Using APM to lock down attributes in 11.1.2.1.0

I am new to APM and OIM.
I want to use the policies in APM to deny edits to certain fields (say Display Name on the my information page) for a normal user, but allow edits for someone with the User Administration role.
Reading the documentation here: http://docs.oracle.com/cd/E37115_01/dev.1112/e27150/securityarch.htm#CEGDHJHC it seems to be as easy as adding the denied fields to OrclOIMDeniedAttributesDirect in a policy like OrclOIMUserSelfServiceDirectWithAttributesObligation (if I'm reading it right).
My question is, where do I get the attribute names from that I want to deny? Are they the database fields, the ones in web composer or the ones in the ldap server? Or should they be attributes that exist in the APM attributes section already? Or, is there something I need to do to OIM to allow the attributes to be understood by APM?
Any help would be appreciated.
Thanks!

Apologies, I meant a policy like OrclOIMUserSelfServiceDirectWithAttributesPolicy - not OrclOIMUserSelfServiceDirectWithAttributesObligation (cut and paste error)

Similar Messages

How to use configurator to lock down settings on the iPad?

Hi All,
I'm pretty new to the iPad / Configurator scene but have grasped the basics on how to deploy profiles etc using configurator. My question is this - I would like to be able to lock the 'settings' feature to not allow general user access without a passcode @ least, is this possible?
In an educational environment i would really like this to be done because we all know how tech savvy students are now!
Sorry if this has been asked before but after an hour or so of searching, i've given up
Thanks,
Dave

The ipad is still a personal device. A knowledgeable student can delete configuration profiles hence all associate apps and settings. you will want a standard restore image to fix the device.
Use VPP. Select an MDM. Read the google doc below.
IT Resources -- ios & OS X -- This is a fantastic web page. I like the education site over the business site.
View documentation, video tutorials, and web pages to help IT professionals develop and deploy education solutions.
http://www.apple.com/education/resources/information-technology.html
   business site is:
   http://www.apple.com/lae/ipad/business/resources/
Excellent guide. See announcment post -- https://discussions.apple.com/thread/4256735?tstart=0
https://docs.google.com/document/d/1SMBgyzONxcx6_FswgkW9XYLpA4oCt_2y1uw9ceMZ9F4/ edit?pli=1
good tips for initial deployment:
https://discussions.apple.com/message/18942350#18942350
https://discussions.apple.com/thread/3804209?tstart=0
Educational institutions in the USA can use the App Store Volume Purchase Program (VPP) to buy Apps.
https://support.assistiveware.com/index.php?pg=kb.page&id=54
There are three ownership models:
    *     Personal
    *     Institution
    *     Layered. combines personal & institution.
Watch this apple video on layered ownership. It education based, but that's OK.
http://www.apple.com/education/resources/videos/#ios-layered-ownership

I am using a Photoshop cs2, and I wonder if it is possible to keep the settings of the guidelines when closing an image, with the actual document ? It would be nice to have the guidelines locked down, I find it than when opening the same or another image,

I am using a Photoshop cs2, and I wonder if it is possible to keep the settings of the guidelines when closing an image, with the actual document ? It would be nice to have the guidelines locked down, I find it than when opening the same or another image, the guidelines are not locked, it is annoying to have to lock them down again. and it would actually be nice, to ba able to give specific directions when placing the guidelines. Thanks

Then why are the guides unlocked when I reopen a document that I saved with the guides locked ?
Thanks.

The Adobe Photoshop CC 2014 - I can't use becouse is LOOCK DOWN the computer - When USE is LOCK the computer so everything is LOCKING can't even move the mouse + need to restart the computer and use Photoshop CC 64 bit instead - have this problem for abo

The Adobe Photoshop CC 2014 - I can't use becouse is LOOCK DOWN the computer -
When USE is LOCK the computer so everything is LOCKING can't even move the mouse + need to restart the computer and use Photoshop CC 64 bit instead - have this problem for about 6 months ...

Please read this (in particular the section titled "Supply pertinent information for quicker answers"):
http://blogs.adobe.com/crawlspace/2012/07/photoshop-basic-troubleshooting-steps-to-fix-mos t-issues.html
http://forums.adobe.com/docs/DOC-2325
Are you trying to use a 32bit version (I did not even know there is one for Photoshop CC 2014)?
If so – why?

