The logged in user does not have permissions to perform this operation

OIM 11.1.2.0.4
Connector: Microsoft Active Directory User Management 11.1.1.5.0
Action: revoke a provisioned AD account (logged in user is XELSYSADM member of SYSTEM ADMINISTRATIONS role)
Error message: IAM-2050243 : Orchestration process with id 5756, failed with error message IAM-4065011 : An error occurred in oracle.iam.provisioning.spi.DOBProvisioningMechanism/revoke(Account) while revoking account with id 1 for the user with key 43 and the cause of error is The logged in user does not have permissions to perform this operation..

The problem is missing entries into table AAD, Provisioning API uses table AAD to check administrator's scope on the user's organization.
TEST: following SQL statement should return at least a value
select aad_write, aad_delete
from aad aad
, usr usr
where aad.act_key = usr.act_key
and usr.usr_key = <user_key_of_user_you_wanto_to_revoke>
and aad.ugp_key in (
select ugp.ugp_key
from ugp ugp
, usg usg
where ugp.ugp_key = usg.ugp_key
and usg.usr_key = <user_key_of_xelsysadm>
BUG (in my case): if you create an Organization using a OIM user that does not have any Role (except default ALL USERS Role) the system does NOT add right entries into AAD table, so you can revoke account of users that are members of this Organization
WORKAROUND: manually insert entries for all Organizations (ACT_KEYs) for the user XELSYSADM into AAD table
FIX: always create an Organization using a OIM users with at least one Role except ALL USERS role

Similar Messages

'The logged-on user does not have permission to use this object'

Hello everyone,
I am getting the message 'The logged-on user does not have permission to use this object' while saving the Sales Order. I am logging in as a CRM user. There is an addon also running on the server, that saves some data into a user defined table when the Sales Order is saved. Is there any authoisation for users to access user defined tables.
Regards,
William

hi William,
this is an Authorization issue. provide the user with authorization on your UDT. Definition of user authorization can be found in Administration -- >> System Initialization -->> Authorizations -->> Additional Authorization Creator.... if already defined from here you can fined the additional authorization from the General authorization window.
regards,
Fidel

"The Loged On user does not have permission to use this object" error

Hi
I've created a form that is used by a customer which allows for certain draft documents to be approved and then once approved they are created. The problem that I am having is that when the users attempt to update the changes on the form an error is logged, which is shown below:
"Error: -3000
The Loged On user does not have permission to use this object
System.Runtime.InteropServices.COMException (0xFFFFF448): The Loged On user does not have permission to use this object"
Once the update button is pressed then a User Defined Table and Drafts are both updated with the relevant modified UDFs from the form.
If I log onto their system then I don't seem to get any issues. To me it looks like a user authorisation problem but the ones who have used the form seem to have the relevant licences.
Do you have any idea why this error could be occuring?
Thanks a lot.
Steve

Hi,
Go to Administration --> System Initlization > Authorizations> General Authorizations not expand all and check if the service call is given full *Read & Write * rights to the required user.
If not then give full rights and check the add on.
Hope it helps,
Vasu Natari.

The loged on user does not have permission to use this object'

A professional license user currently has Authorisation to all Customer BPs and Sales Documents.
When creating a random Sales Order, the error message
'Create POs(): The loged on user does not have permission to use this object'
is occuring. This is not occuring for all Sales Orders, this is occuring randomly.
Note that the Purchase Orders Button in the Logsitics tab in the sales order is NOT selected.
Cheers Lisa

hi lisa
there could be some changes in transaction notification from your side if there are any i would request you to please comment all the changes and then try saving the document it would definately go ahead as there has to be some change in the stored procedure ,
Regards,
Manish

Error Message' "The loged on user does not have permission to use this obje

The loged on user does not have permission to use this object-
I am entering a Sales order, which is customized, when I add the Sales order this system imformation appears.
The user has a pro-license and authorizations to all AR
Can someone tell me what my problem might be?

Thank you for your help

CREATE USER, User does not have permission to perform this action.

