Creation of authenticated external users

Similar Questions

• ACS 5.1 - can external users be members of groups inside?

  Currently I use ACS4.1 to authenticate access admin network routers and switches. Users are authenticated against a Microsoft AD domain but belonging to a group is managed by the Association because we are unwilling to deal with bureaucracy AD company on the ad groups.

  I'm migrating to ACS 5.1 due to its much more effective and more flexible policy problems try to get external users belong to groups inside?

  I don't REALLY want to have to create ad groups and do things in whole group mappings. Am I missing something obvious or I'm he overthinking?

  Thank you

  Nathan Spitzer

  SR Network Communications analyst.

  Lockheed Martin

  This is possible by creating a sequeuence of indetity:

  Users and identity stores >... > sequence identity store

  (1) select 'password base' as an authentication method

  (2) in "Authentication and recovery search attribute list" select AD1

  (3) in the "search for the recovery of additional attribute list", select InternalUsers

  (4) select the Advanced Option"

  If the internal host not found or disabled user then quit sequence and treat it as "User Not Found".

  This can then be selected as the result of a politics of identity. What it does authenticate using Active Directory. If authentication fails is considered an authentication failure. If authentication is successful, it will then look for the user in the internal user database. If there is no active users in the internal user database then sequence identity will be treated as if it has failed with the "authentication status" of "UnknownUser.

• TWO_TASK settings prevents the OS authenticated the user DB

  Hi all
  I am facing problem while connecting to an OS authenticated database user.
  I install an application that a first affects the TWO_TASK parameter in the name of the database (e.g. TWO_TASK = DMDB. Here DMDB is also ORACLE_SID) then attempts to connect to the database with a user (say appuser) which is externally authenticated by the operating system.
  But the connection fails with an error:
  
  *****
  ERROR:
  ORA-01017: name of user and password invalid. connection refused
  
  
  SP2-0751: unable to connect to Oracle. Exit SQL * more
  
  ******
  
  I'm working on SunOS and Oracle db is 9iR2.
  
  Also note that authenticated users are still able to connect.
  This user (appuser) is created by the application itself as an external user and therefore cannot be changed. And in this scenario, TWO_TASK variable cannot be disabled.
  
  Help, please. Thanks in advance...
  
  
  Suggest also if I need to configure sqlnet.ora (I still did)?
  
  Remote_login_passwordfile = EXCLUSIVE lock
  
  
  Kind regards
  Saket BB

  This parameter is mandatory (TRUE) If you want SQLNet connections (TWO_TASK is a SQLNet connection) could have been authenticated by the remote host.

  Oracle recommend that DO NOT serve as a security breach.
  (you can think of ways to use!)

  See
  http://download.Oracle.com/docs/CD/B10501_01/server.920/a96536/ch1178.htm#REFRN10185

  This shows how much it should normally be set to FALSE
  http://download.Oracle.com/docs/CD/B10501_01/network.920/a96573/asoauth.htm#1005059

• Sqldeveloper & external users

  According to http://htmldb.oracle.com/pls/otn/f?p=42626:39:2768468353797662:NO:P39_ID:5341, I was assuming that the Radius Authentication for users identified externally would work with Sqldeveloper 1.5
  
  It seems to me that the external authentication configuration on the server should be transparent to any application that connects to Oracle, but apparently not.
  
  I have authentication radius on the server, I can use 'sqlplus user/pass@DBNAME' connect to the database using the radius (Oracle Advanced Security) authentication
  
  But I'm unable to use all of the accounts that I created as 'outside' to connect to the database using sqldeveloper or enterprise manager.
  
  Does anyone have the sugggestions on getting this working?

  How do you define your connection in SQLDeveloper? You should probably use the driver for the OIC to advanced security. Look at the tools-> preferences-> database-> advanced settings and check pilot OIC/use of thickness.

• I'm currently having a batch file. I need to enable authentication of users can u it... Please tell me how I can run?

  I'm currently having a batch file. I need to enable authentication of users can u it... Please tell me how I can run?

  the in-house batch file calls a few .jar files... the requirement is I need to restrict who uses this batch file.
  I can either store the user name and password in a separate file or...
  Please suggest me... Thanks in advance.

  Hi Alexander,.

  Your question is more complex than what is generally answered in the Microsoft Answers forums. It is better suited for the IT Pro TechNet public. Please ask your question in the following forum.

