Will OBIEE supports multiple authentication

Hi All,
Does OBIEE 11.1.1.5.0 supports multiple authentication, at present in my environment we have configured LDAP, where a number users and groups are accessing obiee, we do not have some 3000 non obiee users, for these users also i have to send delivers. So my question how can i achieve. At present i am able to send delivers to obiee users.
Please provide information on this
Thanks
sreekanth

Hi,
Yes it supports multiple authentication.
For more refer,
http://docs.oracle.com/cd/E23943_01/bi.1111/e10543/privileges.htm#BABDCJBH
Thanks
Deva

Similar Messages

  • Hi All , Will Java supports Multiple Inheritance  classes???

    Hi All ,
    Will Java supports Multiple Inheritance by classes???
    Thanks in advance,
    Prakash

    No, Multiple inheritance would look like
    public class A extends B,C {(You can do that in C++, but it's rarely a good idea).That's not true at all. It's not inherently harmful, in C++ or any other language. It's entirely possible to do it correctly when it truly makes sense.
    Java just guarantees that nothing bad can happen to you by only allowing multiple inheritance of interface. You can't ever have multiple inheritance of implementation, that's all.
    %

  • Will OBIEE Support creating reports from 2 different data sources

    Hello Guys
    I am new to BI . Can anybody let me know how to create a report using 2 different data sources .
    Ex: Suppose we have 10G and SQL server , can we import tables to rpd and join 1 fact & dimension from 10G and 1 Fact from SQL server to the 10G tables . If so ,
    1) Will the repository be consistent ?
    2) Is it a best practice to do this kind of modeling ?
    3) Will it affect the performance of the reports ?
    Your advice is highly appreciated .

    Hi,
    Dont try to do this at the BI server layer. Oracle has special abilities to do this thing. So use the power of oracle to import the tables from the sql server to oracle and in the bi server just create one data source.
    you can browse for *'DBLINK'* in oracle.
    Regards,
    Karthick

  • Does SQL Developer support OS Authentication?  Will it?

    Does SQL Developer support OS Authentication connections? If not will it in the future?

    Given this has the SQL Developer been changed to remove the requirement of adding a password for an OS authenticated account? These users also have the ability to access the DB via applications and the fact that they don't have to enter a password right now is ideal. I really don't want to have to add a password for them. Will this be changed within SQL Developer?

  • OSB (11.1.1.7): Can OSB/Weblogic (11.1.1.7) support multiple PKIs (Public Key Infra-structure)

    Hi All,
    Would you be able to help me in understanding if OSB/Weblogic (11.1.1.7) can support multiple private key's in the domain to enable 2-SSL W/S calls ?
    Solution walk-through :
    A 3rd Party Web Service is only accessible via 2-way SSL http channel. To achieve this, OSB is required to use the private key which is issued by 3rd party. This private key and 3rd party root certificate (CA) need to be installed into OSB’s keystore which is based on Java Keystore format.
    The private key (issued by 3rd Party) will be used by OSB for identity signature. This private key is bound to IP address of the OSB machine calling the 3rd Party web service. Also, 3rd Party root certificate (CA) will be used by OSB to verify the identity of 3rd Party web service.
    Given the private key is used as the identity of the system and should be guarded closely by the target system, we believe this approach needs to be reviewed and assessed accordingly.
    Limitations and drawbacks with the current solution :  
    1. The private key of OSB system is issued and controlled by an external application vendor.
    2. OSB is enforced to use this private key and its signature algorithm for other external parties’ interactions. The current client certificate issued by 3rd Party is X509v3 certificate which uses RSA, with a 2048-bit key size, signed with a SHA-512 hash.
    3. The SSL is self-signed, not signed by a publicly trusted cert provider (i.e. VeriSign)
    4. Extra dependency on external vendor systems as the key provider. Currently, the keys are bound to server IP address; any changes to the production environment, (i.e. adding new nodes) will require a new key to be generated by 3rd Party system. In case 3rd Party is no more used in the future, the keys can no longer be generated.
    Conclusion : OSB does not support multiple PKIs (Public Key Infra-structure) which is a mapping mechanism that OSB uses to provide its certificate for SSL connecitons to the server. Multiple private keys, require multiple PKIs which OSB does not handle.
    So, do you agree that OSB/Welblofic (11.1.1.7) could not support multiple private key issued by more than one 3rd party vendor ?
    Thanks,
    Kunal Singh

    Hi Kunal,
    Although it is recommended to have 1 key pair for 1 identity store as it represents unique identity of your domain but you can:
    import multiple key-pairs in your identity store
    Configure PKI credential mapper to use reference of identity store consisting of multiple keys
    When in your OSB project, you create Service Key provider(SKP) then it loads all the private keys present in identity store referred by PKI mapper. It will browse both the keys.
    Depending on your requirement, you can choose different key pair for for different SKPs for "Client Authentication key" section(For SSL) and "Signature key" for DigiSign.
    Please let me know if i understood your query correctly and above helps.
    Regards,
    Ankit

  • Can ACS support multiple Active Directory Domains for 802.1x EAP-TLS?