-- first, connect to the master database
CREATE LOGIN login1 WITH password='Qwerty12345';
CREATE USER login1User FROM LOGIN login1;
EXEC sp_addrolemember 'dbmanager', 'login1User';
EXEC sp_addrolemember 'loginmanager', 'login1User';After, I connect to database 'master' with 'login1User' and execute:CREATE LOGIN login2 WITH password='Qwerty12345'; - okCREATE USER login2User FROM LOGIN login2; - User does not have permission to perform this action.

Hi Vit007,
Please check the two database role: 'dbmanager' and 'loginmanager'.
CREATE USER Requires ALTER ANY USER permission on the database.
Iric Wen
TechNet Community Support
select rm.*, dp2.name AS 'User', dp1.name AS 'Role' from sys.database_role_members rm LEFT JOIN sys.database_principals dp1 ON rm.role_principal_id = dp1.principal_id LEFT JOIN sys.database_principals dp2 ON rm.member_principal_id = dp2.principal_id
role_principal_id
member_principal_id
User Role
6 8
login1 dbmanager
7 8
login1 loginmanager

PSCONFIG - error - USer does not have permission to perform this action

After installation fo July 14 CU in the sharepoint 2013 server, getting the below error when i ran the PSCONFIG command.
"An exception of type System.Data.SQLClient.SqlException was thrown. Additional Exception information: USer does not have permission to perform this action"
My service accounts have db_Owner, db_SecurityAdmin, public, and SPDataAccess to the CONFIG DB.
Added the services to the local admin group also.
I am not sure why i am getting this error.
Any help is much appreciated.
Thank u

Hi,
Did you run SharePoint configuration wizard after applying
July 14 CU?
you need to run the wizard after installing the CU.
Please remember to click Mark as Answer on the answer if it helps you

User does not have permission to perform this action

Dear sirs,
i made a project (VB2010 express) connecting to SQL Server 2008 express on my PC running Windows 7 (W7): it works as expected.
Now,
i need the same project run on a different PC (running Windows XP, say WXP, with VB2010 express installed) of my private LAN, but still connecting to SQL server running on Windows7-PC. So i exported the project file to WXP PC.
After enabling TCP for SQL, opening ports and bla bla bla, i can "see" SQLEXPRESS instance (running on W7) from SqlServerManagementStudio running on WXP and i can modify, select, create tables and so on.
Then i changed connection string parameters in app.config to point to the dB:
<connectionStrings>
<add name="IlMioCapolavoro22.My.MySettings.MyCompanyConnectionString"
connectionString="Data Source=INGSERGIO\SQLEXPRESS;AttachDbFilename=z:\mycompany.mdf;Integrated Security=true;Connect Timeout=30;User Instance=True"
providerName="System.Data.SqlClient" />
</connectionStrings>
In detail, i changed .\SQLEXPRESS to INGSERGIO\SQLEXPRESS and AttachDbFilename =c:\temp\mycompany.mdf to AttachDbFilename = Z:\mycompany.mdf (c:\temp of W7-PC is mounted as z:\ on WXP PC).
IF i do F5, i get the sql exception above.
Based on what i read in other forums,
it seems that the user connecting to SQL server (when the program starts) has not enough permission to access the database: frankly speaking, i don't know which user should i add permission for (my knowledge of SQL is poor).
The SQL Server Log file doesn't show anything (or what i am able to see).
.mdf file is in a directory where anyone has all privileges in reading-writing etc.
Can anyone help me?
Thanks
Sergio

Dear Sofiya,
thanks for reply.
TCP/IP, SQLServer.exe and SQLBrowser were already configured (Windows firewall was configured by adding "listening ports"
and not by changing scope to applications... i don't think this is a problem): in fact i can connect db remotely from SSMS (all privileges).
When you say:
"make sure the
user running your DB application in other computer has permissions to access the database"
you mean "windows user" ? if so, same windows user & password are accessing the 2 PCs, they both have admin-privileges on both PCs (maybe different operating system is a concern?). I didn't
create sql-user so far because my understanding is that in windows authentication mode it shouldn't be necessary or am i wrong?
"..., we can attach the “.mdf” file the SQL Server Express and then use the same method (Connect to database with
VB) to connect the database." ---> VB doesn't let me do this, because if i try to test the connection
with the db file from VB, it errors saying: "the file is in a network path not supported for database files. A database with the
same name exists, or specified file cannot be opened, or it is located on UNC share." Somewhere i had read
that the VB EXPRESS doesn't support database remote connection, so it is necessary to do it by changing manually string connection.
Any ideas?
thank you.
Sergio

