Users, Roles, Restricted access

We have several databases on several different platforms and a multitude of schemas spread across this "grid". We also have several "home grown" web pages that curerently present "read only" information about these databases, their contents (schemas) and connect string information, space available, tablespace usage etc. all driven by cgi scripts and other scripts that query the databases v$views or even have small databases containing specific schema related information to provide this information. The developers have one, the QA folks have a different one, the support group has a different one, but they all present very similar information. Us DBA's use EM.
I have been tasked to try to "coalese" all these into a single source and was entertaining the concept of using the OEM console as a single point of reference for all this information since it is pretty much available there already or can be included there by creating "custom reports" on the reports tab. I have been able to create some of these reports already and they look good.
Now, I want to allow many of these users who are not DBA's but who are "developers", QA engineers, Support technicians, to view all this but I do NOT want to allow them to make any kind of DBA type changes directly from their OEM session.
The way it is right now all I have is the "Super Administrator" SYSMAN account.
Any ideas on how to limit the functional access to this product without necessarily limiting the "viewing" access. I mean I'd like a developer to be able to see for instance the amount of free space in a tablespace on an instance but NOT change anything...like NOT add a datafile or anything.
Am I trying to use the EM in a way it was never intended? Is this whole thing a "bad idea". Please give me your opinions?

import java.io.BufferedReader;
import java.io.File;
import java.io.FileReader;
import java.io.StringReader;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.CharacterData;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.Node;
import org.w3c.dom.NodeList;
import org.xml.sax.InputSource;
public class XMLParsingProj {
public static void main(String arg[]) throws Exception {
String xmlData = "";
FileReader fileReader = new FileReader(new File("XMLData.xml"));
BufferedReader bufReader = new BufferedReader(fileReader);
String xmlLine = "";
while ((xmlLine = bufReader.readLine()) != null) {
xmlData += xmlLine;
System.out.println("String Value is");
System.out.println(xmlData);
DocumentBuilder db = DocumentBuilderFactory.newInstance().newDocumentBuilder();
InputSource is = new InputSource();
is.setCharacterStream(new StringReader(xmlData));
Document doc = db.parse(is);
NodeList nodes = doc.getElementsByTagName("soap:Envelope");
for (int i = 0; i < nodes.getLength(); i++) {
Element element = (Element) nodes.item(i);
NodeList name = element.getElementsByTagName("soap:Body");
Element line = (Element) name.item(0);
System.out.println("Name: " + line.getTagName());
NodeList title = element.getElementsByTagName("lookupResponse");
line = (Element) title.item(0);
System.out.println("Status: " + line.getAttribute("status"));
System.out.println("data node length :" + nodes.getLength());
}

Similar Messages

  • Query user roles and access

    hi,
    How can query user roles and access in whole database? I want to list username, status, rights, and role
    thanks
    P

    Hi,
    The data dictionary view dba_users has one row per user.
    The data dictionary view dab_role_privs has one row for every distinct combination of user and role that actually occurs ion your database,
    Are you interested in system privileges? See dba_sys_privs.
    Are you interested in individual grants, like the privilege to UPDATE a given table, or the privilege to execute a given stored procedure? See dba_tab_privs. (Don't be fooled by the name; it's not just for tables.)
    I hope this answers your question.
    If not, post some CREATE statements, that create tables, roles, and whatever else you want, and some GRANT statmeents that grant privileges on those objects. Pos the results that you would want to get from those objects and grants.

  • User role to access configuration management in NWA

    Hi,
    What USER role is required to create the destination information in configuration management in NWA. When I access NWA, I only have access to SOA management which has only Monitoring tools with role SOA technical ADmin.
    I need this to convert IDOC XML to flat file.
    thanks
    Prashanth

    Hi Prasanth,
    I am not sure about the exact role but, the ABAP role "SAP_NWA_FULL" & Java role "NWA_SUPERADMIN" will certainly help. This is the role that i had when i was trying a similar scenario.
    Please take a look at the following link which might be helpful:
    http://help.sap.com/saphelp_nwpi71/helpdata/en/45/c7ca8e89e45592e10000000a1553f7/content.htm
    You can infact ask your Basis team to help you out with this.
    I hope this helps.
    Regards, Gaurav.
    Edited by: Kumar Gaurav on Nov 9, 2010 5:57 AM

  • Cisco ISE - How to map User- Location - Restrict Access to other locations

    Hi,
    i've got a simple question and I hope someone here can help me out with this mess.
    The problem is about WLAN 802.1x Auth with Cisco WLC and a ISE.
    The design goal is the following:
    There are several branch facilities. A user belongs to only ONE facility. This user should not access the WLAN in other facilities.
    The technical design is this:
    Local WLC and/or central vWLC. In the datacenter is one ISE which must handle the auth-requests. The identity source of the users, where I add and manage them, should be the ISE itself for the first time, later I want to AD and LDAP sources.
    Here is the problem:
    I don't understand how I can create a ruleset or something else where I can define that a user of facility A can only login over APs, WLCs,.....in facility A and NOT facility B. Or maybe my design is so bad that I have to start from scratch.
    PLEASE HELP.

