What permissions are needed to be able to view requests?
Hi OIM gurus,
Let's say a user logged in and requested a resource and it was assigned and provisioned to him/her. A request id is created in OIM. Now, what permission is needed for another user (an admin) to view this request with this request id? I see that if an admin is member of "SYSTEM ADMINISTRATORS" group the admin is able to view the request details, but it is not working if the admin is member of any other user groups. I tried to add this other user group on the Resource object under Administrators, as well as Object Authorizers, and also in the Process Definition Administrators. But it doesn't seem to work.
Could someone help me with this?
Thanks a lot
Thanks Martin. I kind of followed it up into the code (ofcourse using Jad) and ended up with the Stored procedure XL_SPG_GetAllowedRequests which is called to get all the allowed requests for this user. From this, it seems like the admin (or his group) has to be one of the approvers of the request and then he can view the request. If he did not approve he cannot view the request.
There was a bug fix around 2 years back (like you mentioned) that extended the base requirement (of SYSTEM ADMINISTRATORS user group) and at that time they might have added the call to get allowed requests.
I will leave this thread open to see if someone has any other thoughts to get around this.
Thanks
Similar Messages
-
What permissions are needed on the client side for RunspaceFactory.CreateRunspace?
Hi.
I am running a remote powershell command from an IIS application to an Exchange server getting the below error. Everything works fine if the IIS application pool identity is in the local administrators group on the IIS server so we can rule out issues with
firewall or anything on the Exchange server. It is a problem with lack of privileges on the local server.
So my question is: What permissions are required on the local server for RunspaceFactory.CreateRunspace? I find good documentation on the permissions required on the server side, but nothing about the client side.
The last Win32 error code after failure is 1008.
An internal error occurred.
at at System.Management.Automation.Remoting.Client.WSManClientSessionTransportManager.Initialize(Uri connectionUri, WSManConnectionInfo connectionInfo)
at System.Management.Automation.Remoting.Client.WSManClientSessionTransportManager..ctor(Guid runspacePoolInstanceId, WSManConnectionInfo connectionInfo, PSRemotingCryptoHelper cryptoHelper)
at System.Management.Automation.Remoting.ClientRemoteSessionDSHandlerImpl..ctor(ClientRemoteSession session, PSRemotingCryptoHelper cryptoHelper, RunspaceConnectionInfo connectionInfo, URIDirectionReported uriRedirectionHandler)
at System.Management.Automation.Remoting.ClientRemoteSessionImpl..ctor(RemoteRunspacePoolInternal rsPool, URIDirectionReported uriRedirectionHandler)
at System.Management.Automation.Internal.ClientRunspacePoolDataStructureHandler..ctor(RemoteRunspacePoolInternal clientRunspacePool, TypeTable typeTable)
at System.Management.Automation.Runspaces.Internal.RemoteRunspacePoolInternal..ctor(Int32 minRunspaces, Int32 maxRunspaces, TypeTable typeTable, PSHost host, PSPrimitiveDictionary applicationArguments, RunspaceConnectionInfo connectionInfo)
at System.Management.Automation.Runspaces.RunspacePool..ctor(Int32 minRunspaces, Int32 maxRunspaces, TypeTable typeTable, PSHost host, PSPrimitiveDictionary applicationArguments, RunspaceConnectionInfo connectionInfo)
at System.Management.Automation.Runspaces.RunspaceFactory.CreateRunspacePool(Int32 minRunspaces, Int32 maxRunspaces, RunspaceConnectionInfo connectionInfo, PSHost host, TypeTable typeTable, PSPrimitiveDictionary applicationArguments)
at System.Management.Automation.RemoteRunspace..ctor(TypeTable typeTable, RunspaceConnectionInfo connectionInfo, PSHost host, PSPrimitiveDictionary applicationArguments)
at System.Management.Automation.Runspaces.RunspaceFactory.CreateRunspace(RunspaceConnectionInfo connectionInfo, PSHost host, TypeTable typeTable, PSPrimitiveDictionary applicationArguments)
at System.Management.Automation.Runspaces.RunspaceFactory.CreateRunspace(RunspaceConnectionInfo connectionInfo)Thanks Daniel.
I see that the IIS server has a GPO setting 'Allow log on locally' to the local administrators group for this server. I will order add of the IIS app pool identity to this list.
I tried the process monitor comparing runs with and without the app pool identity as local administrator. The runs are identical up to the point where one does something useful and the other closes 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WSMAN'.
There are no failures.
I am not using my runspace objects for multiple threads. I dispose after use.
