User does not have the propoer permissions to setup Networks

Hi all,
I was happily setting up networks and watching them be created in CPO from SE 3.01 Setup Wizard only to go back later and realize that a Cloud Portal Cancel Service Request had basically removed them all approximately 3 minutes after I had set them up!!!!
It seems the user I was using didn’t have the correct authority to do this operation. See below…………
System (External) on 08/03/2012 3:10 PM "[NT AUTHORITY\SYSTEM (03/08/2012 16:10:53) - Service request cancelled due to an error.
Error Code: 1009
Error Description: The remote server returned an error: (401) Unauthorized.
User does not have proper authentication.
Automation Summary URL: \\CPO-DEV-01.uktme.cisco.com\AutomationSummaries\20120803\9ca]"
System (External) on 08/03/2012 3:10 PM "[TEO change request 'Add Network' was marked canceled by 'NT AUTHORITY\SYSTEM'.]"
The interesting thing is that I am using the cloud admin setup in the wizard who belongs in the Cloud Provider OU and this OU seems to have all the correct setting ( I checked with a parallel working system) but it was missing the nsAPI user in the OU so I added this.
One further clue is the I suspect steps 1 + 2 when using the wizard didn’t have connectivity from CCP to CPO at the time as the authentication wasn’t setup correctly but I though these step were REX internal to CCP only so this and CCP to CPO connectivity didn’t matter too much. Regardless we fixed this connectivity at this stage to proceed to step 3.
Now I suspect in step 1 & 2 sets up some user accounts in CPO for these operations and I am nervous about going back and deleting the Cloud Admin account as I seem to remember another thread about this stating it was not possible.
Any thoughts experts please?
Cheers

Hello Michael,
I have spent the whole day on the same problem then you, which forced me to check all the aspects of my 3.0.1 Starter Edition Lab installation :
- nsapiuser declaration in the CPO logins
- nsapiuser member or not of the Cloud Technical administrators (thank you, chaotic documentation...)
- IIS authentication mechanisms for RequestCenter virtual folder (disabled by default in IIS 7.5)
But none of them solved the error.
The closest information I get (I suppose) is from the CPO activities view, where I finally touched the process that fails:
I did not found the solution yet, but I am sure it is there that the Portal fails to authenticate the data from the Orchestrator.
Best regards,
David

Similar Messages

Export failing with "The user does not have the required rights to perfrom

We are testing an upgrade to BOXI 3.1. We use the CrystalReportViewer .net web control to view the report. When the export button is clicked and the Crystal Reports file format is selected, the following error message is displayed:
"The user does not have the required rights to perfrom this operation. Please contact your administrator. "
Notice that perfrom is not spelled correctly. This is what actually gets displayed.
I'm not too concerned about the spelling, but I do want to fix the error. So I checked the security on the folder and the user does have full control. Both advanced security options are selected:
-View document instances that the user owns
-Export the report's data
So what else could be causing this?

I had applied the full control access to the wrong group. Once I applied that access to the user that actually generates the report, it worked.

The logged in user does not have permissions to perform this operation

OIM 11.1.2.0.4
Connector: Microsoft Active Directory User Management 11.1.1.5.0
Action: revoke a provisioned AD account (logged in user is XELSYSADM member of SYSTEM ADMINISTRATIONS role)
Error message: IAM-2050243 : Orchestration process with id 5756, failed with error message IAM-4065011 : An error occurred in oracle.iam.provisioning.spi.DOBProvisioningMechanism/revoke(Account) while revoking account with id 1 for the user with key 43 and the cause of error is The logged in user does not have permissions to perform this operation..