    I don't know but may be this is the correct way to validate the user:
    NAS-ID in AP-Groups (One AP-Group per facility) must match "12345" AND Identity-Group must match "12345".
    Iam confused because there is no way to compare these values. 
    In this case to compare the value of "NAS-ID" and die users "IDENTITY-GROUP".
    If they match against each other than "Permit-Access".

  • Creating a restricted access page.

    I need to create a restricted access page within my website, so that a username and password are required to access. The Dreamweaver instructions ask me to go to the Server Behaviors panel (Window > Server Behaviors), click the plus button and choose User Authentication > Restrict Access To Page.    However, the Server Behaviors panel does not provide me with an available plus button to choose.  What can I do about this?

    CC is the current version of DW. It was released this year and Server Behaviors were removed from it because they are outdated.  Before that was CS6, CS5.5, and CS5.  CS4 was released in Fall of 2008.
    Password Protecting a page or folder on your server can usually be done very quickly through your remote server's Admin or C-Panel.
    Or if your host server is Linux, you could do it with just 2 files:  .htaccess and .htpasswd
    http://www.htaccesstools.com/articles/password-protection/
    Nancy O.

  • Restricting Access but still allowing acces to Java Apps

    I have a university lab that needs to use a Marching Band charting program that was written in Java. It uses the Apple JRE. I heavily restrict application access on these Macs and I can't get the Java app to run as the check box will not stick under User Limitations.
    The company says that this is an Apple bug because the User Limitations restricts access to the JRE and Java only apps won't run.
    Does anyone know a way around this? I need to restrict access but they need this app.
    Thanks,
    David

    I can't help with the mail problem, but you can always disable autologin via System Preferences->Accounts. That will prevent anyone from logging in without the password. If you have other admin accounts, either delete them or make them nonadmin accounts. To prevent anyone from booting the machine with an install disk or external HD, set an open firmware password. See http://docs.info.apple.com/article.html?artnum=106482 for details.

  • How to implement Oracle user/role security with Access front end?

    Hi,
    We have successfully migrated our Access database tables to Oracle 10g using SQL developer. We've recreated all the users and roles(i.e., access groups) in Oracle and granted rights to tables.
    In the Access front end database, in the Database window we have saved linked Oracle tables which replaced the Access tables. The forms, reports, queries run fine with the linked Oracle tables. All the linked table use one ODBC DSN to the Oracle database with the same Oracle user id.
    We need to be able to authenticate users into the Oracle database and RE-link the tables based on their own unique user id. By during so we can allow users to use the Oracle standard user id/role and system privileges to control select, update, ect. rights to the database.
    I've been able to use the VB code within Access to logon into the database with a unique id, but I have not been able to find out how to RE-link the tables to the unique user id using VB. There should be some way to relink tables dynamically, based on users login into the Access front end.
    I don't know a great deal about Access projects, but I do know with SQL server allows login into your Access project and link tables dynamically.
    Can someone give me some assistance or point me in the right direction?
    Thanks in advance,
    Larry