Error Loged On user does not have permission to use this object

Hi all,
I am trying to Export Document Data in XML format
for OSalesinvoice or oPurchaseInovice object it is working fine
But if i use oPurchaseTaxInvoice it is giving error
"An unhandled exception of type 'System.Runtime.InteropServices.COMException' occurred in myDUAPI.exe "
"Additional information: The Loged On user does not have permission to use this object"
I have logged as "manger" "manager"
Dim oInv As SAPbobsCOM.Documents
        'oInv = oCompany.GetBusinessObject(SAPbobsCOM.BoObjectTypes.oInvoices)
        'oInv = vCmp.GetBusinessObject(SAPbobsCOM.BoObjectTypes.oPurchaseInvoices)
        oInv = vCmp.GetBusinessObject(SAPbobsCOM.BoObjectTypes.oPurchaseTaxInvoice)
        If oInv.GetByKey("9") Then
            oInv.SaveXML("C:\downloads\purinvtax.xml")
        Else
            MessageBox.Show("couldn't find it")
        End If

Hi Sudish,
It looks to me that the logged on user is only a CRM user. You need to have a professional user license to access Invoices.
If you're using only the DI API, please check which user name you are using to connect to DI. If you're using UI API with single sign on, the logged on user to SBO is not a professional user or don't have the correct authorisation.
Hope it helps,
Adele

This log in user does not have proper rights to use WebCenter Capture

Hi experts,
We have WCI 11.1.1.8.0 setup. It has WEC configured. However when I login with "weblogic" user. This is domain admin user. WEC allows user to login and shows top navigation bar. However in the body it shows below message
"This log in user does not have proper rights to use WebCenter Capture"
I am sure i have not gives a proper group/ role to this user. I am not sure which one is that.
Regards,
Vikrant Korde.

Hi Vikrant,
This happens if user is not in Capture Application Role.
Check this:
Log in to EM
Right-click the capture_domain, select Security, and then Application Roles
In the Application Stripe field, select capture, and then click the Search application roles icon to display the Capture application roles.
In the Capture User add this weblogic.
It will work now.

Error msg: Current user does not have privileges to perform product Activation

I am running Adobe Photoshop CS 8.0 on Windows Home Vista platform.
I keep getting this error message when I try to open Photoshop:
Current user does not have privileges to perform product activation. Run this application from a user account with administrative privileges or contact your system administrator.
I am the only owner & user of this software. I have re-installed the SW once (full install), and the error message went away for a while.
Now it's come back.
What do I do now?

2 options:
Either disable UAC (User Access Controls) or run the application with Administrator rights.

Windows Server 2012 R2 Fax Service - Windows 7 Client "You do not have permissions to complete this operation. Contact your fax administrator for more assistance"

First I have tried all sorts of searches and and all I come up with is things related to Windows Server 2008.
1. I have Fax Service running on my 2012 R2 File and Print Server.
a. It can send faxes from the logged in domain user
b. It does not need to receive faxes because we have another machine for that
2. I have added the domain user I am using on the Windows 7 machine to the Accounts List in Fax Manager
3. I can not seem to find any logging saying that there is a security problem (Event Log, etc...)
Please point me in the correct direction as I need to have my staff use Print to Fax from our Practice Management Application.

Hi Shawn,
à
You do not have permissions to complete this operation. Contact your fax administrator for more assistance
From the error message, please check if share the Fax on the server. Meanwhile, please also check if assign
correct permissions in Security tab under Fax properties.
If any update, please feel free to let me know.
Hope this helps.
Best regards,
Justin Gu
1. Fax Sharing is enabled and can see the Shared Fax Printer on other machines.
2. At least 2 domain groups that the Windows 7 user is in are in the Security Section, set to be able to fax. One othem can manage fax.