The problem is missing entries into table AAD, Provisioning API uses table AAD to check administrator's scope on the user's organization.
TEST: following SQL statement should return at least a value
select aad_write, aad_delete
from aad aad
, usr usr
where aad.act_key = usr.act_key
and usr.usr_key = <user_key_of_user_you_wanto_to_revoke>
and aad.ugp_key in (
select ugp.ugp_key
from ugp ugp
, usg usg
where ugp.ugp_key = usg.ugp_key
and usg.usr_key = <user_key_of_xelsysadm>
BUG (in my case): if you create an Organization using a OIM user that does not have any Role (except default ALL USERS Role) the system does NOT add right entries into AAD table, so you can revoke account of users that are members of this Organization
WORKAROUND: manually insert entries for all Organizations (ACT_KEYs) for the user XELSYSADM into AAD table
FIX: always create an Organization using a OIM users with at least one Role except ALL USERS role

The user account in which the Oracle VSS Writer Service is running does not have the DBA privileges to log in to the Oracle instance.

VSS-00011: Connection to database instance <instance_name> failed.
Cause : The user account in which the Oracle VSS Writer Service is running does not have the DBA privileges to log in to the Oracle instance.
Action : Run the Oracle VSS Writer Service in a user account that can connect to the Oracle instance with DBA privileges.
I have assigned ora_dba group to the user that runs the Oracle VSS Writer Service which is the only Oracle solution but still getting
the above error. Was advised to raise the issue here that it is an OS issue. Pls help

The user account cannot access Oracle Database instance. And also how do you temporarily disable security software on the server.
Have you checked what I already asked for? "Try using the user account and access the Database Instance.
That will let you see if the problem is with the user account permissions or not."
If this does not help then you can contact Oracle as suggested by Dave.
This posting is provided AS IS with no warranties or guarantees , and confers no rights.
Ahmed MALEK
My Website Link
My Linkedin Profile
My MVP Profile

Cannot delegate Reporting Services Web access to domain user / group, User does not have required permissions

Hi
I have an SCCM 2012 SP1 CU3 installation on a Server 2008 R2 + SQL 2008 R2.
I'm having trouble delegating Reporting Services Web Access to a standard domain user.
I have followed the instructions from these blogs:
http://blog.coretech.dk/kea/creating-the-reporting-user-role-in-configmgr-2012/
http://www.wolffhaven45.com/blog/sccm/assigning-users-to-configmgr-reportusers-group-in-sccm-2012/
No matter how I try, I cannot get the reports to show for a standard domain user. In the console no reports are showing and in the web access I get
"User domain\user does not have required permissions........"
The only thing that is consistenly working when I test is to put the AD Group on the Security Role "Full Administrator".
Then everything will show up.
Any ideas on how to troubleshoot this?

Thanks everyone for helping me with tips. I have now solved the problem. It was the permissions from SCCM that did not replicate to the Reporting Server.
In srsrp.log I got these error messages:
Could not retrieve the reporting service name for instance 'MSSQLSERVER'
Invalid class
Could not stop the reporting serviceAfter googling a litte I found these 2 sites with similiar problems:http://social.technet.microsoft.com/Forums/en-US/d4a7f93a-506f-4e3f-b5fc-bd2b087277da/ssrs-permissions-do-not-add?forum=configmanagergeneral
http://www.microtom.net/microsoft-system-center/software-distribution/sccm-2012-reporting-services-do-not-install
So I ran the command for SQL 2008 R2: mofcomp.exe C:\Program Files (x86)\Microsoft SQL Server\100\Shared\sqlmgmproviderxpsp2up.mof
and BAAM, everything started to work =)
/ALX

IDocumentQuery.Execute() method throws user does not have edit permissions exception

