussing about the Sign on i want to know which connectivity you are using ? Live offcie or QaaWS.
2) We can make the second point possible in two ways One is with providing restriction at universe level
and the other one is through the use of flash variables.
Using flash variables:
The main idea of using flash variables is reading the User ID from BO authentication and based on that we fetch the Heirarchy level of that user. Then we use some excel logic to hide the data from Low level heirarchy(Here we use Dynamic Visibility for components).
I hope this is what you ar looking for....
If so i have more points to acheive such scenario.
Please provide the your BO environment details, such that it will be easy to identify the better best wat to acheve it.
Regards,
AnjaniKumar C.A.

Single Sign-On and session information

I have an Oracle Portal application with many Java Web Applications. I wish to
provide Single Sign-On to this applications. I know how to configure Single
Sign-On and how to get the user login in Java. I want to store session
information such as: User First and Last Name, User Social Security Number. I
want to get this information from the database after authentication, store it
in session and then access this information from all my applications.

Are you familiarized with sys_context function?
Hope this is useful help.
BR,
Marcos

Oracle Single Sign on and Oracle Internet Directory

Hello Gurus,
What is the relationship between Oracle Single Sign on and Oracle Internet Directory.
To my understanding, OID is required to install SSO.
If OID already exist, can we just install SSO and go on integrating it to existing OID.
Great Thanks,
vimal jain.
[email protected]

Hi Tim,
I've been working on this and could reproduce the issue with anonymous binds. A fix will be ready in 4.2.1.
So what I really need is the password used for login to pass to the is_member call.The P101_PASSWORD item does not save state. However, you can access the value during submit processing of the login page, for example in the post authentication function of your authentication scheme. People sometimes put code in there to query the user's groups (e.g. with apex_ldap.member_of2) and save them in an application. This item value can then be used in the authorization schemes.
Regards,
Christian

Partner application single sign-on and Oc4j

hello,
I'm trying to test portal's partner application single sign-on, following the examples inside the "Oracle9 iAS Single Sign-On Application Developers Guide":
With Tomcat as jsp engine everything works fine, but with Oc4j when I try to enter the protected jsp page i have this exception:
oracle.security.sso.enabler.SSOEnablerException: java.lang.IllegalStateException: OutputStream already retrieved
     at SSOEnablerBean.getSSOUserInfo(SSOEnablerBean.java:153)
     at SSOEnablerJspBean.getSSOUserInfo(SSOEnablerJspBean.java:57)
     at /protetta.jsp._jspService(/protetta.jsp.java:37) (JSP page line 4)
Any suggestion?
Thanks in advance.

I get the same problem with my partner application. It runs fine on JServer but I get the following problem on oc4j:
oracle.security.sso.enabler.SSOEnablerException: java.lang.IllegalStateException: OutputStream already retrieved
at oracle.br.aerochain.sso.SSOEnablerBean.getSSOUserInfo(SSOEnablerBean.java, Compiled Code)
at oracle.br.aerochain.sso.SSOEnablerJspBean.getSSOUserInfo(SSOEnablerJspBean.java, Compiled Code)
at /jsp/papp.jsp._jspService(/jsp/papp.jsp.java, Compiled Code)
at com.orionserver[Oracle9iAS (9.0.2.0.0) Containers for J2EE].http.OrionHttpJspPage.service(OrionHttpJspPage.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.HttpApplication.serviceJSP(HttpApplication.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.JSPServlet.service(JSPServlet.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ServletRequestDispatcher.invoke(ServletRequestDispatcher.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.ServletRequestDispatcher.forwardInternal(ServletRequestDispatcher.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.HttpRequestHandler.processRequest(HttpRequestHandler.java, Compiled Code)     at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].server.http.HttpRequestHandler.run(HttpRequestHandler.java, Compiled Code)
at com.evermind[Oracle9iAS (9.0.2.0.0) Containers for J2EE].util.ThreadPoolThread.run(ThreadPoolThread.java, Compiled Code)
Did anyone get a solution for this?
TIA