The user does not have permission to perform the operation

Hi,
Configuration: JES Q405. Solaris 10 x86.
My customer initially installed JES (Portal + AM + DS) on the same box.
Now, they have a change in their requirement. They want DS to run dedicatedly in another box.
I have successfully installed a fresh instance of DS in the new box with the same domain name (thus maintaining the same dn). I have copied over 99user.ldif and exported all the data from the original DS in the old box.
Everything is running fine. DS in the new box is able to function properly.
On the Portal and AM side, I have changed the following file:
1. AMConfig.properties
2. serverconfig.xml
3. PSConfig.properties
I have also changed the Primary LDAP entry in iPlanetAMAuthLDAPService, iPlanetAMAuthMembershipService, and iPlanetAMPolicyConfigService.
However, when I started AM (which is running on Sun Web Server), I got the following error message:
------------------- in /var/opt/SUNWam/debug/amSDK ---------------------------
05/01/2006 04:46:43:324 PM SGT: Thread[main,5,main]
ConfigManager->Constructor: root DN dc=sg,dc=com
05/01/2006 04:46:43:403 PM SGT: Thread[main,5,main]
Invoking _ldapPool.getConnection()
05/01/2006 04:46:43:403 PM SGT: Thread[main,5,main]
Got Connection : LDAPConnection {ldap://sg-dsq405.sg.com:389 ldapVersion:3 bindDN:"cn=puser,ou=DSAME
Users,dc=sg,dc=com"}
05/01/2006 04:46:43:410 PM SGT: Thread[main,5,main]
Invoking _ldapPool.close(conn) : LDAPConnection {ldap://sg-dsq405.sg.com:389 ldapVersion:3 bindDN:"c
n=puser,ou=DSAME Users,dc=sg,dc=com"}
05/01/2006 04:46:43:411 PM SGT: Thread[main,5,main]
Released Connection : LDAPConnection {ldap://sg-dsq405.sg.com:389 ldapVersion:3 bindDN:"cn=puser,ou=
DSAME Users,dc=sg,dc=com"}
05/01/2006 04:46:43:411 PM SGT: Thread[main,5,main]
ERROR: ConfigManager->Constructor: Caught exception Message:The user does not have permission to per
form the operation.
------------------------------------ end --------------------------------------------------
-------------------------- in /var/opt/SUNWam/debug/amAuth ---------------------
05/01/2006 04:47:21:252 PM SGT: Thread[main,5,main]
Directory Host: sg-dsq405.sg.com
Directory PORT : 389
05/01/2006 04:47:21:298 PM SGT: Thread[main,5,main]
AuthD initializing
05/01/2006 04:47:21:610 PM SGT: Thread[main,5,main]
ERROR: AuthD failed to get auth session
05/01/2006 04:47:21:688 PM SGT: Thread[main,5,main]
ERROR: AuthD init()
com.iplanet.dpro.session.SessionException: AuthD failed to get auth session
at com.sun.identity.authentication.service.AuthD.initAuthSessions(AuthD.java:709)
at com.sun.identity.authentication.service.AuthD.<init>(AuthD.java:229)
at com.sun.identity.authentication.service.AuthD.getAuth(AuthD.java:494)
at com.sun.identity.authentication.UI.LoginLogoutMapping.init(LoginLogoutMapping.java:71)
at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:921)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:813)
at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3478)
at org.apache.catalina.core.StandardContext.start(StandardContext.java:3760)
at com.iplanet.ias.web.WebModule.start(WebModule.java:251)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1133)
at org.apache.catalina.core.StandardHost.start(StandardHost.java:652)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1133)
at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:355)
at org.apache.catalina.startup.Embedded.start(Embedded.java:995)
at com.iplanet.ias.web.WebContainer.start(WebContainer.java:431)
at com.iplanet.ias.web.WebContainer.startInstance(WebContainer.java:500)
at com.iplanet.ias.server.J2EERunner.confPostInit(J2EERunner.java:161)
----------------------------------------- end --------------------------------------------------
Any idea how to solve this problem? Thanks in advance!
justCheeChong
Message was edited by:
justCheeChong

check if the new DS instance has all the AM required ACI's.