    We had one of our programmers here come up with a VB code solution for re-linking table within Access. However the relinking takes 3-4 minutes for 100+ tables.
    In an effort to help you understand the situation better, I will attempt to elaborate on the problem:
    We have an Access 2003 application which currently has a front end using Access(forms, reports, queries, & VB code) and a MS Access 2003 backend.
    We have migrated the backend tables to Oracle. However, we still have a need to maintain the front end in Access, since we have over 60 forms, 40 reports, 200+ queries in Access. Its easy to understand, we have a significant investment in the front end(Obviously, the plan is to migrate the front end also at some future date).
    In order to utilized the existing front end, we have to validate and modify the current front end connections to the new Oracle backend. One of the features of Access is that you can "link" tables and save the link for runtime. Each Access table can have its own link which is a separate ODBC/JET connection. As such, each separate link has its own userid/database information.
    The other issue with using the Access front-end is that Access utilizes a workgroup file to implement user and group security. The workgroup file contains all the users and which groups the users belong to in Access. Then within Access, you allow users access to object(tables, queries, ect) by their userid and or group. When users open an Access database with Access security enabled, they are required to log into Access. The login is authenticated by the workgroup file. Once, logged into Access, users have rights to Access objects based on their rights granted to their userid and groups they belong. The problem here is that when you remove the linked Access tables and replace them with linked Oracle tables, Access has knowledge about Oracle table rights granted to users; nor would you expect it to.
    The dilema is the disconnect between Access and the fact Oracle utilizes a similar but much more sophisticated security model. It creates users and roles(which are similar to Access groups), and again this is independent of Access security.
    Our solution was to still use the Access workgroup file security along with the Oracle security model. By using the Access userid and then creating a similar Oracle userid with similar table rights granted in Access, you could apply security within Access and also with the Oracle database.
    For example, a user BOB logs into Access via the workgroup file, using VB code, Access then establishes a Oracle connection logining into Oracle using the same unique userid BOB into Oracle.
    After connecting and validating user BOB into Oracle, then the Access tables are relinked to Oracle using the user BOB userid and table rights.
    This Oracle userid has been granted table rights specific for this userid.This allows the user BOB to use the Access application and still be authenticated into the Oracle database.
    The problem with this solution is that the relinking of the saved Access tables takes 3-7 minutes for about 100+ tables. This is not acceptable for users each time they log into the application.
    Our current alternative is to use one Oracle userid to login each user, and use Access form restrictions/security to allow/prevent users from updating/viewing data. Obviously, this is not the optimal solution in respect to security, but it at least allows us to control access to the data(via the forms) by using one logon required for each user, and quick startup time for the application.
    I understand SQL server does a better job in integration, but we use Oracle which is what I am trying to work with.
    Larry

  • How to restrict access to views for some users in the app?

    Hi SDN!
    I have an WD application wich embedded in the portal. Appication has 2 iViews (and 2  pages respectively). These iViews consist several views connected with each other (e.g. one view provide list data, second view is add/edit form for this data). I need to restrict access for some users for view with add/edit form. I can't make separate page for this view.
    What I've done:
    1) create yet another UIContainer for this view in main window and embed view to this container. It was be done for create separate iView for form.
    2) in the portal I create iView for this form but don't embedd in any page.
    When I try to call my form from list data (that is one iView from another) I get exception:
    <b>com.sap.tc.webdynpro.services.exceptions.WDRuntimeException: duplicate usage of view .MyCarRentalAddCity</b>
    Is there a way to get needed functional?
    Thanks,
    Lev

    Hi,
    do you need to remove the IView from the portal menu or do you just want to make a View container in your WD application invisible if the user doesn't have the rights to see it.
    If so, you could create your own roles on the app server:
    You need to create a new class that extends NamePermission like:
    import com.sap.security.api.permissions.NamePermission;
    public class ApplicationAccessPermission extends NamePermission {
               * @param name
              public ApplicationAccessPermission(String name) {
                   super(name);
               * @param name
               * @param action
              public ApplicationAccessPermission(String name, String action) {
                   super(name, action);
    Also, you have to create an Action.XML file that looks like this:
    <BUSINESSSERVICE
         NAME="com.vendor.administration">
         <DESCRIPTION
              LOCALE="en"
              VALUE="actions view usage"/>
         <ACTION
              NAME="View Permission">
              <DESCRIPTION
                   LOCALE="en"
                   VALUE="Show view"
                   />
              <PERMISSION
                   CLASS="com.vendor.utilities.ApplicationAccessPermission"
                   NAME="ShowView"
                   />
         </ACTION>
    </BUSINESSSERVICE>
    If you have created these to files in your packages, you can access this function like:
    IUser user ;
    try {
              user = WDClientUser.getCurrentUser().getSAPUser();
              if(user.hasPermission(new ApplicationAccessPermission("Show view"))){
                   wdContext.currentV_UIElement().setViewVisibility(WDVisibility.VISIBLE);
              }else{
                   wdContext.currentV_UIElement().setViewVisibility(WDVisibility.NONE);
         }catch (WDUMException e1) {
              wdContext.currentV_UIElement().setViewVisibility(WDVisibility.NONE);
                    e1.printStacktrace();
    You have to bind the ViewVisibility attribute of the context to the View Container you want to hide.
    The applicationAccessPermission you defined in the XML File will be visible in the UME Manager of you J2EE engine. With this action you can create a new role and group that you can map to the users that should see you view.
    But, the exception you get is because you have embedded one view twice, which is not possible.
    Hope this helps.
    Regards,
    Dennis