I'm trying to query a document folder for all of its containing documents. Its a basic query like this:
IPortletContext PortletContext = PortletContextFactory.CreatePortletContext(Request,Response);IRemoteSession PTSession;PTSession = PortletContext.GetRemotePortalSession();IDocumentManager documentManager = PTSession.GetDocumentManager();
IDocumentQuery documentQuery = documentManager.CreateQuery(FolderID); documentQuery.SetSortProperty(ObjectProperty.Name);IObjectQuery queryResults = documentQuery.Execute();
When I'm logged into the portal as an administrator, everything works fine. However if I'm logged in as a "regular" user, I get this exception when calling the Execute() method:
Plumtree.Remote.PRC.PortalException: Exception of type Plumtree.Remote.PRC.PortalException was thrown. ---> System.Web.Services.Protocols.SoapException: Server was unable to process request. --> Access denied: Current user does not have edit permission
I'm sending the Login Token to the portlet. Now I've tried giving the user Edit rights on the document folder as well as Edit the Knowledge Directory rights in the Activity Manager, but neither gets rid of the exception. I'm not sure what other "Edit" permissions to check. I don't even see why the user would need "Edit" permission to anything in the first place since the Execute() method simply returns an IObjectQuery that doesn't have any ability to make changes to any objects. I know that I could use the SearchFactory interface, but I wanted the results to be real time. Any help would be much appreciated. Thanks!
Jimmy

The problem here is that the query is created with default settings to show unapproved documents -- only users with edit access can see unapproved documents. Add the bold line to your code and it will work.
IDocumentManager docManager = prcSession.GetDocumentManager();IDocumentQuery docQuery = docManager.CreateQuery(iFolderID);docQuery.SetShowUnapproved(false);IObjectQuery queryResults = docQuery.Execute()

Error: The user does not have sufficient privileges to install Adobe Flash Player

I get an error when the system tries to install Flash Player 11. It forced me to install when running a publish in captivate.
The user does not have sufficient privileges to install Adobe Flash Player
I tried to the advice from http://forums.adobe.com/message/4970296 to download and install offline version. I get this error:
A required file (C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe:5) could not be written due to insufficient permissions.

Try a clean install as described in http://forums.adobe.com/thread/928315

Forms Authentication Error: User '' does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed

I created a custom security extension following the steps listed in the Readme_Security Extension Sample. It works fine if I login as the user that is specified AdminConfiguration section of the rsreportserver.config file but if I
log in as another user, I get this error: User '' does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed. I've added the user to both System Administrator
and System User roles to try to get it to work but still no luck.
Does anyone know how to fix this?
Thanks.

Hi MetronM,
The issue is due to that user have no permission to access the report server. In report manager, Reporting Services includes predefined roles that we can assign to users and groups to provide immediate access to a report server. Each role defines a collection
of related tasks.
You can refer to the following steps to assign corresponding role to the user.
Open report manager.
Click “Folder Setting” button.
Click “New Role Assignment” icon.
Type the user name and select the corresponding role.
There is an article about Granting Permissions on a Native Mode Report Server, you can refer to it.
http://technet.microsoft.com/en-us/library/ms156014.aspx
Regards,
Alisa Tang
Alisa Tang
TechNet Community Support

The loged on user does not have permission to use this object'

A professional license user currently has Authorisation to all Customer BPs and Sales Documents.
When creating a random Sales Order, the error message
'Create POs(): The loged on user does not have permission to use this object'
is occuring. This is not occuring for all Sales Orders, this is occuring randomly.
Note that the Purchase Orders Button in the Logsitics tab in the sales order is NOT selected.
Cheers Lisa

hi lisa
there could be some changes in transaction notification from your side if there are any i would request you to please comment all the changes and then try saving the document it would definately go ahead as there has to be some change in the stored procedure ,
Regards,
Manish

'The logged-on user does not have permission to use this object'

Hello everyone,
I am getting the message 'The logged-on user does not have permission to use this object' while saving the Sales Order. I am logging in as a CRM user. There is an addon also running on the server, that saves some data into a user defined table when the Sales Order is saved. Is there any authoisation for users to access user defined tables.
Regards,
William

hi William,
this is an Authorization issue. provide the user with authorization on your UDT. Definition of user authorization can be found in Administration -- >> System Initialization -->> Authorizations -->> Additional Authorization Creator.... if already defined from here you can fined the additional authorization from the General authorization window.
regards,
Fidel

Error Message' "The loged on user does not have permission to use this obje

The loged on user does not have permission to use this object-
I am entering a Sales order, which is customized, when I add the Sales order this system imformation appears.
The user has a pro-license and authorizations to all AR
Can someone tell me what my problem might be?

