ACS5.1 internal user database update

Similar Questions

• issue by allowing expiration of password for internal users in ACS5.1

  Dear all,

  I use Cisco ACS 5.1.

  If I am allowing for internal users password expires, preconfigured users are disabled automatically.

  I enabled users one by one, even after that some time (from 30 to 40 minutes) users are automatically get disabled.

  Need solution to activate the password expiration.

  Kind regards

  William D

  Two suggestions I have:

  S ' ensure that you have the latest fixes for 5.1. Patches are cumulative and was the last patch. However, all least suggest you include at least patch 5.1.0.44.3 which includes a fix for the following problem:

  CSCtf06311: all internal users automatically disabled after you be connected to a single user

  -In 5.1 password expiry applies to all users and there is no way to exclude specific (for example the system users) to have their password has expired. If you want this feature would need to move to 5.2 and then install some 5.2 patches

  Al the patches I want to talk to are available for download from CEC

• ACS 5.2 - accounts User File Update does not work as expected

  Hello, I have a serious problem with the import of the fixed IP addresses to user accounts in ACS 5.2.

  Because this attribute cannot be migrated directly I try via "file operations--> update". I created the file update model, but entered IP addresses aren't imported - all other attributes can be changed without problem.

  If I try to "Add file operations-->" it works well, but I can't use this option.

  IPv4 address attribute in 'System Administration--> Configuration--> dictionaries--> identity--> internal users' is added correctly and appropriate field is not in user accounts.

  Do you have any idea what can be wrong?

  Hi Michal,

  Yes I submitted this as a bug recently. Sometimes after a migration from ACS 4.

  CSCtk05027 : custom fields for users after migration - import/update does not work

  Try to change one of your user input. Just add an IP manually it for example. Then do the update. She will work for this user, and it will update the ip address.

  The solution is to export all users of your DCC 5. Then remove it from the database and then to make an import file 'Add' instead of update. A bit of a silly workaround but the bug should be fixed in future patches (no information on that yet).

  Kind regards

  Nicolas

  ===

  Remember responses of the rate that you find useful

• Try to migrate Ultiboard user database of the 11 to 12 worm

  I updated my software to Ver 12 and noticed that my user database have not migrated. Then I copied my worm 11 critical db space worm 12 and restarted Ultiboard. On call for Ultiboard, I received a diagnosis indicating that my user database was the wrong version and that it would not be usable. So, how can I migrate my database to the user, and why was it not this part of the update process in the first place?

  Hello smh55,

  Tools > database > convert the database should do the trick...

• user database handle is corrupt

  the system is 7 pro and it runs a program that needs to vpn to another computer, other automatic windows 10 updated and we used the do not install key. at this time, we tried to up the vpn again and it gives us an error message "user database handle is damaged" and there we do not allow to go further.

  Hello

  I realize counts the inconvenience you encounter in obtaining VPN. I suggest you to report your query in our TechNet forums as it better this problem.

  Please visit the below mentioned link to validate your request:

  https://social.technet.Microsoft.com/forums/en-us/home?category=windows10itpro

  Hope this information helps.

  Please get back to us with an update on the issue, we will be happy to help you.

• How to manipulate the apex error to avoid lost database updates?

  Hello

  
  

  I'm looking for a way to manipulate the user error message hostile apex to avoid lost database updates. It seems that the message to the error handling function is not routed.

  
  

  Any ideas?

  
  

  THX.

  Gerd
  

  Hello

  Try the APEX error code. DATA_HAS_CHANGED

  Kind regards

  Jari

• Separate authentication for external and internal users?

  Hello
  
  Asked me to come with a CEP for a client who wants a new system APEX is accessible to internal and external users. The client security team want to have two separate copies of the request for the APEX and both copies of the auditor of the APEX on separate databases on two separate servers from Weblogic to support different security requirements for both internal and external users. I don't think that is necessary as APEX should be able to impose conditions depending on what type of user is connected, by questioning the cookie passed in which could contain a flag to say whether the user is internally and externally. In addition, CAE can be used to further restrict external access.
  
  The middleware for the customer solution is managed by a third party, who have made the following recommendations:
  
  The domestic channel requires SSO to configure on WebLogic while the outside lane. Internal users must be validated on Active Directory, with RSA Authentication Manager used for external users. We cannot set up a listener APEX instance to use and not to use SINGLE sign-on at the same time. Two applications are necessary.
  
  Now, I understand from my understanding limited the listener of the APEX, it is possible to implement different rules depending on the type of user to access. However, might just as well not be managed from Magnatune APEX? We could write a custom authentication procedure that verifies again road and the SSO user authentication cookie or otherwise, as required.
  
  So my question is this: can it really be necessary to implement two versions of an APEX application, with two distinct on different servers APEX headphones, to meet the security requirements of separate here? Ultimately at the end of the day if that's what the customer wants, we have to build it, but I'm looking to reassure them via a CEP that won't be necessary. I think that the seller of hardware/middleware recommend that the client just because they do not know available in APEX itself custom authentication options.
  
  Please forgive any simplifications or the lack of details in the above - I'm more a developer APEX as a person of the infrastructure and a bit of a 'newbie' where the listener APEX is concerned. All advice gratefully appreciated!
  