Is it possible for a Web Part to interact with a list the user does not have permissions for?

Say I have a custom web part that queries a list or adds list items, etc. Does the user have to have the equivalent permissions on the list itself to use the web part? Would the SPSecurity.RunWithElevatedPrivileges Method be a way to get around this? Or is
there a better way?
Basically I want certain users to have a more controlled access to a list. But if I try to access the page with the web part on an account without permissions for the list, I get an Access Denied response.

One way of elevating code is, as you already mentioned, using SPSecurity.RunWithElevatedPrivileges which will run SPSecurity.CodeToRunElevated with Full Control rights. From MSDN documentation of the method for SP 2013 (http://msdn.microsoft.com/en-us/library/microsoft.sharepoint.spsecurity.runwithelevatedprivileges.aspx)
you can see that this code runs under Application Pool identity:
Type: Microsoft.SharePoint.SPSecurity.CodeToRunElevated
A delegate method that is to run with elevated rights. This method runs under the Application Pool identity, which has site collection administrator privileges on all site collections hosted by that application pool.
Another method, a bit more security fine-grained, can be used. The idea is to instantiate new SPSite object using overloaded constructor which takes Microsoft.SharePoint.SPUserToken as a parameter: http://msdn.microsoft.com/EN-US/library/ms469253(v=office.15).aspx.
Example can be seen here: http://www.sharepointdeveloperhq.com/2009/04/how-to-programmatically-impersonate-users-in-sharepoint/. Using this approach, you can run your code in the context of the user who doesn't necessarily have to be site collection admin.
This user can have only access to the list in question.

ADDM Report is not produced by SQL DEV 4.0 if logged in user does not have SYSDBA privilege

Hello -
In SQLDEV 4.0 (Early Adapter), I logged in as user with no SYSDBA privilege granted. But ADVISOR granted and execute on DBMS_ADDM granted and "select any dictionary" granted, etc.
Then i go to the menu View --> DBA --> Performance --> Automatic Database Diagnostic Monitor
Select ADDM report from the available choices.
Out of 3 menu options: Summary, Findings and ADDM Report, I can see the first two, but I am getting a grey screen for ADDM Report.
^^^^^^^^^^^^^^^^^^^^^
If i do exactly the same but login as SYSDBA, then ADDM Report can be produced and can be seen. So the issue is in the missing grants and privileges.
^^^^^^^^^^^^^^^^^^^^^^
The goal that we are pursuing in our shop is to empower developers to work with ADDM reports by having them login as non-SYSDBA user.
^^^^^^^^^^^^^^^^^^^^^^^^
Please advise what privilege should be granted to get this working for non-SYSDBA login
The same user can successfully execute $ORACLE_HOME/rdbms/admin/addmrpt.sql and produce file with complete ADDM report. But not able to get the ADDM from SQL DEV 4.0
Thank you,
vr

Thank you, Phil.
This worked for me in my quick test case.
Great help, as DBA group wants to allow NON-privileged users (like Developers and QA) to execute ADDM on demand.
Here is my observation for RAC database with two instances.
I have followed your instructions:
"Performance / Automatic Database Diagnostic Monitor -> Run ADDM"
Then
- Uncheck box "By Creating New Snapshot" (this box was checked by default)
- Provide new "Task Name" (let's say "vr1")
- Select "Start Snapshot" (this is where my first confusion is: each screen shot # is shown twice, may be because i have two instances of RAC)
- Select "End Snapshot" (the same way: each SNAP_ID is shown twice)
- and finally APPLY button is pressed
This creates 3 reports:
vr1
vr1$1 (for instance_id=1)
vr1$2 (for instance_id=2_
So, my question is: this expected and normal behavior of the tool?
What if my RAC database has 8 instances? Then I would generate 9 separate ADDM reports?
Is this correct observation?
Thank you,
vr

The logged in user does not have permissions to perform this operation

Similar Messages

Maybe you are looking for