Trying to lock down DNS server settings to force use of OpenDNS

I'm trying to lock down my time capsule on my home network to only allow outgoing DNS traffic to go through OpenDNS. I have an 18 year old son, with his own computer, who bypasses my OpenDNS by entering the DNS settings for Google on his Windows 7 machine. I have no control over his machine, only my router.
A discussion on the OpenDNS forums mentions blocking port 53 and forcing all DNS traffic through the OpenDNS server settings I've entered into my router, but I can't see any way to do this on the time capsule. Am I missing something?

There is nothing you can do.. TC do not have access to firewall.. at least for ipv4.
You need a much better router.. bridge the TC and grab a Netgear WNDR3800 and run Gargoyle firmware. The power will be put back in your hands.. then he will buy his own 3G connection.. maybe at 18 it is rather too late.

Wireless Controller locking down User per SSID

I am using Wireless Controller 4112. We use WPA enterprise mode for authentication and encryption via Microsoft IAS server and MS AD domain.
My question is how to lock down a user to a specific SSID? I would guess that this is via some vendor specific radius attributes, am I right? And if so, what would be the name (and ID) for the attributes?
Thanks in advance.

Making progress in setting up the wireless controller with multiple VLAN and WLAN/SSID. I create a virtaul interface at the controller and assign a VLAN number to it. The controller mgmt port is also set to a trunk port. Create a new SSID WLAN and have it mapped to the new virtual interface. Things work good.
The new problem I am trying to solve is how to prevent wired users to access the controller admin web interface via the virtual interface IP. I try create ACL and map it to the virtual interface. It doesn't seem working.

Lock down X140e BIOS

Hello!
I'm deploying 55 of the Thinkpad x140e to a school, and I want to be able to lock down the BIOS so the students won't be able to boot from other devices or make any other changes in the BIOS. I'm wondering if anyone knows of an application that allows me to lock down the BIOS without having to do it manually on every machine. I'm imaging them with the same image, so if there's an application that can be put on the image beforehand, that would be ideal. Anyone run into a similar situation or know of any solutions?
Thanks in advance for any help you can provide!
Solved!
Go to Solution.

Lenovo has some scripts (and accompanying documentation) for configuring the BIOS through WMI available here:
http://support.lenovo.com/us/en/documents/ht100612
The X140e isn't listed as a supported model, but it might be worth a try anyhow.
How are you deploying the image? If you're using something like MDT or SCCM you would create a task that runs the script as part of the imaging process.

How do I lock down an iPad from having certain apps removed?

Hello,
We are a Microsoft-based enterprise that has purchased iPad 2 devices as a means of reducing costs of wireless services as well as integration with the 3G adapter (to reduce damage and theft). While I have had great success with the iPhone Configuration Utility and an MDM server, I need to ensure that users cannot remove the Find My iPad App which we use to track employees and ensure they do not lose or steal the device (since they can't remove the battery).
What can I do to lock down this app from being removed and also, I want to give these employees access to load whatever they wish on these iPad units. We control their access through a VPN to a Microsoft Terminal Server and with Microsoft Exchange but I don't want iTunes and the CEO's credit card being used to purchase apps. Any ideas anyone? I know that this can be done and if not, it will be done by me.
Brian Tate
Information Technology Manager
Grand Texas Homes Inc
http://www.grandhomes.com

I'm not sure about the apps, but to prevent theft, you'll also need to disable the power button and the ability to restore the ipad. You might also want to superglue in your Sim card because if they remove that, it wont be tracked unless they connect to WiFi.
Also, I'm not so sure it is an app on the iPad. I think it is built into the mail, calendar and contacts options if you have a Mobile me account. http://www.apple.com/ipad/find-my-ipad-setup/

Would like to know how to Completely Lock-down Windows 7 OS

I don't have a general question..
It's more like specifics about how to lock down windows 7 computers..
Here's a little background information...
I have two computers, both with win 7(Pro, and home prem).
A family member can somehow bypass all bios and all windows security services... Everytime I go to work or school, he will power on my desktop and somehow 'hack' into the OS and install keyloggers or viruses so he can obtain my banking or other personal information.
He also unlocks and deletes all the passwords so he can have access whenever he wants..
Can someone please tell me how to do a complete lockdown? This is getting extremely annoying.. I've done everything that I can do; Also considering on switching my major to some sort of computer security. I'm starting to lose my mind over these months.. All
help is appreciated.
I've password protected BIOS
I've disabled administrator accounts, i've put password on the admin and the guest user; locked the option to change passwords..
All help is appreciated. Thank you all in advance.