  • Creation of roles with restricted access to infoarea

    HI !
    We need to create some custom roles in BW, which will restrict the user (with that role) to access only specific infoareas in BW,  i.e. the reports and Infoproviders etc created under those InfoAreas.
    When I tried to create a role in tcode PFCG, I dont get any such options to restrict by InfoArea. Do we have to create custom Authorization objects for this and assign them to this role? if yes, how do we create such Authorization objects?
    I am totally new to roles/profiles etc... i read the online documentations, but cudnt understand them much.
    <u>Please provide the steps to do this</u>.
    Thanks,
    SUshmita

    hi Sushmita,
    try authorization object S_RS_COMP - business explorer compnent (under RS - business information warehouse),
    you can specify infoarea, infocube
    hope this helps.

  • Restricting access to reports for certain users

    Hi,
    We have few reports on a Multicube with Reporting unit authorization object. A certain group of users has this authorization. Now, we want a few of these users not to have access to one particular report on this multiprovider.
    Can anyone suggest a way to achieve this?
    Thanks,
    Abhishek.

    Abhishek,
    Use S_RS_COMP authorization object to restrict by queries. You can create 2 roles based on this object, one role with access to all the queries. The second one will have access to all but one. You can assign this role to relevant people.
    Although, this is slightly more maintenance intensive as every time a new query is created, someone has to add the query to one fo the roles based on security required.
    -Saket

  • Not able to restrict user groups from accessing certain entities

    We have created user groups and are trying to give them restricted access to certain entities so that they can perform consolidations only for those entities. But even after creating Security Classes (and assigning them to the entities in the metadata) and assigning [Default] security class access as Read Only, the users are still able to access and consolidate all the entities using process control.
    Can anyone please let me know how to restrict consolidation to only certain entities?

    To solve this you need the following information:
    -- What roles do the users have? Anyone with the Administrator role has full access to all classes.
    -- Examine the groups. If any users are members of a group which has more access than the users have as individuals, they get the greater access level. You can generate a report which shows all roles for all users including the derived roles.
    -- Examine your metadata. Do the entities in question have the classes you intend? If you omit a class (the field has been left blank), HFM treats it like the [Default] class.
    With this information we could help you troubleshoot the issue.
    --Chris                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

  • Restricted access for user in SU01

    Hi All
    How can we give authorisation to a User to modify access (Create/Delete/Password Change/Role assign /Role Delete..etc) for other user IDs but that user should have only display access for his User ID.
    Please Help me in this.

    Hi,
    I have worked with many clients, and the requirement of handling the user Administration and Role Administration is different from each client to other client.
    Some client may ask for the same person should handle both User and Role ADministration, but some client may ask for separating the tasks.
    In your case, if you want to restric the person to maintain the other users but not the own user id, this can be achieved by doing the following:
    Create a separate user group who is doing the administration part and create other user groups for other users.
    Create a role with SU01 and restrict the Standard objects with all user groups except the administation one and add S_USER_GRP authorization object manually into the same role and provide only 03 with the administration object.
    The above will solve the problem of administration not able to update the own user id, but the other users.
    Regards
    Anandm

  • ASA WebVPN. How do you restrict access to users in an AD group using LDAP?

    Hi All,
    I am trying to configure separate WebVPN connection profiles to give different portal bookmark contents to users based on their AD group membership.  This has been very difficult, even though I beleive it should be easy.
    The login page of teh ASA by default has a dropdown to allow default users to access the default portal and the SSL VPN client connection.
    There are two other portals that I would like to restrict access to based on AD group membership.  I have set these up to be selected by URL.
    The biggest problem is, I have no way of knowing how to go about this.  The AAA LDAP options show a group membership search, which I have configured, but I cannot say "Profile X is restricted to AD group CarpetBaggers", so that if soneone that is NOT a carpetbagger tries to log in, it fails.
    I can only do an all or nothing scenario.
    It would be nice to use Dynamic Access Policies to do this, and I have created a few, but they do NOT seem to work when the drop down aliases or URLs are in use.  So how do I go about using them in this scenario?  Turning off the aliases or URLs is not really an option right now.
    Scenario 1 would work the best for me.  Restrict access to profiles/groups based on AD group membership using LDAP.
    Scenario 2 would be an ideal longer term solution.
    Any thoughts, ideas or assitance would be greatly appreciated.
    Cheers