  Graham.

  Hi Graham,

  It's a matter of people paranoid how and to what extent they trust their own infrastructure. Things could be easier than to split the environments, but I don't know if I just depends on the cookie because cookie can be easily rigged. But I think that the following architecture would be safe:
  1 internal users connect APEX listener somehow security team requires, come to APEX and maybe be identified using the internal IP address (range). To simulate the INVESTIGATION period should be difficult for external users.
  2. external users connect APEX listener through a defined gateway, preferably a proxy. All future requests through this gateway would be considered external users.
  You may add additional logic to the proxy, for example use something like 'mod_headers' in Apache HTTPD to add a page header to requests, so that you may identify as external users.
  You could, of course, also put it the other Tower and allow internal users to use some proxy to enforce certain rules of IP based address, or perhaps a few additional references as authentication for access to the proxy (which again could be transparent user in AD-configuration, at least if you stick with IE).

  You can easily implement the separation in your custom authentication process. But this architecture also allows some other compromise: even if someone does not trust your application logic to handle two types of application successfully, you can also use the proxy to enforce the specific call for an application id. Certainly you don't need to duplicate the infrastructure...
  Most of the companies already have a proxy for external users, for example to activate SSL and to hide other internal resources, for load balancing,... so I think you just need to put some configuration of the existing infrastructure and end up needing no component additional. Even if there is no proxy and yet, it would be an element of very light weight, easy to handle.

  So far, all this has nothing to do with the earpiece of the APEX. It's 'just' a web front-end for the instance of the APEX in the database. I wouldn't put a logic of network security in this service, but the split things upward front. The APEX listener can be patched to add some logic, but which was not supported.

  I think that this would work and should be sufficient for most of the safety requirements.
  If my picture was not painted understandable, let me know.

  -Udo

• How to integrate the CCM user database unit

  Is CCM and the unit with a ldap user database, possible to integrate? and how

  BTW, if you add a Subscriber in the unit, is to add a user to windows Active Directory.What is the password for this user AD?

  HI -.

  The permissions to allow the unit to create objects user AD, groups and distribution lists are made by running the wizard of permissions of the unit as well as configured when you install the unit (for example, you specify if you want to create user objects, or simply import subscribers, which is how we do it). The default password for the Windows account of the user of the AD is listed in the template of the default subscriber passwords, domain Windows Password Settings section. For security reasons, it must be changed to follow the policies of your organization password. You can change this by creating a new model, based on the default subscriber, with a new Windows Password Settings that gets applied to new subscribers as they are created or imported. The unit is not a LDAP database, it uses the Active Directory database. Database SQL of the unit is synchronized with the information in the AD. CallManager uses its own telephone directory and user information or can use AD. We chose NOT to incorporate the MAC with AD. It is a personal choice for us - we didn't want to CCM or unity, creation of user objects. Maybe it's a different look for a Messaging voice only implementation rather than Unified Messaging. I can't deal with your issue on the integration of Cisco databases and unity.

  Best wishes

  Ginger

• What product can hunt an internal user internet access web site?

  Dear all,

  My client uses ASA 5512, they want to check and record their internal users (employees) visited this site web (HTTP, HTTPS, FTP etc.).

  I have not a clue what cisco product or other reason.

  THX

  The module of firepower on the ASA 5512 - X, when licensed and configured with an appropriate policy, can do this.

  The ASA 5512 - X by itself cannot.

  If you can share "inventory" and "module" we can get some clues on the preparation and the ability to run the module of the unit. We would look for the required and installed SSD sfr module type.

• The ISE - user not found internal user authentication failed

  Salvation of the Forumers

  I try to make wireless 802. 1 x, where the identity store using the internal users.

  But I got this error message when I try to connect

  Authentication failed                                                                                 :

  22056 object was not found in the identity of the point of sale

  My authrorization rules is built like that

  identity groups = user identity group / "mygroup".

  condition = no setting

  Permissions = standard / PermitAccess

  Question 1

  Any troubleshooting step to do about it?

  Question 2

  For authorization rules, what is the condition put to use internal user as the identity store?

  Thank you

  Noel

  The error is due to an authentication failure and is not a problem with authorization

  You must watch your authentication (policy-> authentications) and see what storage of identity has been authenticated against

  Moreover can do authentications Live page (monitor-> authentications) and to record failure, click the icon under details. This will give you details of the request processing and you can see what rule was accompanied in the politics of identity (matching political identity rule) and "banks chosen identity.

• The Developer Portal and internal users

  Hello

  I have configured on our ISE to use AD-users as sponsors. And it works perfectly.

  but I also try to set up an internal user to the portal of the sponsor.

  I've configured almost the same so I don't understand why the LSE reports:
  Authentication of the sponsor has failed: not found for the user Sponsorgroup

  My identity store is a sequence of the my and internal users and I can see from the log it looks like the right place:

  Identity store:

  Internal users

  My condition is that the internal user, must be a member of the group identity: sponsorAllAccount

  my home group:

  Group membership:

  SponsorAllAccount

  and then get a group created promoter, this grop of sponsor which is allocated to the State, works very well for det AD-users.

