User access at IO level

I have 2 OUs-- OU1 and OU2.
OU1 has 1 inv org-- IO11
OU2 has 2 inv orgs-- IO21 and IO22.
I will define responsibilities at IO level, i.e., 3 responsibilities for an application --R11(for IO11), R21 (for IO21) and R22 (for IO22).
I want to restrict user access at the IO level.So, R21 should access only IO21 and not IO22. Same for R22.
What will be the value of the following profile options in order to achieve this? My BG name is Set up business Group.
MO:Operating unit
MO:security profile
HR:security profile
HR:business group

Hi,
Try with organization access.
Guess the above 4 profiles wil help you to restrict at OU level only.
Hope this helps.
tks
M J

Similar Messages

Non Active Directory users are not able to access sharepoint top level site

I have created a sharepoint group with read permission on top level site and I added the NON AD users to that group but the non ad users are unable to access top level site ,they are able to access remaining all subsites without any issue.I am facing
this issue only with NON AD users....I have checked the page layouts , all the layouts are in published mode.All the webparts and Lists on Default.aspx page has all users access permissions.Do I need to change anything in central administration
for this webapplication.

Hi,
Could you please reproduce the issue and collect error information in ULS log for troubleshooting?
For your convenience:
http://blogs.msdn.com/b/opal/archive/2009/12/22/uls-viewer-for-sharepoint-2010-troubleshooting.aspx
Regards,
Rebecca Tu
TechNet Community Support
Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact
[email protected]

Non-admin user cannot access Essbase server level variables

Version 11.1.1.3
Essbase Substitution variables are created at server level. Users are getting error in FR report that uses the Subsitution Variable -- Essbase Error(1051085): You do not have sufficient access to get this substitution variable. Also, users cannot access Substitution variable in SmartView. However, users can access variables created at database level. Users are provisioned as "Server Access" to Essbase and filter access to ASO application "MGTRPTG", where MGTRPTG is an ASO essbase application for reporting. We tried the same provisioning in two other environments and it seems to be working fine.
User is type "Essbase and Planning" provisioned with essbase "server access", application mgtrptg "filter", Reporting and Analysis "analyst", "dynamic viewer" and "Explorer". In addition, it is given a filter "REP_DME_GALB" which restricts 2 dimensions (Division and Geography).
Steps taken to resolve:
1. Existing users were deprovisioned and reprovisioned with no effect.
2. Created brand new identically provisioned users in Prod and QA. QA user can access the server level var and Prod user cannot
3. Created a brand new server level variable in Prod and this cannot be accessed.
4. All services have already been restarted several times.
5. SR has been opened.
Temporary workaround:
By creating a duplicate of the same set of variables at the database level, the reports work. This can only be a temporary workaround as the client cannot be expected to maintain two sets of substitution variables since there are 3 applications using these server level variables.
Thank you for any ideas!
Jennifer

You have stumbled on a defect which is resolved in the Hyperion Planning 9.3.1 patch 6 and above. If you have your planning preferences set to indent members it will cause forms which have page selections to show as invalid in SmartView.
You can either patch Planning or turn off the preference. The patches are available from http://metalink3.oracle.com and require account which has been associated with your client ID.
P.S. Usually it's not a good practice to use the admin id.
Regards,
-John
Edited by: Jbooth on Nov 3, 2008 2:12 PM

Best way to handle user access levels with spring.

I'm a spring newb, and I'm not sure how to properly handle user access levels with a validation controller. There seems to be a lot of information out there about creating simple login validators but like I've said I need to create multiple levels of user access. I could throw something together but i want to do it correctly. Does anyone here have any links to resources or information they could provide?

