Access control and security group

Hi all

I need to know about the access control and what data are suitable for the security group and roles if I have the script like this:

i. There are 2 different app namely ARA (96 branches with different types of reports) and TRACS400 (6 branches with different types of reports)

II al ' ARA, users of Branch01 can NOT check Branch02.

III. different report type is measured by Branch01 and Branch02 are different.

IV. in Branch01, there are some reports are Read (Cannot download) only and some reports are read and write (downloadable).

My questions are:

1. from the above scenario, do I need create all the 96 security group and assign it to different leadership roles?

2. How can I control read and write access, as I have tested the READ access the user is still able to download the report.

3. How can I control to branch 01, report Type A is a read and report Type B read and write access?

4. I noticed that if I use the account, the security group can be used be limited to 50 only security groups. Is this good? I may be an application later in the future. These 2 request for test only. But if I do not use the account, there are any number of security groups that can be used?

Appreciate for your help.

Hi aziela

As mentioned by the friends of the forum, it is advisable to have the minimum security group given that its impact on the scalability of the application (rule). Accounts provide the best security solution of dimension view group.

Security group corresponds to the role, role is mapped to the users. The permissions are obtained at the level of role-SG.

Accounts are mapped directly to users. So you can have a precise control at the level of the user (eliminating the abstraction of the role).

All these aspects are impacting performance where rule of thumb is mentioned in the documentation. In general, if a user belongs to many groups and accounts then it will take more time to process the request of content for this user.

w.r.t. prohibiting the read-only users so that they will not be able to download content, there is a setting, please try option mentioned in this link http://docs.oracle.com/cd/E14571_01/doc.1111/e10792/e01_interface001.htm#CACCFHHA

WRT performance calculation, see http://docs.oracle.com/cd/E14571_01/doc.1111/e10792/c03_security003.htm#CSMSP143

Hope this helps

Tags: Fusion Middleware

Similar Questions

  • Need info regarding the behavior of Oracle UCM accounts and security groups

    Need information about the behavior of Oracle UCM accounts and security groups.

    Oracle UCM version: 11.1.1.5.0

    Steps to follow:
    1. log in with the user "weblogic" and content created with the id of "content1".
    2. apply the "@acc1 (R)" and "TestGroup1" to her quote created in step 1
    3. close the session
    4. connect as that of "acc1user1", the user is not able to see the "content1".
    5. close the session
    6 log in as "role1user1", the user is not able to see the "content1".

    Account information and group:
    1. the user "acc1user1" is part of the "@acc1 (R).
    2. the user "role1user1" belongs to 'role1 (R)' and is mapped to "TestGroup1" at the Complutense University of MADRID

    Expected:
    The 'acc1user1' and 'role1user1' should be able to see "content1" because they have at least the read permission.

    Please help me understand why users aren't able to see the content.

    See section 5.5.1.1 in the Manual: http://docs.oracle.com/cd/E23943_01/doc.1111/e10792/c05_security.htm#BGBGIJDJ

    If the accounts and roles are used, the result is an intersection, not a Union.

  • Access control with custom groups

    I'm rather new to APEX. I'm trying to implement access control/authorization using custom groups (not built-in groups View, Edit and administrator). I search the web and the forums of discussion, in general, but so far I came up empty. I was hoping someone could point me in the right direction on how to start. Is there stored procedures that need to be adapted and implemented? Where should I keep the user groups? Can I use tables integrated or we can develop custom security group tables? These are some of the questions that I tried to be and any help would be appreciated.

    And BTW, due to the customer's requirements, we currently use version 3.2. Not sure if there are significant changes between this version and the latest version.

    Thanks to you all!
    Mischa

    Custom authentication is easy enough to put up with your own tables, here's an example
    http://djmein.blogspot.com.au/2007/07/custom-authentication-authorisation.html

    This brings to authorization, using your own tables. It must focus on the use of the authorisation schemes
    http://docs.Oracle.com/CD/E37097_01/doc/doc.42/e35125/sec_authorization.htm#BABEDFGB
    This can simply be queries on the tables of your own group, which probably would control membership by username.

    You ask a question about the use of built-in tables, but do not want the built-in administrator groups?

    Many important changes, but none that should affect you in what concerns the authentication/authorization.

    Scott

  • Access controls and IP addresses

    Could someone clarify something for me, make access controls restrict access to a volume of only specified IP address or allow access to any IP address of a computer that includes the specified IP address...

    An example of what I mean...

    I have a volume 1, which has a record of access control of 192.168.1.10 and nobody else.

    I have a server with two connections isci switching, 192.168.1.10 and 192.168.1.11

    When I look at the current connections on the volume it shows both the addresses IP as having connections - but I would like to only one of the for connect.