  Evaluate the politics of identity

  5435 sponsor authentication failed

  any suggestions why?    I now use the lastes 1.1.1 version.

  BR

  Tuva

  Yes,

  For your internal groups use the condition of group identity preconfigured on the left.

  I don't know why there is an option on the left, he has not worked for me either in the authorization policies.

  Thank you

  Sent by Cisco Support technique iPad App

• Take the backup of the user database using oracle forms 6i

  I need backup user database using oracle forms 6i. Is this possible?

  Yes.

  Try

  When press the button trigger

  DECLARE
      un                VARCHAR2(30);
      pw                VARCHAR2(30);
      db                VARCHAR2(30);
      con_str        VARCHAR2(100);
      --
      data_file    VARCHAR2(100);
      log_file    VARCHAR2(100);
      cmd_line    VARCHAR2(200);
      ALT NUMBER;
  BEGIN
      IF :CONTROL.file_name IS NULL THEN --- take a file location
          IF SHOW_ALERT('FILE_NAME') = ALERT_BUTTON1 THEN
              RAISE FORM_TRIGGER_FAILURE;
          END IF;
      END IF;
      --
      un    := GET_APPLICATION_PROPERTY(USERNAME);
      pw    := GET_APPLICATION_PROPERTY(PASSWORD);
      db    := GET_APPLICATION_PROPERTY(CONNECT_STRING);
      con_str    := un||'/'||pw||'@'||db;
      --
      data_file    := :CONTROL.file_name||'\'||un||
                               TO_CHAR(SYSDATE, 'DDMMYYYY')||'.dmp';
  
      cmd_line    := 'exp userid='||con_str||' file='||data_file;
      HOST(cmd_line);
      --
  
      ALT:=SHOW_ALERT('MULTI_BACKUP');
      IF ALT=ALERT_BUTTON1 THEN
          RAISE FORM_TRIGGER_FAILURE;
      ELSE
          EXIT_FORM;
      END IF;
  
  END;
  

• upgrades of vcenter 5.0.1b to 5.0.2 (5.0 update 2) includes the schema of database update/upgrade?

  upgrades of vcenter 5.0.1b to 5.0.2 (5.0 update 2) includes the schema of database update/upgrade?

  Hello

  I'd be surprised if there is one, but have you checked with the database audit tool?

  http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2004286 - mentions not required for minor updates but still should be able to run it.

  Many tx

• Display both internal users and external v5.0

  Hello

  I have an evironment of configuration using view 5 for internal users using PCOIP (about 500).  I want to enable some of these users access to a virtual computer from outside the workplace.  Currently I only use 1 connection to the server.  I can use this connection to the server to enable PCOIP internal and external / RDP connections or I need to connect 2 servers, one for internal and an external?  I'm just trying to understand how it fits into the picture, I intend on using a security server.  If explained elsewhere then please point me to it, but I tried to search.

  Thank you.

  Depends on how they access, most of the cases you need an another view connection to the server that is configured for PCoIP tunneling and external URL is what your users will connect from the outside.

  Its really easy to install, install another (choose the replica), highlight the original, then you configure the settings above and you're done.

  Linjo

• Public connected user database link creation

  Hello, DBA
  
  I tried to create the user database link connected audience.
  I have two databases (orcl, orcltest)
  
  Orcltest database, I created dblink
  
  SQL > grant create public database to u1 link;
  Grant succeeded.
  
  SQL > conn u1
  Enter the password:
  Connected.
  
  SQL > create sequoia link of public database using "orcl".
  Database link created.
  
  
  In orcl, I tried to access
  
  SQL > select * from u1.tab1@redwood;
  Select * from u1.tab1@redwood
  *
  ERROR on line 1:
  ORA-02019: description of the connection to the remote database not found
  
  QUESTION: what is the error?
  Note: tns, earphone works very well. No problems.
  Prod: 1 0.2.0.4.0
  OS: rhel 5.1
  
  Thanks in adnvance...

  Hello

  Orcltest database, I created dblink

  SQL > grant create public database to u1 link;
  Grant succeeded.

  SQL > conn u1
  Enter the password:
  Connected.

  SQL > create sequoia link of public database using "orcl".
  Database link created.

  Here, you create a DBLINK on the ORCLTEST to the ORCL database, sort of source database is ORCLTEST and target is ORCL.

  In orcl, I tried to access

  SQL > select * from u1.tab1@redwood;
  Select * from u1.tab1@redwood
  *
  ERROR on line 1:
  ORA-02019: description of the connection to the remote database not found

  It will not work because you created the dblink on the source database, which is ORCLTEST.

  DBLINKS give you a way to access resources (tables, indexes, packages, etc.) in a remote database.

  What you do is:

  1. create a dblink on ORCLTEST. This dblink will provide access to ORCL via the ORCLTEST.

  2 instead of this, you you connect directly to ORCL. That won't work, your DBLINK is not here, you can create another one here pointing to the ORCLTEST.

  DBLINKS act as a bridge, a connection between two databases. They are only available in the source database to create a link to a database remotely (target).