    Hi
    I'm looking to implement ACS 5.2 using 802.1X, we have two seperate AD domains.
    Now.. this is the tricky part...
    A single switch will need to support both ADs, so if a machine in AD1 is connected, it will be authenticated to the ACS using AD1 and applied to VLAN1, while a machine that is in AD2 will be authenticated to AD2 and applied to VLAN 2.
    I'm looking at machine authentication, not user authentication, so I assume that I will need to import two certs from each AD.
    Can any expert please let me know if they think that this will be possible please??
    Many thanks

    Yes ACS can support multiple AD domains but you will have to configure one as your AD domain and the other as an LDAP database and this will work since you are planning to use eap-tls.
    The question I have is which version of ACS are you using? If you are using ACS 5.x then you can setup and identity store sequence so if the user is not found you can move to the next store and this will prevent you from installing two certificates on every machine.
    You can then setup an authorization rule for the seperate containers on where the workstations are located (this is assuming machine authentication is being used) for the AD database or the LDAP database and then assign the vlan based off that.
    Thanks and I hope this helps!
    Tarik Admani

  • Multiple authentication in One WCF Service

    Hello,
    I need to use some authentication in my WCF Service, could you please if it is possible to use multiple authentication in One WCF Service? If it is possible, how to implement it.
    Thank you.

    Hi helloGoodman,
    I wonder if you mean that you want to use multiple authentication in One WCF Service endpoint, if so in WCF 4.5, it is supported to use multiple authentication in a single endpoint, for more information,
    please try to refer to the following articles:
    #Using Multiple Authentication Schemes with WCF:
    https://msdn.microsoft.com/en-us/library/hh556235(v=vs.110).aspx .
    http://blogs.msdn.com/b/james_osbornes_blog/archive/2011/11/04/2-auth-modes-on-1-endpoint-using-multiple-authentication-schemes-with-serviceauthorizationmanager.aspx .
    If you mean that you want to use multiple authentication in One WCF Service not in a single endpoint, then I will recommand you use multiple endpoints and in each endpoint you can use the independent authentication mode which you want.
    Best Regards,
    Amy Peng
    We are trying to better understand customer views on social support experience, so your participation in this interview project would be greatly appreciated if you have time. Thanks for helping make community forums a great place.
    Click
    HERE to participate the survey.

  • LDAP supporting multiple DNS domains

    I have an environment with multiple DNS domains, and am configuring a Directory server (DS 6.3.1) to centralize various OS configuration maps including user authentication. None of the DNS domains have unique data, so I'd like to do something like storing all the real data in one suffix, then somehow have all clients look to that primary suffix. I am aware that the Solaris Native LDAP client wants to bind to a nisDomainObject that matches its DNS domain. I'm just having a hard time believing that I really need to manage all those individual suffixes when they don't have unique data requirements.
    Take as an example the following domains to be supported: foo.example.com, bar.example.com, dev.example.com, qa.example.com, prd.example.com (no hosts are actually in "example.com", they are all in subdomains). Again, all share common configuration data, same user IDs, etc - no unique maps are required.
    I created a suffix, "dc=example, dc=com", set it up with idsconfig. All is well there.
    [A] My first thought is to bind all Solaris clients, regardless of their DNS domain, to the baseDN of "dc=example, dc=com" in order to avoid having a separate suffix for each DNS domain. I tried to do this using "-a defaultSearchPath=dc=example,dc=com" with ldapclient init, but it failed with an error indicating it wants to see the nisDomainObject of its real DNS domain.
    The second though I had, which I don't believe is possible, is to find some sort of a LDAP equivalent of a symbolic link so that I could actually have an object for each DNS domain, but it would simply point back to "dc=example,dc=com". I can't find anything in the documentation which suggests this is possible, but I'd love to be wrong!
    [C] Perhaps this could be somehow done with a rats nest of SSDs, but that really seems unwieldy, right? I plan on using a fair amount of the available objects, so it would be many SSDs per suffix. Yuck.
    Can anyone comment on my above thoughts, or provide how they would go about supporting multiple DNS domains that have common configuration data?
    Thank you,
    Chris