ZimmerS1337 wrote:
SoulTech aren't you a smart ass, why post anything at all?You don't get to control what people post, any more than we can control what people ask. It's best to let stuff roll off your back.
ST wasn't exactly abusive. If you had typed "spring security" into Google, you would have gotten exactly what I recommended. So why would you say that his advice to try Google first was being a "smart @ss"? It's actually a good recommendation. Try it before you post here.
%

Controlling data access at universe level

Hi,
I had a doubt in universe regarding the implementation of security.
Existing process: We had a portal called flex (intranet site)which the BO report has been integrated and for opening the report the name of report was clicked (hyperlink)
This report should show the data specific to the user profile logged into the portal.
Now if we want to restrict the data at universe level for each individual users accessing the report in portal our idea is to create a dervied table (which contains a list of userid's and project id's)in universe so that who ever logged into the portal and clicks on report he will see the data only related to profile
For example: The scenario would be a manager residing in a region need to see the list of projects which he is assigned to but not all of them.
Could you please let me know how can implement at universe. Kindly let me know if you need any futher information.
Thanks,
Eswar

Another way to do this is: (a) in your universe create a table that has a list of user names a long with their BOUSER id; (b) associate that list with fact tables or d imensions in the database, either using joins or by using a where clause as a filter or in an object definition using the syntax @variable(bouser); below is an exerpt from BO Designer guide.
Example:
@Variable
In the universe for a human resources database, you have an object called
Employee name. You want to restrict the returned data for Employee name
to the values authorized in the database for each user. This would allow
you to control what employee information each user is allowed to see. This
information is defined by their database profile.
You insert the @Variable function in the WHERE clause as follows:
Employees.Employee_Name = @Variable('BOUSER')
When the object Employee name is used in a query, the data is returned

File structure and Multi-user access/control

Hi All
Currently evaluating RH. Our plan is to use RH HTML with RoboServer and either SourceSafe or Team Foundation for source control. We will be producing the "printed" manual (PDF) and publishing online help (hopefully html via RH server) from the single source layout
Given that we will edit content in RH's XHTML editor, I'm not clear on when we should create new files or the granularity of multi-user access. We have 17 apps and I plan to use a master project and merging (because we need to link to related topics in other apps).
I'm really not sure what should constitute a file in RH. First off, is access controlled at the file level?
I want to have multiple authors editing the same manual at the same time, so do I need to break the manual into multiple small files (currently it's a single word doc)?
If I do break it into multiple files, what's the best approach: 1 file per topic (or is this a requirement)?
Finally, when I come to generate the PDF, will the files be combined. (i.e. can I have different page-breaks than I have in the RH project)?
Any pointers greatly appreciated
Regards
Mark

Hi,
First off, is access controlled at the file level?
Not sure what you mean by that. In source control, you can check in/out ever file independent. Sometimes dependent files will be automatically checked out, for instance images used in the css when you check out the style sheet.
I want to have multiple authors editing the same manual at the same time, so do I need to break the manual into multiple small files (currently it's a single word doc)?
That be the idea. Anyway, it's not a good idea to have an entire RoboHelp project in a single topic. You probably want to cut up your contents into the small chunck: topics.
If I do break it into multiple files, what's the best approach: 1 file per topic (or is this a requirement)?
In RoboHelp a topic is a HTML file. RoboHelp doesn't force you to split up content into one or more topics. If you are creating help for the web, you want the information to be organized in relatively small chunck so users can quickly scan through it.
Finally, when I come to generate the PDF, will the files be combined. (i.e. can I have different page-breaks than I have in the RH project)?
Not sure what you mean by page breaks. As RoboHelp creates HTML files, there are no page breaks such as in paper manuals. When you create a PDF, you combine the topics you need into a single document.
If a PDF is required for you, you may want to consider not using RoboHelp for your sources. A PDF created by RoboHelp is useful for internal use, but it never seems to get good enough to give to customers. Personally, when a PDF version of a manual is required, I create the manual in FrameMaker and link or import the book into RoboHelp. You can also link Word documents, so you may want to play around with that before deciding whether to use Word, RoboHelp or FrameMaker for your source.
Greet,
Willam

Can I give our AD users access to Visual Studio Online?

Our AD is connected to our Azure Active Directory and synced via DirSync.
Is it possible for me to give our AD users access to VSO and they use their organizational login credentials OR do they need to create Microsoft accounts?
Our goal is single sign-on with our AD credentials. Please let me know if this is possible?
Thanks, Sam

Hi Sam,
You can link your Visual Studio Online account with your Azure Activy directoy. Directory administrators control who joins the directory and has possible access to your Visual Studio Online account. The users can use Azure Active directory accounts
to sign in Visual Stduio Online account. You can check this
page for more information about manage organization access for your account.
The numbers of users can access Visual Studio Online account depend on your license of Visual Studio Online account. You can add no more then 5 basic users and unlimited MSDN subscriptions if you have Basic license of Visual Studio Online account. Check
this
page for the pricing. However, you can assign team members stakeholder license if the users only view the project-level information. Check this
page for more information about stakeholder license of Visual Studio Online.
Best regards,
We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
Click
HERE to participate the survey.