Hi,
If you are using Windows 7 Professional, Ultimate, or Enterprise, you can use the Local Group Policy Editor to change policies that affect the security of your computer. Please check if the following policies meet you requirements.
[User Configuration\Administrative Templates\Windows Components\Windows Explorer]
Enable these two polices:
Prevent access to drives from My Computer
Hide these specified drives in My Computer
For your reference:
Lock Down PCs with Windows 7:
http://technet.microsoft.com/en-us/windows/gg983426.aspx
Also, restrict Which Programs a User Can Run. You can set rules in AppLocker in the Group Policy Editor that prevents all programs from being run.
In addition, temporarily Lock Your Computer if Someone Tries to Guess Your Password
If you share your computer with other family members or allow your friends to use it, you should have a password on your Windows account so no one else can log into it. However, someone may try to guess your password and log into your account. If this happens,
you can temporarily lock your computer.
You should also periodically change your password.
If you suspect, you family member using a tool to bypass your password. You may use Malicious Software Removal Tool (http://www.microsoft.com/security/pc-security/malware-removal.aspx)
to remove it.
Hope it helps.
Regards,
Blair Deng
Blair Deng
TechNet Community Support

What are the security settings to lock down a form with fillable fields and yet allow someone with Reader to fill in the fields as will as save the form and print it?

What are the security settings to lock down a form with fillable fields and yet allow someone with Reader to fill in the fields as will as save the form and print it?

You want to allow someone to open your document and fill out the form (in the fields you have created), but not change or edit the form, right? Here's the answer - assuming you are using Acrobat Pro and someone will be opening the PDF using at least Acrobat Reader 9 and up:
Tools > Protection > Encrypt < Encrypt with Password
Answer YES to change the security.
A new window opens:
     Do NOT select Document Open (or that will require a password to open the document.)
     Select: Permissions (Check the box next to "Restrict editing and printing of the document.")
     Change the following 2 settings from the drop-down box:
          Printing Allowed: Select High Resolution
          Changes Allowed: Select Commenting, filling in form fields, and signing signature fields
          Leave selected: "Enable text access for screen reader devices for the visually impaired"
          Change Permissions Password (insert a strong password)
          Leave all other settings alone in "Options"
          OK - OK
          Re-enter the Permissions Password (the one you entered above)
          OK - OK
          Save the PDF to apply the security [notice that (SECURED0 will appear after the document title]

Hello My ipads Power button is not working properly when I press it once it shows option to turn off instead of locking and some other display problems like it suddenly lockes down or display disappears ...Please help. Thank You

Hello My ipads Power button is not working properly when I press it once it shows option to turn off instead of locking and some other display problems like it suddenly lockes down or display disappears ...Please help. Thank You

Thanks for that information!
I'm sure I will be calling AppleCare, but the problem is, they charge for the phone calls don't they? Because I don't have money to be spending to be on the phone with a support service.
In other things, it seemed like the only time my MacBook was working was when I had Snow Leopard without the 10.6.8 update download that was supposed to be done to prepare for OS X Lion.
When I look at the information of my HD it says that I have 10.6.8 but that was the install that it claimed to have failed and caused me to restart resulting in all of the repeated problems.
Also, because my computer is currently down, and I've lost all files how would that effect the use of my iPhone? Because if it doesn't get fixed by the time OS 5 is released, how would I be able to upgrade?!

Locking down multiple PDF's at a time

We want to lock down multiple PDFs at once, meaning we do not want people to be able to save the files or copy text in the PDFs. When we turn it on one at a time we go to File- Properties- Security tab and change the security method to Password security and so on. We would love to find a way to change that on multiple PDFs at a time. I have done searches for how to do this and they say to click on advanced- Document processing- Batch processing. I am using acrobat 9 Standard and I am not able to see batch processing. Do I need to upgrade to Pro? Or is there a different way to accomplish this task that I am missing?
Thanks

I have upgraded to PRO and I still only see this. When I did the install I told it to do a complete install. Is there a plug-in that I need to have for this to work? Any other ideas would be helpful.
I