    Ok, I answered my own question. Turns out it's pretty easy. Just use the "-a domainName=example.com" option with `ldapclient` then make sure that the FQDN of the LDAP server is available (or use its IP address). My problem was that the ldapclient overwriting nsswotch.conf was clobbering the SSL session because I used the FQDN which couldn't resolve.
    This leaves an interesting condition of having the output of "domainname" not match the DNS domain. I'm testing now to see if this causes any unexpected issues with our environmnet, but I suspect it's not a problem.

  • Supporting multiple companies with JES6

    I have been trying to find instructions to support multiple companies using email, calendar, and IM on a single installation of JES6 (messaging, calendar, IM, delegated admin, independent convergence, etc). I have had no luck.
    The sales pitch talks a great story about scalability, so I must be missing something. Sun Docs does not have Messaging Server 7.0 yet. The wiki that the product page sends you to is incomplete. I am not sure when Sun made the decision to not require complete documentation before a product is released, but I find that frustrating.
    I see that I can add multiple domains in Delegated Administrator, but this does not create separate partition areas in Messaging Server. I believe that you need to separate each company's email and calendar so that conflicts in names don't happen.
    Can someone direct me to a document or tell me how to do this? Please?

    workman99 wrote:
    I have been trying to find instructions to support multiple companies using email, calendar, and IM on a single installation of JES6 (messaging, calendar, IM, delegated admin, independent convergence, etc). I have had no luck.Log into Delegated Administrator and create a new organisation for each of the companies you wish to support. This organisation will require a domain-name e.g. somecompany.com (hence the term "hosted domain"). The users in the company then log into Messaging/Calendar/Convergence with [email protected].
    The sales pitch talks a great story about scalability, so I must be missing something. Hosted/Virtual domain functionality is in use by a number of companies to provide the very functionality you refer to.
    Sun Docs does not have Messaging Server 7.0 yet. There is no intention to provide static PDF based docs for communication-suite-6 products (which include MS7.0) going forth.
    The wiki that the product page sends you to is incomplete.How exactly is it incomplete? Where there are differences between MS6.3 and MS7.0 they are documented on the http://wikis.sun.com/display/CommSuite/ site.
    I am not sure when Sun made the decision to not require complete documentation before a product is released, but I find that frustrating.Once again, what exactly is not complete. Sweeping statements aren't really constructive. The wiki format has provided the ability to provide much quicker updates and enhancements to the documentation then was previously possible with the publish-once PDF guide mechanism.
    I see that I can add multiple domains in Delegated Administrator, but this does not create separate partition areas in Messaging Server. I believe that you need to separate each company's email and calendar so that conflicts in names don't happen. You don't require separate partitions as Messaging Server and Calendar Server both use the hosted domain information in their storage e.g.
    bash-3.00# ./mboxutil -lxp user/[email protected]/INBOX
      msgs  Kbytes last msg         partition   quotaroot mailbox path and acl
         3     240 2008/04/03 07:28 primary          5120 user/[email protected]/INBOX /opt/SUNWmsgsr/data/store/partition/primary/=user/b7/e4/=testuser@hosted%dsun%dcom [email protected] lrswipcda
    bash-3.00# ./mboxutil -lxp user/shjorth/INBOX
      msgs  Kbytes last msg         partition   quotaroot mailbox path and acl
         6      37 2008/09/12 13:08 primary          5120 user/shjorth/INBOX /opt/SUNWmsgsr/data/store/partition/primary/=user/c4/31/=shjorth shjorth   lrswipcdaSo in the above example "testuser" is in the hosted.sun.com hosted domain and "shjorth" is in the aus.sun.com default domain. The default domain does not have the domain information appended in the path and is treated as a special case.
    bash-3.00# ./cscal list [email protected]
    [email protected]: [email protected] status=enabled
    bash-3.00# ./cscal list [email protected]
    [email protected]: [email protected] status=enabledFor calendar server, the domain of the user is appended to the UID thus providing for separate UID name-spaces for each hosted-domain organisation.
    Regards,
    Shane.