Starting single sign-on and directory service

i am trying to install oracle 9i infrastructure on my clean win2000 box with 2.4 GHz proc and 1GB RAM.
i am getting falilure messages for the following:
infrastructure instance configuration assistant: failed
oracle 9i application server randomize password: failed
single sign on configuration assistant: failed
infrastructure mod-osso configuration assistant: failed
OPMN configuration assistant: failed
log file says:
Configuration failed for IAS
IAS Instance creation failed
Configuration failed for JAZN
JAZN configuration failed: unable to establish a directory context.
Configuration succeeded for IASProperty
Configuration failed for IAS
Configuration failed for JAZN
after which single sign-on and directory service dont start. which means no connectivity :(
can somebody please guide me about how to avoid this failure in installation or how to manually start these after installation.
it would be a great help
ashish

Hi,
we're having exactly the same problem.
Could you tell me what the problem is with the network ?
You say configure it properly but what do you mean ?
It's installed on a Windows 2000 Server machine, it's own DNS.
Thanks,
Yuri Arts

Single Sign on and Protect URL step

Hi,
I have successfully installed Oracle Internet Directory, Identity Server, Web Pass, Policy manager, Access Server and WebGate (attached to Oracle HTTP Server from Oracle Management Infrastructure).
My questions are:
- How do I protect URL so the user will need to login to access certain URL?
- How do I enable single sign on and test it?
- What are the general steps involve to enable URL protection (so if the url is protected it will prompt for username and password) and single sign on using Oracle Internet Directory?
Kindly help me if anyone know a solution or can point me to the right documentation. I have tried to read Oracle Access Manager - Access Administration Guide, but keep getting confused.
Thanks.
Regards,
Alfonso

Hi,
You can follow Oracle Access Manager Integration Guide (10.1.4.0.1) B25347-01, chapter 4, to achieve this. This document will answer most of your questions.
Regards,

Single Sign On and Command line

Hi!
We have application without any logon form which executed from command line by BAT file:
app.exe Username Password par1 par2 ...
where par1, par2... is parameters of application
So question is: can Oracle Single Sign On set user credentials to the command line? Can we use OSSO for application without logon form?
Thank you.

SSO is for web apps, you could try to use OID to perform the autentification of your application but you should change your application so it looks for the users in LDAP.
Greetings.

My ipod wont let me buy apps etc... keeps saying this is the first time this device has been used and to sign in and answer security questions. I have had this account for years but cant remember the answer to the security questions. How can i fix it?

My iPod touch wont let me buy anything, i've beem using this account for a couple of years and now it says that this is the first ime this id has been used on my device... it's not.... and to sign in and answer security questions. i cant remember the answers to the questions. How can i fix this without making a new account and losing all my stuff???

From a Kappy post
The Three Best Alternatives for Security Questions and Rescue Mail
1. Use Apple's Express Lane.
Go to https://expresslane.apple.com ; click 'See all products and services' at the
bottom of the page. In the next page click 'More Products and Services, then
'Apple ID'. In the next page select 'Other Apple ID Topics' then 'Forgotten Apple
ID security questions' and click 'Continue'. Please be patient waiting for the return
phone call. It will come in time depending on how heavily the servers are being hit.
2. Call Apple Support in your country: Customer Service: Contact Apple support.
3. Rescue email address and how to reset Apple ID security questions.
A substitute for using the security questions is to use 2-step verification:
Two-step verification FAQ Get answers to frequently asked questions about two-step verification for Apple ID.

TS2446 I just got my iPad, I have an iPod. When I go to put apps on it says my apple I'd Is disabled. I have reset the passwords. Somehow I have two id's? I've gone into settings for apps signed out and back in with the new p.w. I can't think of what e

I just got my iPad, I have an iPod. When I go to put apps on my new ipad it says my apple ID Is disabled. I have reset the passwords. Somehow I have two id's? I've gone into settings for apps signed out and back in with the new p.w. I can't think of what else to do to get the disabled block off. Any ideas?? Thanks

See this Apple document for help...
http://support.apple.com/kb/ts2446

HT201269 When I try to setup my new iPad air, I go through all the steps for the iCloud sign-in and choosing security questions and what not. But after I hit the agree to the terms and conditions... It says Apple ID could not be created because of a serve

When I try to setup my new iPad air, I go through all the steps for the iCloud sign-in and choosing security questions and what not. But after I hit the agree to the terms and conditions... It says Apple ID could not be created because of a server error. Have no clue what to do... I've restarted the iPad and get the same message. But my internet works just fine.