Thank you for your help

Hr_maintain_masterdata showing an infotype that the user does not have auth

subject: hr_maintain_masterdata showing an infotype that the user does not have authorisation for
Hi all,
I've a user account that's meant to perform staffing, based on the actual HR role. The system is also set up with an infogroup that contains infotypes 0000, 0001, 0006, 0185, XYZ and other infotypes; XYZ representing an actual infotype. The HR role is not supposed to have this infotype XYZ.
When PA40 is used, infotype XYZ will be skipped, as the user account do not have authorisation for it. I could then proceed to create the record.
When the fm: hr_maintain_masterdata is used, I was prompted that I do not have authorisation for infotype XYZ.
I have setup my fm with the mininum amount of values, as indicated below.
I did not populate a table for "proposed_values" so the infotypes called were due to the actions of the infogroup.
fm: hr_maintain_masterdata
pernr = 01234567
massn = 01          (new staff)
actio = INS          (insert record)
tclas = A          (master record)
begda = 01.09.2010
endda = 31.12.9999
werks = myCompanyPlant
dialog_mode = 2     (online)
luw_mode = 1          (commit, if no errors encountered)
no_existance_check = X
Q. Is there any way to let the function module call the infotypes, with authorisation checks, as what PA40 is doing?
Your guidance would be appreciated.
Thank you,
James Wong

A behaviour that has been observed was that, after infotype 0185 was saved, the function module throws me back to infotype 0000, citing, "No authorization to maintain XYZ exists". Data that I had populated to the screen, either via the FM or by manual input were cleared. If I skip the next 4 screens, I'll arrive at the Infotype after XYZ, with the data populated. Subsequent infotypes also have their data filled in.
Once I complete the sequence, the personnel record will be created. Upon examination, the frist 4 screens that were skipped in the 2nd pass contains data that were entered in the 1st pass.
My question, as posted in the original post, is why infotype XYZ is triggered by the function module, as the staffing account does not hae access for it. If I repeat the process using PA40, the infotype is skipped accordingly.
Any help would be appreciated.
Thank you,
James Wong,

Opening my Photoshop Elements 11 does not work. I always get following message: "Could not open a volume of work, because the file is locked or you do not have the required permissions. Undo the protection of the file on using the command 'Properties' in

Opening my Photoshop Elements 11 does not work. I always get following message: "Could not open a volume of work, because the file is locked or you do not have the required permissions. Undo the protection of the file on using the command 'Properties' in Windows Explorer." What is wrong? I cannot unterstand what I have to do!

Could not open a scratch file because the file is locked or you do not have the necessary access privileges. (…) | Mylen…
Mylenium