  • Looking for a client/server that supports multiple protocol and delivery

    Hi all, I don't know if this the right place to ask my question,here it goes.
    I am looking to develop a client-server that supports multiple protocols such as HTTP, HTTPS etc. I am looking for a framework( i don't know if that is correct or I need some kind of web-service (soap etc)) that would manage connection, security etc. I would like to like to devote most of my time in developing business objects with multiple delivery mechanism such as sending serilized java objects, xml message or soap message, or in some case JMS message as well. So I need a client server that can come in via TCP/IP or HTTP or anyother industry standard protocol and I should be able to service him with pub/sub model and also request/response model as well.
    I don't know if I had explained what I need, I would like to know what technologies I should be evaluating and which direction I should be heading... Also the server I'm developing should be free of Java constraints if needed...
    Also this service is not webbased service as now but if need arises I should have a flexibilty to make them web enabled in future. Also I would like to work with open source webservers or appservers if I need

    Inxsible wrote:I installed i3 - along with the i3status - which I still have to figure out. I am liking what I see as of now. It reminds me of wmii -- when I used it way back when. However I do not like the title bar. I would much rather prefer a 1 px border around the focused window.
    "i3 was created because wmii, our favorite window manager at the time, didn't provide some features we wanted (multi-monitor done right, for example), had some bugs, didn't progress since quite some time and wasn't easy to hack at all (source code comments/documentation completely lacking). Still, we think the wmii developers and contributors did a great job. Thank you for inspiring us to create i3. "
    To change the border of the current client, you can use bn to use the normal border (including window title), bp to use a 1-pixel border (no window title) and bb to make the client borderless. There is also bt  which will toggle the different border styles.
    Examples:
    bindsym Mod1+t bn
    bindsym Mod1+y bp
    bindsym Mod1+u bb
    or put in your config file
    new_window bb
    from: http://i3.zekjur.net/docs/userguide.html (you probably already found that by now )

  • Multiple authentication sources with the same category

    Quote from portal help:
    "Multiple authentication sources can use the same category. However, because the prefix is prepended to the user and group names, you need to be certain that the domains involved do not have different users or groups with the same name. That is, if a LizaR user exists on one domain, and a LizaR user exists on another domain, they must be the same user because only one user will be created."
    Fine, let's say I am "certain that the domains involved do not have different users or groups with the same name".
    But there is other concern I have here. I want to know how portal will RECOGNIZE which authentication source to use?
    Let's say I have 2 auth sources AS1 and AS2 with the same category MyAuth. AS1 use WS1 to authenticate against LDAP1 and AS2 use WS2 to authenticate against LDAP2.
    Now, I have a user - Dmitry. I am trying to login into portal and I selected AS1 to do actual authentication. My question is how portal will CHOOSE which auth source to use because all portal knows about me is <MyAuth\Dmitry> that is came from portal login screen? Both auth sources match this pattern so seems like portal may choose any of them.
    Does it mean that portal will try to authenticate again AS1 and if this attempt failed then you AS2?
    I didn't find any explanation in portal documentation.
    Thank you.
    Edited by Bryazgin at 12/12/2007 10:42 AM

    Yes, it seems you are right. As soon as portal have found CORRECT user there is no issue anymore because user is bind to unique auth source that actually has been used to created this user.
    I think my main confusion come from the fact that having <Category> and <UserName> is not enough to UNIQUE identify user in portal as soon as <Category> can be the SAME for different auth sources.
    Let's have you have user created by AS1. According API this user created by this AS1 will have 4 different names, like sUniqueName, sAuthenticationName, sLoginName and sDisplayName. But portal is going to search user in portal database BASED on information that is available in login form - <Category> and <User Name>. At this point portal has no idea about sUniqueName and all this things.
    Now if there were 2 users in database that have been created by 2 different auth sources with the same <category> and <User Name> then I don't understand how portal will figured out which user to choose from. I guess <Category> value somehow MUST participate in sUniqueName value. <Category> has to be involve in process of finding user in database. In this scenario 2 users will be retrieved from database and what is important these 2 users are different, they have been created by different auth sources. Now question became which user is CORRECT one?
    Edited by Bryazgin at 12/12/2007 1:34 PM

  • Custom Infotype to support Multiple language

    Hi Experts,
    i need help in creating a custome infotype which should able to support multiple language.
    kindly help how to do that.
    points will be rewarded for helpful answers.
    Best Regards,
    Rahul
    Message was edited by:
            Rahul Kumar Gupta

    Hello rahul,
                   I dont think it need any special settings.You can have a look at
    infotype 0182 as reference.Normally this infotype supports multiple language.
    Reward points if useful.
    Regards,
    Manoj.

  • How java support multiple inheritance by the use of interface.