    Additional ACLs are hidden, being created on the fly.  This prevents also maxing out limit ACL and speed up the login process.

    Ideally iSCSI should be on its own subnet, with dedicated network cards.  You can use the remote installation wizard to define subnets are available for iSCSI use.

    It is a characteristic of the ACHIEVEMENT.  Initiator iSCSI MS if SUCCESS did not you will need to define each path connection manually for each volume.   Successfully, you need only one discovery entry, HIT does the rest.

  • Political strategy of access control and Intrusion

    Hi all

    I am a student for certification ips.

    I do not understand the difference between the political Intrusion and access control strategy...
    Maybe the difference is: ACP's ip and the control ports and Intrusion policy antivirus, file inspection etc etc?

    Thanks in advance

    Specify you rules in your access control strategy.

    For each of these rules, you can ad a political Intrusion and a file.

  • Error ERR - 10768 current Application ID and security group ID are not the measures

    Dear all,

    I had the default below code in my login page and it was running fine.

    (wwv_flow_custom_auth_std). Login
    P_UNAME = >: P101_USERNAME,.
    P_PASSWORD = >: P101_PASSWORD,.
    P_SESSION_ID = > v ('APP_SESSION').
    P_FLOW_PAGE = >: APP_ID | » : 1'
    );

    Then I replaced the code above with the code below, and now he's in error "error ERR - 10768 Application ID and current security group ID are not constant".
    I can't understand what is wrong with the code. Please correct me where I am wrong.

    declare
    vpage_no number 4;
    Start

    If: P101_USERNAME = "DEMO" then
    vpage_no: = 2;
    on the other
    vpage_no: = 1;
    end if;

    (wwv_flow_custom_auth_std). Login
    P_UNAME = >: P101_USERNAME,.
    P_PASSWORD = >: P101_PASSWORD,.
    P_SESSION_ID = > v ('APP_SESSION').
    P_FLOW_PAGE = >: APP_ID | vpage_no
    );
    end;

    Yousuf,

    You did not follow the convention used in the original, try:

    P_FLOW_PAGE =>: APP_ID |': ' | vpage_no
    );

    Scott

  • What are access controls and what would put them... anyone know a website... totally lost

    Directions for use:
    For scenarios that follow, identify the data that should be protected. Recommend how implement you one or more of the following commands for given scenarios and justify your recommendation:
    § Administrative controls
    § Logical and technical controls
    § Material controls
    § Software controls
    § Physical controls

    Scenarios:
    1 shovels and shingles are a small building composed of 12 computers with wifi band society.
    2 top ads is a small advertising consisting of 12 computers with wifi band company. All employees communicate using smartphones.
    3 NetSecIT is a multinational company that IT services to business made up of 120 000 computers that have access to the Internet and 45 000 servers. All employees to communicate using smartphones and electronic mail. Number of employees work from home and travel.
    4. out of stock of parts is a defense contractor that creates pieces of communication for the military. All employees to communicate using smartphones and electronic mail.
    5. confidential Services Inc. is a subsidiary of military support composed of 14,000,000 computers with Internet access and 250 000 servers. All employees must have security clearances, and they communicate mainly with the help of e-mail and BlackBerry devices

    Does working from home that you are required to give your course of study? If yes then you would be better to study your course material. If no, you must use a consultant rather than volunteers invite you to do the work for you for free.

  • Client access FTP and object-group

    Hello

    Someone can help, we want to make a group of objects for some of our employees to have access to the FTP server of office

    All I want is to create a group of key members of staff can download files from any FTP server but denied anything else

    Use us ISA Server for web and ftp access seems never fully work through ISA and so would pass to key personnel

    So far, I tried these parameters but always violated user 192.168.2.30?

    object-group network access FTP

    Host network-object 192.168.2.30

    internal access-list allow tcp any object-group FTP eq ftp access

    Thank you

    Clint

    Thank you... mark the post as solved, which can help others... rate replise if found useful.

    REDA

  • Problems with "security access control list '.

    Hello

    My system is configured as follows
    UCM - 11 GR 1 material - 11.1.1.4.0 (Build: 7.3.0.180)
    -Database 11 GR 2
    OracleTextSearch - engine is used
    RoleEntityACL - component is enabled
    -Parts of my config.cfg
    SearchIndexerEngineName=OracleTextSearch
    IndexerDatabaseProviderName=SystemDatabase
    UseEntitySecurity=true
    I want to create lists of access control for users, groups, and roles. I followed the the next page http://download.oracle.com/docs/cd/E17904_01/ documentatoindoc.1111/e10792/c03_security.htm#CDDBCIDA
    Everything seems to work fine at first, because I'm able to add users, groups, and roles to the ACL of the document. The problem is that adding a user, group or role of the ACL of a document does not affect the rights of a user a of the document.