ACS user access setting

I am trying to find solution for some type of settings in ACS.
Imagine for instance real situation as follows:
There is group "A" with 100 users. I need for 20 of them assign the access to devices in the group "B". I can't find any easy possibility how to do that.
Examples:
Enable the user section âPer User Defined Network Access Restrictionsâ this replace the settings of the user group and I have to add there all the devices from Group "A" to preserve their access. When Group "A" changes, I have to apply the changes to separate persons.
when I insert the device group into user group Enable privileges (level 0) and I set the Max Privilege for any AAA Client for separate persons, I will grant them level 15 privileges for all the AAA devices
When I create new user group instead Group "A" and move the users to this group, I have 2 groups for maintenance with the same privileges except the Group "B"
When I create separate level 15 privileges for every person, I have to insert there all the groups and devices from user group and I have to maintain again changes to all the people, when settings of user group changes
We often have such kind of problems. Is there any normal possibility how to add the users from this group this privileges and preserve settings from Group "A" for them?

Sounds like you really do need 2 groups since the access restrictions are totally different. If these 20 users always have different NARs to the other 80 users they should not be in the same group.
In essence this is the reason for shared profile components. So that you can multiple groups re-using pieces of config. It s obviously not perfect.
Im guessing you would like to see either nested groups or multi-group membership - but thats a world of pain and complexity.

APEX Pages - User Access List with NTLM

Hi,
I'm building several APEX Applications, and using NTLM as its Authentication Scheme. With this, the users won't have to type any user and password. And their user name stated in top right screen.
I'd like to build another application to administer users of all created APEX Applications. So I'd like to build 3 tables:
1. users (hold user name, and user data)
2. pages (hold APEX Applications pages)
3. access_list (hold combined data of users and pages and access flag)
The last table will give me an SQL that can be used to create page level Authorization Scheme.
The problem is:
I cannot find a way to get a list of user ids to pre-populated the table users. Is there a way that an administrator user use an LOV of all NTLM user instead of typing domain\user to this application? OR is there a better and elegant way to create User Access List with NTLM.
Your helps will really help me, and thanks in advance.
Regards,
Aulia

This is kind of a followup to Scott's post. Instead of using your own tables to map user accounts to permissions etc, why not simply use LDAP to query the NT domain global catalog?
You can tell what users are members of particular AD groups and control access to functions based on AD group membership. Then you would only need one table that maps Apex functionality to AD groups.
That's what we do. Our account management people add users to different security groups and they get access to our apex app based on those groups. The type of access is controlled by the group to which they belong.
If you try to capture a list of all users, you'll be constantly trying to keep your list of users in sync with your AD/NTLM accounts.
Or I guess you could simply use LDAP queries inside the database to get a list of ALL your users in a nightly batch. Wouldn't help for people added in the middle of the day, but maybe that doesn't happen often in your company.
I have posted code on using Active Directory LDAP with dbms_ldap inside the database. Shouldn't be too much trouble to modify that code to scan your directory for users every night. Search for "dbms_ldap" in this forum.

ITunes U user access log

Is there a way to show how many times or how long a user accesses your course?

Then use Usage Tracking Feature of OBIEE.
The Oracle BI Server supports the accumulation of usage tracking statistics that can be used in a variety of ways such as database optimization, aggregation strategies, or billing users or departments based on the resources they consume. The Oracle BI Server tracks usage at the detailed query level.
When you enable usage tracking, statistics for every query are inserted into a database table or are written to a usage tracking log file.
You can find more details about Usage Tracking in Server Administrator Guide.
- Madan

User access log -Analytics

hello
I need to get the user access log in order to know the user who access to the applications analytics OBIEE????