The user does not have permission to perform the operation

Hi,
Configuration: JES Q405. Solaris 10 x86.
My customer initially installed JES (Portal + AM + DS) on the same box.
Now, they have a change in their requirement. They want DS to run dedicatedly in another box.
I have successfully installed a fresh instance of DS in the new box with the same domain name (thus maintaining the same dn). I have copied over 99user.ldif and exported all the data from the original DS in the old box.
Everything is running fine. DS in the new box is able to function properly.
On the Portal and AM side, I have changed the following file:
1. AMConfig.properties
2. serverconfig.xml
3. PSConfig.properties
I have also changed the Primary LDAP entry in iPlanetAMAuthLDAPService, iPlanetAMAuthMembershipService, and iPlanetAMPolicyConfigService.
However, when I started AM (which is running on Sun Web Server), I got the following error message:
------------------- in /var/opt/SUNWam/debug/amSDK ---------------------------
05/01/2006 04:46:43:324 PM SGT: Thread[main,5,main]
ConfigManager->Constructor: root DN dc=sg,dc=com
05/01/2006 04:46:43:403 PM SGT: Thread[main,5,main]
Invoking _ldapPool.getConnection()
05/01/2006 04:46:43:403 PM SGT: Thread[main,5,main]
Got Connection : LDAPConnection {ldap://sg-dsq405.sg.com:389 ldapVersion:3 bindDN:"cn=puser,ou=DSAME
Users,dc=sg,dc=com"}
05/01/2006 04:46:43:410 PM SGT: Thread[main,5,main]
Invoking _ldapPool.close(conn) : LDAPConnection {ldap://sg-dsq405.sg.com:389 ldapVersion:3 bindDN:"c
n=puser,ou=DSAME Users,dc=sg,dc=com"}
05/01/2006 04:46:43:411 PM SGT: Thread[main,5,main]
Released Connection : LDAPConnection {ldap://sg-dsq405.sg.com:389 ldapVersion:3 bindDN:"cn=puser,ou=
DSAME Users,dc=sg,dc=com"}
05/01/2006 04:46:43:411 PM SGT: Thread[main,5,main]
ERROR: ConfigManager->Constructor: Caught exception Message:The user does not have permission to per
form the operation.
------------------------------------ end --------------------------------------------------
-------------------------- in /var/opt/SUNWam/debug/amAuth ---------------------
05/01/2006 04:47:21:252 PM SGT: Thread[main,5,main]
Directory Host: sg-dsq405.sg.com
Directory PORT : 389
05/01/2006 04:47:21:298 PM SGT: Thread[main,5,main]
AuthD initializing
05/01/2006 04:47:21:610 PM SGT: Thread[main,5,main]
ERROR: AuthD failed to get auth session
05/01/2006 04:47:21:688 PM SGT: Thread[main,5,main]
ERROR: AuthD init()
com.iplanet.dpro.session.SessionException: AuthD failed to get auth session
at com.sun.identity.authentication.service.AuthD.initAuthSessions(AuthD.java:709)
at com.sun.identity.authentication.service.AuthD.<init>(AuthD.java:229)
at com.sun.identity.authentication.service.AuthD.getAuth(AuthD.java:494)
at com.sun.identity.authentication.UI.LoginLogoutMapping.init(LoginLogoutMapping.java:71)
at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:921)
at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:813)
at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3478)
at org.apache.catalina.core.StandardContext.start(StandardContext.java:3760)
at com.iplanet.ias.web.WebModule.start(WebModule.java:251)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1133)
at org.apache.catalina.core.StandardHost.start(StandardHost.java:652)
at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1133)
at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:355)
at org.apache.catalina.startup.Embedded.start(Embedded.java:995)
at com.iplanet.ias.web.WebContainer.start(WebContainer.java:431)
at com.iplanet.ias.web.WebContainer.startInstance(WebContainer.java:500)
at com.iplanet.ias.server.J2EERunner.confPostInit(J2EERunner.java:161)
----------------------------------------- end --------------------------------------------------
Any idea how to solve this problem? Thanks in advance!
justCheeChong
Message was edited by:
justCheeChong

check if the new DS instance has all the AM required ACI's.

List the items the user does not have access to.

I have a requirement to show the user a list of all the libraries of a site with the number of items in each even if the user does not have rights to the library. (the link or button will be grayed out if the user has no access)
I am looking for opinions on how to do it with the best performance possible.
The first candidate is to first enumerate all the items in all the libraries with elevated then do the same as the logon user and compare the collections.
The drawback is performance so maybe rely on the assumption that the overall content of the site does not change often so keep the collection from the elevated run in cache (with configurable lifetime) and only run as user on page load and compare with the
cache.
I am sure there is probably a better way so let's here it. can we take advantage of search?
This is on SP2013 but we are not using apps for unrelated reasons. We can use server object model.
Thank you all.
Ofer Gal

Hi,
I believe Search cant be used since Search is Security Trimmed. Search will not return the result if user dosent have the permission.
Thanks! Best Regards, Prasham Sabadra http://prashamsabadra.blogspot.in

User does not have the propoer permissions to setup Networks

Similar Messages

Maybe you are looking for