  Windows XP IT Pro category

• Push message to external users

  Hi all

  We have a Blackberry Enterprise Server.

  Is it possible to send a push (pap) message to external users (not the registration in our BES)?

  Thank you

  I solved the problem by changing the order of the transport network in the config.xml file

• is it possible to make the machine and authentication of users in the same permission profile?

  Hello

  I want to know is - it possible to machine authentication authentication of users arrive at the same time? Something like that...

  Condition

  IF (wired_802.1x and AD:externalgroup computer dommain EQUAL AND Some_domain_user_group EQUAL AD:exteranalgroup)

  Permissions

  then Vlan x

  Basically, I'm just checking a machine in the domain and user is valid only while he should be able to have full access.

  Any help will be of great value.

  Hello

  IF (wired_802.1x and AD:externalgroup computer dommain EQUAL AND Some_domain_user_group EQUAL AD:exteranalgroup)

  -Not possible

  As the authentication of the user and the machine occur in different contexts.

  ACS cannot check them both at the same time.

  With the help of MAR, you can, although club together and reach:

  "machine is part of the domain and user is valid only while he should be able to have full access"

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_system/5.1/user/guide/users_id_stores.html#wp1235978

  Tips for MAR configuration:

  (1) set the client to authenticate user or computer.

  (2) create two rules in the authorization for the user and and the other for the machine (identity them using the ad group membership).

  (3) enable MAR on the AD on ACS configuration page and set the aging time.

  (4) in rule user, customize and use the condition "Has been authenticated machine" and the value is false.

  Rate if useful

• Windows 7 slow login / delay authentication question user wireless via ACS 5.8

  Just set up a new ACS 5.8 farm (only 2 servers) here and which I hope someone here can shed light on the difficulties.

  The new ACS server is set up to correctly authenticate administration network device and I am currently working on the definition of profiles for our wireless users authentication and business laptops.

  Being new to this version of ACS (we will migrate manually ACS 4) I followed an excellent example of this task described in a video on this site: http://www.labminutes.com/sec0044_ise_1_1_wireless_dot1x_machine_auth_peap

  I managed to have a Windows XP sp3 client authenticate properly, first with the authentication of the computer, then the authentication of users... and the domain logon process takes place in a short period of time< 1min="" and="" the="" user="" gets="" all="" their="" networked="" drives="" via="" the="" domain="" login="">

  However, I'm fighting to get our Windows 7 clients to authenticate properly.  It seems that the machine authentication does not work as expected (I can ping the laptop test from another machine on the network while the test machine is sitting at the login screen; and I see Authentication host recorded in the papers of authentication Radius ACS).  But, when a domain user logs in with his credentials, the connection process takes 4-5 minutes before an event to authenticate the user is entered in the register authentication Radius ACS, after which the login process completes, except that the domain logon script does not work and the user does not receive the drive mappings.

  Can someone point me in the right direction here?  I would be grateful any entry on this.

  Thanks in advance,

  John

  I had a similar problem with Wireless 802.1 x Win 7 clients unable to connect unless they had cached credentials of the AD.  Authenticate in the machine, but the user would take a lot of time if the Windows credentials have been cached.

  I could solve the problem by expanding the ACL of the air space used during the user authentication to include all DC in the environment.

• Authentication card smart - authentication certificate user

  I am developing an authentication solution for BlackBerry based on cryptographic SIM cards. I managed to create a pilot smart card reader and a driver of smart card using the RIM Crypto API. The use of these two, I'm able to import a
  certificate stored on the SIM card, enable the authentication of users in two phases that checks the password device and the STEM to the certificate. I can also set up a TLS session using private keys and certificates stored on the card.

  However, when you try to activate the "Authentication certificate" option in the password options panel, I encounter a problem. After selection of the certificate and click on save, the device asks me to enter the password device and the PIN smart card, what I'm doing. Debugging tells me, that the PIN is properly checked with the card. Subsequently, a 'Card access smart' popup appears with information that the 'Options' of RIM application attempts to access the card with the information "the private key will be used to initialize authentication certificate". When I enter PIN code OK, I said: 'failed to initialize authentication certificate. Check that the certificate is not on the smart card used for two-factor authentication. »

  Can someone tell me why this is? Must the certificate be special in some way (content, restriction of the use of the key etc.)? The certificate is obviously present on the map, as there is for example a client certificate for TLS sessions setting. Also, what makes this "initialization" all of the average of certificate?