Then use Usage Tracking Feature of OBIEE.
The Oracle BI Server supports the accumulation of usage tracking statistics that can be used in a variety of ways such as database optimization, aggregation strategies, or billing users or departments based on the resources they consume. The Oracle BI Server tracks usage at the detailed query level.
When you enable usage tracking, statistics for every query are inserted into a database table or are written to a usage tracking log file.
You can find more details about Usage Tracking in Server Administrator Guide.
- Madan

OLS Label Security: how users can view own level/compartment/group choices?

I have an application using OLS (Oracle Label Security) Virtual Database (VDB) for security; to allow users to only view rows to which they have access.
I'm creating a list of values (LOV) to allow the user to change the level or compartment of a database record to a different value for which they still have access. The views that show these values is DBA_SA_USER_LEVELS (and COMPARTMENTS, GROUPS) but this view is only visible to DBA users, not the regular user. We are considering giving regular users access to this view, or granting SELECT_ALL_TABLES as suggested in an article I read. However, this approach seems to loosen security, not maintain it.
How can I allow a user to get a list of levels, compartments or groups available to them without loosening the security on the DBA_* views?
thanks,
Scott

Bump

APO Security to control the users access

Hi,
Is there any possibility to control the users access by controlling through selection ID's or does it possible through any of the product lines (Characteristics)?
My requirement is I have to control all the APO DP users in various levels of Product lines and the access has to be granted at specific product level. Right now I am trying do through selection ids, but I am looking for more effective way.
Please help me with your views.
Thank you in advance!
Jegan

Hi Jegan,
There are so many security objects in DP that you can try out and see if they meet your requirement.
The way I understand your issue is to restrict user by certain products or BW characteristics.
To control by Products, try the object C_APO_PROD with activity APO_PROD (Product Identifier). You can select specific products here for each role and restrict by either display, change, execute, delete etc.
If you want to restrict by BI characteristics, try object S_RS_AUTH.
Be careful with this as you are selecting BI objects, the system restricts them even if they are remote part of your work.
If you have to restrict by specific product levels like all product lines, I am not sure how to do it but you can certainly try searching based on keyword "PROD".
Please let us know if you discover something useful.

Tracking User Access to Help

Is there a way to track user access to HTML help? I'm wanting to be able to run a report that will tell me how often the online help is accessed either at topic level or just the full help level if that is the only possibility. Is there a plugin or third party app that can do this?
For my Webhelp apps, I am able to tag individual html files with Omniture tags, however I can't do this for a compiled .chm file. The issue with the Omniture tags is that everytime I recompile help, I have to reinsert the tags.
I am using Robohelp 8, HTML Help and Web Help
Thanks in Advance,
Diana Weber

Hi Diana.
With the web output you could try using something like Google Analytics or even invest in the RoboHelp Server application. However neither of these will work with HTML Help. The problem with HTML Help may not be the feasibility of recording hits on a file but pricacy concerns by the user. The Windows System Monitor records file hits but you'd have to manage a way of homing in on the data on each end user's PC!
Read the RoboColum(n) for a tips, tricks and musings on the Technical Communication Suite products.
Follow the RoboColum(n) on Twitter

Access on aggregated levels with virtual key figures

Hi all,
I need access to the aggregated view of a BEx report within user-exit RSR00002 for processing virtual key figures. Currently I only get access to the lowest non-aggregated level.
My requirements in detail:
I get certain key-figures (250 historical values)on the lowest aggregation level - so-called folders. Then I have to aggregate this vector of values at the next hierarchy level up to the top-level, say along-side a company's business department structure. Drill-down, slice&dice should be possible. So far so good - this is done easily with standard BEx features.
Then, on each aggregation level, i.e. hierarchy node, I need to get the third lowest of the 250 aggregated values to assign this to my vkf. This is not an issue of the algorithm but of the internal data representation or access to the OLAP processor because I don't get this vector on the same aggregated level such as I could see it in my BEx report but on the lowest non-aggregated folder level.
The question is now:
a. Is data access on aggregated levels and drill-downs because of the internal representation generally not possible within this user-exit and would I have to supply the aggragation logic myself or
b. do I have overlooked something critical - did I miss the trick?
Every idea or hint is deeply welcome!!
Thanks a lot,
Michael
Message was edited by: Michael Kronenberger

First check in Technical Information in RSRT , whether the
Virtual Char/Key Fig is Y or N.

User access at IO level

Similar Messages

Maybe you are looking for