    Example:
    -Wear a read access to "public"-SecurityGroup
    -UserB is to check in a "document1" to the SecurityGroup 'public' and adds UserA to the ACL of "document1" give UserA 'read' and 'write' access to "document1".
    -The result is that UserA doesn't have to 'write' access to "document1", well it is in the ACL (same problem with groups and roles)

    In this scenario shouldn't UserA have "write" access "document1" or I have a bad understanding of access control lists?

    Thanks in advance
    Brahim

    You heard wrong...

    Permissions through ACL are subject to the same rules of intersection between the permissions granted by the intermediary of roles or accounts.

    If you want write access to a document, you must have at least write access to the security group of the document, account and have RW permissions in the ACL.

    In other words work ACL on top existing accounts/groups and roles that they do not replace the existing UCM permissions. You can restrict the permissions by an ACL but not grant permissions that the user has not already set for the account or the security group.

    And by are the ACL way ugly generally impassable and unmanageable so if you have to use them all to be very careful!

    hope tha helps
    Tim

  • Firepower does not work when using the Active Directory group as a rule filter access control

    I am PoV of Cisco ASA with the power of fire with my client. I would like to integrate the power of fire to MS Active Directory. Everything seems to work properly.

    -Fire power user agent installation to complete successfully. Connection to AD work fine. The newspaper is GREEN.

    -J' created a Kingdom in FireSight and you can download users and groups from Active Directory.

    -J' created a politics of identity with passive authentication (using the field I created)

    -Can I use the AD account "user" as a filter in access control rule and it work very well.

    However, if I create the rule of access control with AD Group', the rule never get match. I'm sure that the user that I test is a member of the group. Connection event show the system to ignore this rule and the traffic is blocked by the default action below. It doesn't look like the firepower doesn't know that the user belongs to the group.

    I use

    -User agent firepower for Active Directory v2.3 build 10.

    -ASA 5515 software Version 9.5 (2)

    -Fire version 6.0.0 - 1005 power module

    -Firepower for VMWare Management Center

    Any suggestion would be appreciated. Thanks in advance.

    Hello

    You should check the download user under domain option. Download the users once belonging to a group is specified on the ad and then test the connection.

    Thank you

    Yogesh

  • To access the controls and their values in different JFrames and forms

    Hi all - is it possible to access controls and their associated information? For example, in my old .NET application, I got a form where users could enter usernames/people with disabilities and also preferences for the launch of other external tools. The user filled in the text boxes and made a few selections on combo boxes etc. - I then recorded in an ini file which is loaded at run time. Then from anywhere in the application I could do something like:

    Dim strUserName As String = frmUserSettings.txtUserName.Text//for username
    Dim optLocalorRemote as String = frmUserSettings.cmbLocalorRemote.SelectedItem.ToString () //for selected item in the drop-down list box
    Dim optSomeOption as Object = frmSomeForm.SomeControl.Value //etc etc...

    You can call any control in any form and obtain its associated variables and also call any method belonging to him in .NET or void. Is it possible to do in the frameworks for Swing? I did some research but can't seem to find the equivalent in Swing

    If it is not possible can then someone point me in the right direction on how to do it? Do I need to define a class and I then have to instantiate each control in the class and have the getters/setters or y at - it an easier way? I essentially have an obligation to access related information across different forms in the application

    I found this:
    http://StackOverflow.com/questions/4958600/get-a-swing-component-by-name
    But this seems to return the control names and no values?

    Thanks in advance for any advice or help - we appreciate it! :)

    Hello Matt,

    for what you do with files .ini, java provides the java.util.Properties class.
    To access the other JFrames and forms (JPanels), you pass a reference to this framework/Panel to the place (class or method) where you want to retrieve information from this framework/Panel.
    Example:

    public class MyFrame extends JFrame {
      JPanel myPanel1= new JPanel(...);
    ...
      MyVeryOwnPanel mvop= new MyVeryOwnPanel(myPanel1,...);
    }
    

    Now within mvop, you can look at what happened to myPanel1.

    HTH

  • Disable defender and Security Essentials due to conflicts, has blocked access and control other programs.

    Hello, I use Windows 7 on a HP G60 laptop. I disabled Windows Defender and Microsoft Security Essentials because I started running free Panda and Malwarebytes Antimalware version. Now an error window Defender blocking access and control of a large number of programs, the window message trying to force me to turn Defender. Disabling Security Essentials is causing other things to not work. I can not yet re - turn on Defender, if I try clicking on the link in the error window, it will not restart, expires.  Tried to turn it back on using the Task Manager, but there is no response at all if I click Start. Access to Services and programs in the start Panel are all both blocked by Defender error window.  I actually want defender and Security Essentials, because they are redundant and are in conflict with other programs I am running, but apparently they cannot be disabled without blocking access to my computer. I thought it was harmful to run all these programs of security in conflict between them, now I can't use my computer at all. Thanks for any advice you can give me.