  Well, I think I'll answer myself that I managed to solve this problem

  After some debugging I realized that:

  • After the second PIN prompt appears, the method of signRSA (net.rim.device.api.crypto.RSACryptoSystem, net.rim.device.api.crypto.CryptoTokenPrivateKeyData, byte [], byte [], int, int, java.lang.Object) in our RSACryptoToken extension is called
  • This method gets a context (last parameter) object, which is a SmartCardSession
  • during the processing of the request of sign (cf. the smart card and examples of smart card of RIM drive) must not create an another smart card session, but instead reuse the provided in the framework.

  Trying to establish a new session of chip due to the demand to block, because the sessions are exclusive, i.e. only can be opened simultaneously.

• Update the phone book for an external user

  Hi all

  I got 13.2 TMS

  I am trying to add an external user in the telephone directory. Do I have to create a txt or CSV file to add it? If so, is there a format of CSV file with columns to enter data and download it?

  Hello

  You can create a type of source directory to the "Manual of the list" and type in your contacts. Create a directory, and then add the source. That should do the trick.

  / Magnus

  Sent by Cisco Support technique iPhone App

• How to access e-business applications by external users via internet

  Dear all

  We have e-business application 12.1.3, currently accessible by internal users only

  We intend to access the site by external users also via internet

  Please suggest me.

  material requirement

  requirement of network

  safety requirement

  procedure of implementation & Doc Oracle.

  Thank you

  MUBA

  Review pl MOS Doc 380490.1

• External user followed in Captivate first

  If I understand correctly, there are some limitations to the use of external user accounts (self-registration of service too), when it comes to monitoring the progress and performance of users in the LMS.

  As we work with elderly test subjects that might not be very technologically inclined, we would prefer to sign upward and as easy as possible, and if the Adobe ID is simply not ideal.

  Is there an alternative?

  Hi Thomas,

  With external user Adobe ID is not necessary. Simply send the registration of external users link to the user where it will ask you to register itself. User can use any email ID (his personal e-mail ID) to register for this external group and you will see increased County on your side of seat.

  After registering, the user will be directed to the home page of the learner. Later user needs to use the external link and the registered e-mail ID and password to connect.

  Kind regards

  MILIN

• Access for interal AND external users through a single login server?

  Hey,.

  Apart from redundancy, it is possible to have a single connection server that allows internal users AND external access virtual resources?

  For external access, I have associated my login server security server. It works perfectly if I activate the PCoIP Secure Gateway option on my server of connection and enter the public IP address of the Security server.

  But with this configuration internal users are not able to connect (listing the works of resources, but the connection fails).

  If I disable the PCoIP Secure Gateway option, internal users can access, but not external users via the Security server.

  Any contribution is appreciated.

  Thank you very much!

  No, it's the only way you can do it for internal users and external to share the same login server - activation of the MTP setting is by CS. If you want to PSG on for external users (and it is practically a necessity unless you use a third-party VPN), but offshore for internal users, they will point to the servers of different connection and so you'll need two.

• Database connection - error of creation of the admin user Setup. No route to host

  During step 2: configuration of the database connection we select the "internal database".
  After a short delay, we get a message saying "error of creation of the admin user. No route to the host.
  I have been more before DNS records and back and everything seems in good condition.
  Can someone point me in the right direction to solve this error?
  

  This is an SSL certificate error. Have you changed the default self-signed SSL certificates?

• See 5.1 and external users...

  Hello

  I'm a new 5.1 installation deployment view and came to the point of wanting to grant external users access to their desktop using PCoIP.  I have currently only a single connection to the server in place and don't get any display on external clients unless I have activate the option 'Use PCoIP Secure Gateway for connections PCoIP desktop' and specify the external IP address that I am NAT'ing in the login server.  However, once I do that, it breaks the connectivity for all of my internal users.  Deactivation of the PCoIP Secure Gateway option restores internal connectivity, but then I'm back to square one and only a black screen and disconnected my external when users I'm trying to connect to the desktop computer.

  Roll on a new security server will solve this problem for me?  Or do I need a second connection to my external users server instead?  We have no DMZ area...  Is there any question, place security server (if it's the real solution) on the same local network as my existing connection server segment?

  Thanks for any help!

  -Matt

  Here is the video I made which will answer your questions on the servers VMware View and security for external access: http://www.virtualdojo.com/content/how-configure-security-server-security-servers-101