1. Turn router off for 30 seconds and on again
2. Settings>General>Reset>Reset Network Settings

How does schedule with RESTful API a Webi report for a group of users ("Schedule For" to "Schedule for specified users and user groups" with one or more users/groups)?

SAB BO 4.1 SP1
Does it have an RESTful API to schedule a Webi report with the parameter to specify a group of users ("Schedule For" to "Schedule for specified users and user groups" with one or more users/groups)?

Hello Ricardo,
have you try a call like this one ?
    <schedule>
      <name>"test"</name>"
      <format type=\"webi\"/>
      <destination>
        <inbox>
         <to>userId1,userId2,userId3,groupId1,groupId12</to>
        </inbox>
      </destination>
    </schedule>
Regards
Stephane

Signing up and getting started with HP INSTANT INK

Signing up and getting started with HP Instant Ink
Note: your printer must be connected to the Internet through a wireless connection.
How does HP make sure you’ll always have ink? Your printer uses the Internet to let us know when to send more ink. Here’s how you can get all the ink you need, delivered to your door.
Purchase an eligible printer.
Enroll in a plan based on the number of pages you print.
Ink, shipping, and cartridge recycling are included.
No annual fee—Change or cancel your plan anytime.3
We’ll mail special HP Instant Ink cartridges to you.
Our cartridges have more ink than standard HP ink cartridges, so you’ll replace them less often.
Billing and service start after you insert your first HP Instant Ink cartridge.
Your printer will tell us when to send ink.
Your service is not based on how many cartridges you use, so print as many high quality photos as you like.
You’ll always have ink before you need it.
See below for details on How to enroll for HP Instant Ink......
Although I am an HP employee, I am speaking for myself and not for HP.
Twitter: @Ciara_B_HP
This question was solved.
View Solution.

When you enroll in an HP Instant Ink plan, you pay a monthly fee to print a defined number of pages per month. The plans are based on the number of pages that you print, not on how many ink cartridges you use. Your monthly fee pays for ink, shipping, and recycling. If you do not print all of your plan pages in a month, you can roll over up to the number of pages per month in your plan. If you print more pages, there is an additional charge. Ink is included — the plans are based on your usage so you pay for the pages you print, not the ink cartridges HP sends you. A printed page counts the same whether it is black and white, a color document, or a photo. Shipping is included.
What are customers saying about HP Instant Ink?
I signed up for Instant Ink to save money, but now I think the best thing about it is the convenience!— Jack C.
HP Instant Ink is a great way to always have ink when I need it, and it is so convenient.— Rene D.
I’m so glad that someone came up with this brilliant idea of HP Instant Ink because it is just so convenient. I’m completely satisfied with this service.— Nellie O.
I wanted to save money, so I signed up for HP Instant Ink!— Benjamin S.
Although I am an HP employee, I am speaking for myself and not for HP.
Twitter: @Ciara_B_HP