    Thanks much for the advice. I have a few other questions. Defender is not separated from the essential? Then uninstall Security Essentials would have no effect on the Defender isn't it? My problem is that Defender deactivation now blocks access to many other programs with a Defender error window.  I read that Essentials was supposed to replace defender and Defender should have been stopped or disabled when Essentials has been installed. Is this correct? I didn't, got them both running.  When I installed Panda, I got a notification from Windows on the conflict and choose which program to use. Although I chose my own safety programs at the time, which was never disabled Defender or kept from running. So I finally did it manually by accessing the properties in Services to change the startup type to disable, which is when all the trouble started.

  • Error message: "Lightroom can't access the internet, check your firewall and security applications. »

    Hello.  I have an Acer Aspire under Vista 64-bit desktop.  I have an error message when I try to export photos from Adobe Lightroom on my zenfolio online gallery.  The error message reads:

    "Lightroom can't access the internet.  Please check your firewall and security applications (Little Snitch, Norton, Zone defense,...) and add exceptions to the need to allow lightroom to connect to zenfolio.com. "

    I, to the best of my knowledge, did in the Security section of the Control Panel, adding to the list of exceptions in Lightroom.  However, it did not connect.

    I'd appreciate any help on this!

    Hello.  I have an Acer Aspire under Vista 64-bit desktop.  I have an error message when I try to export photos from Adobe Lightroom on my zenfolio online gallery.  The error message reads:

    "Lightroom can't access the internet.  Please check your firewall and security applications (Little Snitch, Norton, Zone defense,...) and add exceptions to the need to allow lightroom to connect to zenfolio.com. "

    I, to the best of my knowledge, did in the Security section of the Control Panel, adding to the list of exceptions in Lightroom.  However, it did not connect.

    I'd appreciate any help on this!

    It might be best if you find the solution of Adobe Lightroom forum. After all, the forum is dedicated exclusively to the Lightroom application.
    Here is the link to the forum (there is more than one available forum.)
    http://forums.Adobe.com/community/Lightroom

    t-4-2

  • System and security missing in Control Panel and also not able to decrypt the drive

    Original title: System and security

    i is not system and security link in my control panel and I want to decrypt the drive I encrypted earlier, what I do now, please help

    Hello

    To suspend BitLocker Drive encryption on a drive
    a. Click Start, click Control Panel, click System and security and then click BitLocker Drive encryption.
    b. click on suspend Protection for the reader.
    c. a message appears, informing you that your data will not be protected by BitLocker is suspended and asking if you want to suspend BitLocker Drive encryption. Click Yes to continue and suspend BitLocker on the drive.
    By performing this procedure, you have suspended BitLocker protection on the disk by changing the decryption for the BACKSPACE key key. To read data from the drive, the clear key is used to access the files. When BitLocker is suspended, secure the TPM validation does not place and other authentication methods, such as the use of a PIN or USB key to unlock the operating system drive, are not applied. This allows you to make changes such as upgrading system BIOS or replacing a data drive. When you have finished your changes to the computer, click RESUME Protection in the BitLocker Drive Encryption to start Control Panel item to use BitLocker Drive Encryption again.
    To turn off BitLocker Drive encryption
    a. Click Start, click Control Panel, click System and security and then click BitLocker Drive encryption.
    b. find the drive on which you want BitLocker Drive Encryption is disabled and click enable disable BitLocker.
    c. a message appears, informing you that the drive is decrypted, and this decryption may take a long time. Click on deciphering the drive to continue and turn off BitLocker on the drive.

    More information: http://TechNet.Microsoft.com/en-us/library/ee424315 (WS.10) .aspx

    I hope this helps.

  • Change security groups are allowed access to the project

    Hello

    We have a project of the Disqualification in our production environment that allows only administrators to view/access it. We now allow access of data analysts. I know that we could just edit the prod Manager access security group, but due to some storage issues related to the postgres DB that uses a Disqualification, we clearly downwards and the redeployment of the Disqualification (and the project) on the prod server every two weeks. This means having to manually modify access groups after each reinstall. To save the duty of our many stop to promote a new project dxi file, is there something that can be added to all config files to allow data analysts access the project? Editing a config in our backup file would be very fast and simple.

    See you soon

    Jon

    Unfortunately, no, no.

    I can't imagine a scenario that would require the Disqualification to redeploy completely. If there is a problem of PostgreSQL, the worst case would be a fall and recreate the Pb of results, I would have thought.

Maybe you are looking for