Directory preferences in a locked down PC environment

How do I change:
ide.pref.dir
ide.pref.dir.base
ide.user.dir
ide.work.dir
ide.work.dir.base
user.home
so that they don't reference a windows path like \\<server>\<user>$, but <drive letter>:\Oracle\sqldeveloper instead
We use locked down PC's (with no access to the A: and C: drives) . And when we start SQLD we get 16 dialogue windows say that it cannot access the A: drive, to which we press the continue button. You also get the message when using the File navigator and the File->Open or File-Save functions.
On upgrade from 1.5.1 to 1.5.4 the number of dialogue windows dropped from 16 to 2.
We also always lose our connextions and have to reimport from a saved file every morning.
A response to thread Connections fail to load at startup by user user641239 at 1-sep-2008 0:59 seems to have the solution - except it requires access to regedit. We don't have that. It's much too painful to get SQLD part of the PC build at the customer, so we need to be able to configure without resorting to regedit.
Any help appreciated.
Nic
Edited by: Nic Atkin on 17-apr-2009 2:41
Edited by: Nic Atkin on 17-apr-2009 2:54

Hi FurryOne,
There is a way to hide both A: and C: - but you need Windows Administrator rights to do it. Not possible in a locked down PC, So I'll live with it for now.
I was also having the Configure File Type Associations at startup everytime problem (see
Re: Configure File Type Associations at startup everytime
So, my current solution looks like this:
AddVMOption -Dide.pref.dir.base=M:\Oracle\
AddVMOption -Dide.pref.dir=M:\Oracle\sqldeveloper
AddVMOption -Dide.user.dir.base=M:\Oracle\
AddVMOption -Dide.user.dir=M:\Oracle\sqldeveloper
AddVMOption -Dide.work.dir.base=M:\Oracle\
AddVMOption -Dide.work.dir=M:\Oracle\sqldeveloper
AddVMOption -Duser.home=M:\
AddVMOption -Dno.shell.integration=true

Data network locked down when usb tethering with a lot of request (i.e. 3 to 4 tab pages and IRC)

Hi, i am currently using the usb tethering on my ubuntu desktop(this also happened in win8 desktop) which the data network will be locked down when open 3 to 4 tab pages in 3-4 seconds or requesting large amount of data traffic (i.e. downloading movie)
This locked down will be recovered only after a few minutes (4 minutes at least) when there is no more request maked.
OR reboot the phone again.
This doesn't affect receiving calls, only the data network is locked down
I do see this is a software problem as i have asked for a exchange for phone, the same thing happened again.
Does anyone get the same problem as i experienced?
The firmware is v.114
Thanks for help

Hi z1CUser
based on your information, i believe there is not problem with the phone, since even second phone is doing same thing as first, what I can suggest is
>check with different phone if possible and see whether it does same, incase 'Yes" then its might be with the internet connection i believe, you can give a call to Internet Service Provider, stating the issue faced in 2 different phones
>if possible Refresh the Router and try to connect it again
>Last you can try to restore the phone once
Manjuboyz
NOTE:
Rate me(Kudos) If you are happy with my Resolution, Thanks

Can we lock down user admin functionality to allow password changes only?

Hi,
Is it possible to lock down the user admin functionality so a specific role can only change passwords?
We have a large user base of >10K infrequent users that are forced to change their passwords every 30 days. We suspect a lot will require password changes and we are keen to not have the tech team spending most of their time dealing with such requests. We would like to pass this task onto data management but not allow them the system administrator functionality.
We know we can create a responsibility with a limited menu available so the operator can see only the security/user/define menu. But this will still allow the person to add responsibilities to existing user accounts and create new user accounts, both of which are deemed unacceptable security risks. Is it possible to lock down the form as well as the menu? Allowing operators to only change the password of existing users? Or can we use the custom.pll to error when a user tries to do anything except edit the password field when in this role?
Thanks
Matt

You should be able to do that. You would create a new privilege level (ie 7), assign all commands to that level except (this is my guess) the command vpn-sessiondb, you would put that at a lower privilege level (ie 6). Here's a write-up that may help getting you in the right direction.
http://www.packetpros.com/2012/08/read-only-asdm.html

Using APM to lock down attributes in 11.1.2.1.0

Similar Messages

Maybe you are looking for