I will end up with the below if I change. Comments?
public static PowershellResult RunPowerShellCommandExchange2010(string exchangeServer, string command, ICollection<KeyValuePair<string, object>> parameters, string usr, string pwd) {
WindowsImpersonationContext impersonationContext = null;
try {
impersonationContext = WindowsIdentity.Impersonate(IntPtr.Zero);
GetProcessInformation();
try {
var connectionInfo = GetExchange2010ConnectionInfo(exchangeServer, usr, pwd);
using (var runspace = RunspaceFactory.CreateRunspacePool(1, 1, connectionInfo)) {
using (PowerShell powershell = PowerShell.Create()) {
var psCommand = new PSCommand();
if (parameters != null) {
psCommand.AddCommand(command);
foreach (KeyValuePair<string, object> parameter in parameters) {
if (parameter.Value == null) psCommand.AddParameter(parameter.Key);
else psCommand.AddParameter(parameter.Key, parameter.Value);
} else {
//if parameters argument is null the command will be treated as script
psCommand.AddCommand(new Command(command, true));
powershell.Commands = psCommand;
runspace.Open();
powershell.RunspacePool = runspace;
var resultPSObjects = powershell.Invoke();
var psResult = new PowershellResult {
PSObjects = resultPSObjects,
Errors = powershell.Streams.Error.ToList()
return psResult;
} catch (Exception ex) {
var windowsIdentity = WindowsIdentity.GetCurrent();
int errorCode = Marshal.GetLastWin32Error();
if (windowsIdentity != null) throw new Exception(string.Format("Failed to run Exchange powershell command '{0}' as user {1} passing executing user {2} due to: {3} at {4}. Server: {5}. Last error code: {6}", command, windowsIdentity.Name, usr, ex.Message, ex.StackTrace, exchangeServer, errorCode), ex);
throw new Exception(string.Format("Failed to run Exchange powershell command '{0}' as unknown user passing executing user {1} due to: {2} at {3}. Server: {4}. Last error code: {5}", command, usr, ex.Message, ex.StackTrace, exchangeServer, errorCode), ex);
} finally {
if (impersonationContext != null) {
impersonationContext.Undo();
Tore Olav Kristiansen -
what software is needed to be able to open the olm file I have exported from Outlook to my documents when transfering my Microsoft Office Contacts to my Mac Addressbook?
You might find a solution here: how to convert microsoft outlook contacts to apple address book - Google Search
OT -
Hi there, I'm thinking of buying both a new MacBook Pro and a small 22 inch LED tv for my kitchen... what would I need to be able to use (wireless of course) the tv as a monitor for the new computer? Apple tv? Airport Express? something else? Thanks.
Hi a,
http://www.mctiviausa.com/
There has been "talk" on and off of Apple TV doing it (and people have done it with a hack), but I haven't really followed it.
It would be a whole lot cheaper getting an adapter (as needed) and cable and simply pluggin it in when you're in the kitchen. -
How do I determine what xtras are needed?
From the searching I have done it appears that xtras equired are mostly trial-and-error.
Is there an efficient way to determine what xtras are needed for each lindividual movie?
My programs are divided into a series of sequential movies. At the end of each movie
there is a goto statement to launch the next movie. Does that require me to determine
xtras for each separate movie?
In a perfect world there would be a way for Director to search a folder for and present an aggregate list of all xtras required for that set of movies.
If no such method exists, what is the recommended hunt and peck system?Thanks for the response, rduane. But I refer to the procedures as a bit random for the reasons you mentioned in your explanation. For example, you stated that, "Director will normally add all of the Xtras that you need to each movie as you build it". And, yes, I know that it does add some automatically. But, if Director really does "add all of the xtras that you need to each movie as it is built", how could I ever jump to one that is missing a needed xtra? If it needs it, why wasn't it added when it was built?
So, that's the reason I mentioned "trial and error", and "hunt and peck". The system is not reliable in its handling of xtras, or which ones are needed where. I am familiar with workarounds such as going to each movie and selecting Modify>Movies>Xtras to see which ones Director has added, But that is all it tells you. It does not tell you if it has added all the xtras "needed". And when the error message comes up, it does name the missing xtra, but not which movie needs it. So, one has to go find the named xtra and copy it over to the Xtras folder.
At least, that's what I do to fix it. But I asked the question because I wanted to know if Xtras handling itself is unreliable, or if I'm doing something incorrectly.
Dewey-+ -
What wires are needed to connect to a projector
What wires are needed to connect a macbook to a projector
A VGA or HDMI cable (Perferably HDMI). But you need mini-displayport connectors to the specific cables.