    This is exactly what i was looking for, and Nelson is correct.  When you enter the DAP configuration for a profile click on "Advanced" and there is the option to create a logical expression.  The guide (ther is a button to access this) is really helpful, with a couple of examples.  This is what i used:
    assert(function()
       if ( (type(aaa.ldap.distinguishedName) == "string") and
            (string.find(aaa.ldap.distinguishedName, "OU=Users") ~= nil) )
    then
           return true
       end
       return false
    end)()
    from the debug dap you can see what Users relates to;
    DAP_TRACE: Username: MyUsername, aaa.ldap.distinguishedName = CN=Mr B,OU=Users,OU=Site ******,DC=CH,DC=Mycompany,DC=com
    My admin account fails to get me in to the same profile:
    DAP_TRACE: dap_add_to_lua_tree:aaa["ldap"]["distinguishedName"]="CN=Admin Mr B,OU=Admin Users,OU=Site *****,DC=CH,DC=Mycompany,DC=com"
    Thanks
    Andrew

  • HT201304 Is it possible to restrict access to specific IOS apps based on the WIFI profile that a user has connected to?

    Is it possible to restrict access to specific IOS apps based on the WIFI profile that a user has connected to?

    you might be able to block it if the app uses Internet access
    and depending on your wireless you might be able to block a specific user
    accessing the backend host that the app uses
    some firewalls offer application filtering but I'm not aware of any that work with ios apps

  • Restrict access to buttons, regions, etc. on a per user basis?

    My application restricts access to buttons, regions, etc. on a per user basis.
    Here is my application logic...
    1. A User can only edit items they own.
    2. A Super-User can edit all items
    So, when a user logs in, I use a post-authentication process to set the user ID to an application level item.
    Now, for example, to have an edit button display on a page, I need to check the item's owner ID against the application level user ID...and check to see if this user is on the Super User list via a query.(which could be set to another application level item upon login...I guess)
    Question...What is the best way to do this? Conditional display? Authorization scheme?
    Would something like the following work for a Conditional Display?
    Condition: SQL Expression
    &USER_ID.=&P6_ITEM_OWNER_ID. OR USER_ID in (select USER_ID from table where USER_ID=&USER_ID.)
    How would I do this with an Authorization Scheme? (I like the idea of updating the logic in single location...but I'm not sure if it is possible because I have to check PX_OWNER_ID would be different on each page.)

    Hi Denes,
    Thanks for your code which allows user to edit (if authorized) and view (if not).
    But some how - I do not get the image to show up - instead it show a small underline.
    From SQL point of view - here is what I get - when i run the sql
    '<img src="/i/ed-item.gif">',2,CR TEST,,,,dune2.cit.cornell.edu,CRDMTEST.CIT.CORNELL.EDU,PSPROD,,,CRDMTEST
    Here is my wrap_image function
    create or replace function wrap_image(p_user_name in varchar2,p_dm_name_id in number)
    return varchar2 IS
    v boolean := False;
    ret_val varchar2(1000);
    begin
    dbms_output.put_line('user='||p_user_name);
    dbms_output.put_line('dm_name='||p_dm_name_id);
    -- Check authorization if the user is super user - return true, else if he has edit priv on dm_name_id - return true - else false
    v:=ACL_DMTOOLS_DM_PRIV(p_user_name,p_dm_name_id);
    if v then
    ret_val := '<img src="/i/ed-item.gif">';
    ret_val := ''''||ret_val||'''';
    dbms_output.put_line('TRUE');
    else
    ret_val := '';
    dbms_output.put_line('FALSE');
    end if;
    return ret_val;
    end;
    Thanks for your great educational site.
    Regards
    atul

Maybe you are looking for

  • Cant Figure out if OS or Trackpad bug

    I am new to the glass mousepad and taken aback by its slow response. I dont know if its a snow leopard bug or my trackpad is faulty. Sometimes double and right clicking doesnt happen and i have to tap hard. Also another peculiar problem is that if I

  • Can't get master and subpages to show in PDF doc

    I have created a PDF doc and revised it in Adobe LiveCycle. I can see the pages in LiveCycle, but when I PDF the doc it just shows one page. Please advise.

  • CloseDoc is interrupting a batch run script in Acrobat X

    I am using a batch script to split a PDF file and then process (send via email) the individual pages.  Because extractPages opens the new page each time it's called, I had inserted a closeDoc referencing the new doc object so that I didn't end up wit

  • Oracle Database Sizing

    I'm looking for a source of information regardind Oracle database sizing. Does anyone can help me? Thank you. null

  • Need help in personnel development

    Could some one explain me what are the personnel development infotypes (PD).