OBIEE 11G with Single Sign-On and Active Directory

Hi guys,
Release Version: Oracle Business Intelligence 11.1.1.5.0
Patch applied: 11.1.1.5.0 BP3 (Patch 13832750)
OBIEE Server operating system: Windows Server 2008 SP2 (32-bits Operating System).
We are trying to configure Single Sign-On according to TechNote_WNA_SSO_AD_V4.0.doc.
Our krb5login.conf:
com.sun.security.jgss.krb5.initiate {
com.sun.security.auth.module.Krb5LoginModule required
principal="[email protected]"
keyTab=cgdkobi2.keytab
useKeyTab=true
storeKey=true
debug=true
com.sun.security.jgss.krb5.accept {
com.sun.security.auth.module.Krb5LoginModule required
principal="[email protected]"
keyTab=cgdkobi2.keytab
useKeyTab=true
storeKey=true
debug=true
We generate de keytab file:
C:\OracleBI11g\user_projects\domains\bifoundation_domain>C:\OracleBI11g\jrockit_160_24_D1.1.24\bin\ktab.exe -k cgdkobi2.keytab -a [email protected]
Password for [email protected]:XXXXXXX
Done!
Service key for [email protected] is saved in cgdkobi2.keytab
C:\OracleBI11g\user_projects\domains\bifoundation_domain>C:\OracleBI11g\jrockit_160_24_D1.1.2-4\bin\kinit -k -t cgdkobi2.keytab cgdkobi2
New ticket is stored in cache file C:\Users\cgdkobi2\krb5cc_cgdkobi2
C:\OracleBI11g\user_projects\domains\bifoundation_domain>C:\OracleBI11g\jrockit_160_24_D1.1.2-4\bin\klist -k -t cgdkobi2.keytab
Key tab: cgdkobi2.keytab, 1 entry found.
[1] Service principal: [email protected]
KVNO: 1
Time stamp: Mar 15, 2013 10:34
C:\OracleBI11g\user_projects\domains\bifoundation_domain>klist
Current LogonId is 0:0x406163f5
Cached Tickets: (0)
We re-start the services and logon into analytics web and SSO doesn't work but there's not an error. It runs successfully with and Active Directoy user and password. Seems like SSO wasn't enabled, but I checked is enabled.
Any suggestion?
Thanks in advanced

Follow the posts : OBI 11.1.1.6.SSO and You are not currently signed in to Oracle BI Server" for OBIEE 11.1.1.6 SSO do the troubleshooting mentioned there.
Also check your logs for error like the one below:
[2012-03-09T16:42:36.000-05:00] [OBIPS] [NOTIFICATION:1] [] [saw.securitysubsystem.checkauthentication.runimpl] [ecid: 6c98b5cce1f24814:2a613331:135f95fbdff:-8000-0000000000005b7a,0:1:1] [tid: 5932] Authentication Failure.
Odbc driver returned an error (SQLDriverConnectW).
State: 08004. Code: 10018. [NQODBC] [SQL_STATE: 08004] [nQSError: 10018] Access for the requested connection is refused.
[nQSError: 43113] Message returned from OBIS.
[nQSError: 13039] The impersonator does not exist in the BI Security Service. (08004)[[
If you are getting this when you login to OBIEE : You are not currently signed in to Oracle BI Server"
then you need to apply this patch : 13553428 QA:BLK:DELIVER TO CORP. OID LDAP USERS FAILED WITH IMPERSONATOR DOES'NT EXIST. 11.1.1.6.0 Generic Platform (American English) General Oracle BI Suite EE Apr 5, 2012 799.4 KB
Let us know the updates. Hope this helps. Mark if it does.!
Thanks,
SVS

Active Directory, single sign-on and SRM Users

We are in the process of installing SRM 7.0. using the Classic Scenario. I am seeking clarification around the creation of users in that system given the following:
- My Basis colleagues are in the process of implementing single sign-on using Active Directory for our SAP Portal, SAP Business Warehouse and SRM systems.
- Single sign-on will not at this point be used for our SAP ECC 6.0 system
My questions are:
1. If active directory is being used do we need to create actual users within the SRM system?
2. If actual users in the SRM system are not required, does this have any impact on the creation of the Organizational structure in SRM from the SAP ECC HR hierarchy?
Many Thanks

Hi Claire,
The Single Sign On work only if user exist on every systemes.
For example :
If you connect trough portal to access ECC and SRM, your user id must exist in ECC and SRM.
For Active Directory you can synchronize your user table to AD by using LDAP option.
The best way is to configure a CUA for ECC and SRM, use the UME of Portal on ECC and synchronize the CUA to Active Directory.
Finally use the SSO certificate between Portal ECC and SRM.
Regards,
Gilles SEBBAG
Sap Technical Consultant.

Single Sign On and user security with IS

Similar Messages

Maybe you are looking for