    As per my understanding, Interface is just having the signatures of the methods not the implementation.
    So How java support multiple inheritance by the use of interface?
    Answer 1: we can institate interface reference by its implemented
    class.
              ����� interface inf...
              ����� class aa implements inf..
              ����� class bb implements inf....
               Now, inf i = new aa();
               inf i = new bb();
    Answer 2: We can extends as many interface as we want in the
    single
               interface.
               i.e. interface infFirst....
               interface infSecond....
               interface infThird....
               Now ,
               interface ingMulti extends infFrist, infThird...
    By above two answers its not prity clear as per the multiple inheritance in C or C++.
               i.e.
               class first{
               method abc();....}
               class second{
               method bbc()......}
               class multi::first::second{
               we can call to abc();.....as well as bbc();
    -Please give your important suggstion on the same.(Hope I explain it well.)
    -Jeff

    The keyword implement is used only for interfaces not
    for abstract class. If i am wrong correct me.I believe your right, but I will double check.
    As for the multiple inheritence think about the following code:
    class Animal {
        //  Animal generic stuff in this class
    interface Eat {
        //  Generic stuff that models eating behavior
    interface Runs {
        //  generic methods that model running behavior
    public class Horse extends Animal implements Eat, Runs {
        //  Stuff specific to a horse
    }The Animal class is generic but has stuff in it common to all animals.
    The Eat interface models behavior that is generic to eating, all living things have to eat something to survive. Herbavore are different from carnivores.
    The Runs interface models generic behavior to running, such as speed. A cheeta definately runs faster than a human.
    This brings us to the Horse class. It extends the Animal class because it "is-a" animal, and it implements the eat and runs interface because they are behaviors a horse has.
    I hope that helps.
    Extending an abstract class is the same as extending a regular class with the exception you MUST override all abstract methods in the abstract class. Thats not too difficult but I believe when designing classes, designing an abstract can be more diffecult than modeling the base class, and generic behaviors in interfaces. JMO.
    JJ

  • IChat - Host does not support Kerberos authentication

    Hi all,
    I have been trying but with no success to set up an iChat server on 10.6. Our OS X server is bound to AD and will hopefully be using AD to authenticate the iChat clients. I have followed Apple's guide on commenting out the <!-- <cram-md5/> --> section of the c2s.xml file which hasn't solved our problems. Open Directory isn't running as a master it is connected to another directory (our AD directory), and as a test I set up a Wiki server on the same box and this does allow us to authenticate against AD.
    The error message we are receiving in iChat is "The host example.com does not support Kerberos authentication. The client is set to use Kerberos, the username format is [email protected] all I think the correct settings.
    Under iChat General Settings on the server the Host Domain is example.com, SSL Certificate: No Certificate, Authentication: Any Method, and Enable XMPP server-to-server federation is enable for all domains.
    This is our jabber fullstatus:
    jabber:state = "RUNNING"
    jabber:readWriteSettingsVersion = 1
    jabber:logPaths:PROXY_LOG = "/private/var/jabberd/log/proxy65.log"
    jabber:logPaths:MUCSTDLOG = "/var/jabberd/log/mu-conference.log"
    jabber:logPaths:JABBER_LOG = "/var/log/system.log"
    jabber:proxyState = "RUNNING"
    jabber:currentConnections = "0"
    jabber:currentConnectionsPort1 = "0"
    jabber:currentConnectionsPort2 = "0"
    jabber:pluginVersion = "10.6.100"
    jabber:serviceMode = "CHATSERVER"
    jabber:domainName = "example.com"
    jabber:mucState = "RUNNING"
    jabber:servicePortsAreRestricted = "NO"
    jabber:servicePortsRestrictionInfo = emptyarray
    jabber:hosts:arrayindex:0 = "example.com"
    jabber:setStateVersion = 1
    jabber:startedTime = "2010-10-07 16:12:01 +0100"
    jabber:jabberdState = "RUNNING"
    This is our changeip -checkhostname:
    Primary address = 192.168.1.20
    Current HostName = ichat.example.com
    DNS HostName = ichat.example.com
    The names match. There is nothing to change.
    dirserv:success = "success"
    Any help with this would be much appreciated, and I can supply further logs details if needed. I have used example.com to protect our domain name but i kept the format identical.
    Cheers,
    Chris