-
Hi! What do I need to be able to listen to the music of my iPod in my car? Thanks!
Hi! What do I need to be able to listen to the music of my iPod in my car? Thanks!
You can hear your music of your iPod from your car via Bluetooth or by a USB port (maybe located in your car) and connect it with the cable.
If your car doesn´t have does two things, you can do it by accesories: http://store.apple.com/us/search/Belkin-TuneCast-Auto-with-ClearScan?mco=Nzk5NTQ 1Ng# -
What steps are needed when upgrading from a pc to a Mac?
Copy everything from your old computer to your new one.
-
MOVED: what do i need to be able to watch HDTV .. tv?!?!?!?!?!?
This topic has been moved to Anything Under The Sun.
what do i need to be able to watch HDTV .. tv?!?!?!?!?!?You're going to need an adapter so that you can plug into the UK's unique plug configuration. I believe the UK runs at 220 V and the US 110, but the iPhone plug adjusts for that. You do not need a converter.
But you need to buy an adapter into which you would plug your US charger, so that you can plug into the UK style outlets. A travel store will sell them for a few dollars. Don't buy the expensive ones, because they contain converters, which aren't necessary these days for higher end electronics.
Apple sells one for the iPhone and iPod:
http://store.apple.com/us/product/MB974ZM/A?mco=Njc1MzI1Mw
It's kind of pricey, but really nice.
Of course, you could buy an Apple USB charger at a UK Apple Store! -
While doing ODI migration what things are needed to be setup in Topology?
While doing ODI migration what things are needed to be setup in Topology manager ?
1.Like in Toplogy in file we hive file paths.
2. In Planning we set Logical schema .
Not sure about other things.
Hoping some can can help!!!!!!!!!!!!!!!11Lots of things are defined in the topology manager - below is a simplified list
1) Physiccal Schemas the actual connection information / details related to any technology you plan to use in your ODI integration interfaces
2) Logical schema, abstracted version of the Physical schema which allows greater flexibility ad reuse across environments
3) Contexts - how you asssociate logical and physical schemas
4) Agents - manage the execution of ODI jobs
When you talk about migration, do you mean moving ODI objects between seperate environments such as Dev and Prod? If so you will need to ensure that all the technologies you use in Dev are present in Prod. The physical layer has been set up with all the correct connection details. Your logical scemas has been set up matching your configuration in the dev environment and you have used the contexts to associate the logical and physical layers as per your dev configuration. -
WHAT PARTS ARE NEEDED TO SHOW MY MAC 10.8.4 OVER TV-.
WHAT PARTS ARE NEEDED TO SHOW MY MAC 10.8.4 OVER TV….
About AirPlay Mirroring in OS X Mountain Lion
You need:
An AirPlay-enabled device such as http://store.apple.com/us/ipod/ipod-accessories/apple-tv
A suitable TV monitor
A network
HDMI cable
A compatible Mac:
iMac (Mid 2011 or newer)
Mac mini (Mid 2011 or newer)
MacBook Air (Mid 2011 or newer)
MacBook Pro (Early 2011 or newer)
Or, depending on the model Mac you intend to use: a Thunderbolt or MiniDP or DVI to HDMI adapter for a wired connection to your TV or AVR -
What commands are needed to configure authentication?
I'm running the JaasAcn Sample from a DOS prompt on a Win XP client and am getting 'authentication failed'. My Active Directory Realm is AD.COURSEWIZARD.COM and the KDC FQDN is ad.ad.coursewizard.com. It succeeds when I run the 'Sample' locally on the AD server. If I set 'isInitiator=false' in jaas.conf, it succeeds no matter what I enter for username & password. It seems that I need to configure an SPN.
When setting an SPN, are you declaring that a particular AD user account is associated with a remote service that will be requesting authentication?
Do I have to also use the 'ktpass' command, even though I'm using a Win client?
If I use ktpass, but am just testing with a PC on the Inet, should I just use my IP address for domain since I don't have a FQDN?
Do I need to move the keytab file, created by ktpass, to the client and configure it to use it?
Does the ADS need to have a krb5.conf or krb5.init file? I don't see one under '../drivers/etc/'.
What commands are needed in order to configure the server, and client, to authenticate successfully?
CheersSorry, I haven't seen a nice JGSS for Windows guide yet.
Back to your questions:
1. When setting an SPN, are you declaring that a particular AD user account is associated with a remote service that will be requesting authentication?
IMHO, setspn creates a service-like alias for a normal AD account, so that GSS style server program can use it as a NT_HOSTBASED_SERVICE name.
2. Do I have to also use the 'ktpass' command, even though I'm using a Win client?
ktpass is used at the server side, what you use at client side is unrelated.
3. If I use ktpass, but am just testing with a PC on the Inet, should I just use my IP address for domain since I don't have a FQDN?
Porbably not. Anyway, AD works fine with a DNS. If you haven't one, config the AD server as a DNS server.
4. Do I need to move the keytab file, created by ktpass, to the client and configure it to use it?
No, keytab is used at server side. The client side uses the native credentials cached in LSA after you login to Windows as an AD account.
5. Does the ADS need to have a krb5.conf or krb5.init file? I don't see one under '../drivers/etc/'.
Yes, Java needs the file for both client and server JGSS programs. Normally it should be inside the WINDOWS directory. Somethign weird woun happen if you uses Terminal Services or else. Add -Dsun.security.krb5.debug=true to the Java command line will show you when Java tries to look for this file.
6. What commands are needed in order to configure the server, and client, to authenticate successfully?
You need setspn.exe and ktpass.exe on the server to create the SPN and the keytab file. No tools are necessary on the client side, but MS's kerbtray.exe and klist.exe (attention: MS's klist, not Java's) are nice. BTW, a nice network sniffer (say, Wireshark) is also useful.
I'm not an expert on all these questions, but I cannott resist the temptation to give an answer to each of them. -
What skills are needed to manage Exalogic?
Hi there
Please let me know if I should be directing this question to another Forum and which Forum it should be.
We are thinking of purchasing Exalogic with a view to having a private Cloud.
What skills are needed or teams in order to manage Exalogic in-house?
I've used google but not really found the answers other than a couple of Oracle docs which suggest sys admins teams, network teams, etc could all have a hand in the management as they currently exist.
However, Management are wondering if a new team needs to be formed and what skills that team should have.
As we already have Exadata under the DBA team they are wondering if the skills the DBAs have will also apply for Exalogic.
Thanks.Others are welcome to jump in!
Thanks and stay tuned to for results next week<a href="https://www.sdn.sap.comhttp://www.sdn.sap.comhttp://www.sdn.sap.com/irj/sdn/developerareas/technology">The Technology HomePage</a> for tally and scores -
hi good morning,
I'm from malaysia,
can I use apple education package
my wife is a teacher,
I'm interested for mac 13 inch water for her
I be able to buy used apple education package
how and what documents are neededYou will need to contact th Apple Store. This is a user to user forum.
http://www.apple.com/contact/
http://store.apple.com/us-hed -
What permissions are required to see scheduled tasks on a remote server using SCHTASKS /S {server}?
When I attempt to run SCHTASKS /S {server} some servers return:
ERROR: Access is denied.
On servers where I am a member of the local Administrators group I can run this command successfully. There are many servers where it is not appropriate for me to be a local Administrator but would be fine for me to monitor the status of scheduled tasks
on the server.
What permissions need to be granted to me to see the scheduled tasks and not be a local administrator? Is this even possible?
Thanks,
MatthewHi Matthew,
Based on my research, any user can schedule a task on the
local computer and they can view and change the tasks that they scheduled; however, to schedule, view, or change a task on a
remote computer, we must be member of the Administrators group on the remote computer.
Therefore,
What permissions need to be granted to me to see the scheduled tasks and not be a local administrator? Is this even possible
It is not possible.
More information for you:
Schtasks
http://technet.microsoft.com/en-us/library/cc725744(WS.10).aspx
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected]
Maybe you are looking for
-
Camera roll on iphone5 not loading to photostream
photostream is enabled on my iphone5 and iphoto. New camera pictures are not moving over to photostream (I assume they are supposed to go 1st to icloud then back to My Photo Stream). I have 100% charged battery and a rock solid Wifi connection. I
-
I'm not keen on the filing system in iPhoto '09, and i'm wondering if there's a way around it. I upgraded to iLife '09, and the folders are a mess in comparison to how they used to be organized in my previous version (5.x.x). I used to be able to sea
-
How do I get a question answered if it isn't answered here?
I posted the question "Some flash videos don't show except as admin" well over a week ago and no replies. How else can I get this resolved? I'm not inclined to commit to $40 unless it's my fault. If I'm doing something stupid, fine, I'll take the hit
-
I ve brought apps on the comp for my ipad and they successfully downloaded onto itunes but now they wont sync to the ipad... Any ideas? Im lost and annoyed... :/
-
I want to change german language to english language.
hi i am a student.when i am getting any run time error then its coming in german language.so i am not gettng whats the problem? so can anyone guide me how to change the german language to english language? Moderator message: please search for availa