    From the console:
    08/10/2010 13:00:52 com.apple.launchd.peruser.2027651558[416] ([0x0-0x16a16a].com.apple.iChat[2873]) The USER environmental variable changed out from under us!
    08/10/2010 13:00:52 com.apple.launchd.peruser.2027651558[416] ([0x0-0x16a16a].com.apple.iChat[2873]) In a future build of the OS, this error will be fatal.
    08/10/2010 13:00:52 com.apple.launchd.peruser.2027651558[416] ([0x0-0x16b16b].com.apple.iChatAgent[2875]) The USER environmental variable changed out from under us!
    08/10/2010 13:00:52 com.apple.launchd.peruser.2027651558[416] ([0x0-0x16b16b].com.apple.iChatAgent[2875]) In a future build of the OS, this error will be fatal.
    08/10/2010 13:00:52 iChatAgent[2875] [Warning] JConnection: Error: Error Domain=XMPPErrorDomain Code=122 UserInfo=0x10020b680 "The host corepublishing.co.uk does not support Kerberos authentication."
    The iChat server log shows this at the same time:
    Oct 8 13:00:52 ichat jabberd/c2s[1051]: [7] [::ffff:192.168.2.170, port=50624] connect
    Oct 8 13:00:52 ichat jabberd/c2s[1051]: [7] [::ffff:192.168.2.170, port=50624] disconnect jid=unbound, packets: 0

  • Does CISCO C3560X VLAN support multiple Network segments which are further configured with HSRP function

    Hi Cisco experts,
        My name is Kumagai and I need your expert opinions below.
    I am trying to configure one VLAN1 support multiple network segments as below.
    (this should be a very straight forward configuration and should be OK, I think ? )
     interface Vlan1
     ip address 172.30.0.0 255.255.128.0
     ip address 172.30.31.253 255.255.254.0 secondary
     ip address 172.30.61.253 255.255.254.0 secondary
     ip address 172.30.71.253 255.255.254.0 secondary
     ip address 172.30.4.253 255.255.255.0 secondary
     The only issue that is eating me is the above network segments are using HSRP too
     and I am not sure is this possible with a combination of VLAN1 supporting multiples which are
     further supported with HSRP settings in Cisco environment.
    !example of HSRP:
    interface Vlan4
     ip address 172.30.4.253 255.255.255.0
     no ip redirects
     standby 4 ip 172.30.4.254
     standby 4 priority 105
     standby 4 preempt
    <<< what will happen if I add the HSRP configuration as below into the above VLAN1 with multiple Network segment ??)
     I would like to summarize my "Combined" configurations as below but I need your expert opinions on
     whether the configuration below is workable without any problem ??
     Or it is a total flop because Cisco does not support the configuration below !!!
     interface Vlan1
     ip address 172.30.0.0 255.255.128.0
     ip address 172.30.31.253 255.255.254.0 secondary
     ip address 172.30.61.253 255.255.254.0 secondary
     ip address 172.30.71.253 255.255.254.0 secondary
     ip address 172.30.4.253 255.255.255.0  secondary
     standby 30 ip 172.30.31.254
     standby 30 priority 105
     standby 30 preempt
     standby 60 ip 172.30.61.254
     standby 60 priority 105
     standby 60 preempt
     standby 70 ip 172.30.71.254
     standby 70 priority 105
     standby 70 preempt
     standby  4 ip 172.30.4.254
     standby  4 priority 105
     standby  4 preempt
    Thanking you in advance !!!!!

    Hi,
    As far as i know we dont set the ip helper address on the radio interface. It should be on the L3 interface of corresposding VLANs i.e.
    int vlan 20
    ip helper-address 192.168.33.xxx
    int vlan 60
    ip helper-address 130.20.1.xxx
    I'm assuming that your using SVI's (int Vlan 20 and int Vlan 60) rahter than physical interfaces. Also hope you have configured switch port as trunk where this AP is connected.
    Modify the AP config as below since you are using data vlan as the native vlan
    interface Dot11Radio0.20
    encapsulation dot1Q 20 native
    interface FastEthernet0.20
    encapsulation dot1Q 20 native
    Ideally your AP fastethernet configuration should looks like below and not sure how you missed this as this comes by default when you have multiple vlans for multiple ssids.
    interface FastEthernet0.20
    encapsulation dot1Q 20 native
    no ip route-cache
    bridge-group 20
    no bridge-group 20 source-learning
    bridge-group 20 spanning-disabled
    interface FastEthernet0.60
    encapsulation dot1Q 60
    no ip route-cache
    bridge-group 60
    no bridge-group 60 source-learning
    bridge-group 60 spanning-disabled
    Hope this helps.
    Regards
    Najaf

Maybe you are looking for