My requirement is show dashboard on my adf screen based on user role .
For this I created three dashboards
Dashboard1- assigned to role1
Dashboard2- assigned to role2
Dashboard3- assigned to role3 .
I created a adf page which contains the three Obiee dashboards( using )
Now whenever a user with roles(role1 and role2) logs into my adf application ,he should be shown only Dashboard1 and Dashboard2.
I achieved this by setting permission to dashboard in obiee, but the problem is that " Access denied for Dashboard3" message is shown for the Dashboard3 .
How can i overcome it or is there any way where i can render only those dashboards which are assigned to the logged in user.
Is there any API exposed by obiee which gives me the dashboard assigned to a particular user.
Can anyone help me on this.
You can use the rendered attribute in the dashboard and fill it with the following expression
#{securityContext.userInRole['role1']} which will only get displayed when the user has role1
You need to have ADF Security enabled... If you didn't enable it, you can learn how from here
Related
hello i want to add autorization roles like admin and editor users for my reactJs dashboard using firebase .
when a user create his own account he will be a editor by default.
in the same time i want to create just one user as an admin so he can do extra things .
You can use firebase custom claims which can be used for role based control access.
Check out https://firebase.google.com/docs/auth/admin/custom-claims for more information.
I'm planning to create a website, and the pages contents will be created by both Admin and normal(logged in) users.
Is wagtail admin page supposed to be only for the admin users to create page contents ?
Is it a bad idea to give normal users the admin access with limited permissions to allow them to create their page contents?
If it is a bad idea, is it still possible to use the awesome admin page editor interface for the normal user?
I'm wondering how other people handles the page creation by the normal users in wagtail..
It depends how you're defining "admin user". By the most literal definition, as soon as you give a user access to the Wagtail admin, they're an admin user...
Wagtail is designed to support multiple user roles - through features like the permission system and the "submit for moderation" option, so that you can give people access to edit pages without giving them total control over the site. For example, the Royal College of Art - the site that Wagtail was originally built for - gives students limited-permission accounts on Wagtail so that they can create and submit pages about their work in the RCA Now section, without giving them edit access to the rest of the site.
If you want to give normal user to wagatil admin access than you have to give below permission as mentioned in photo.
You can see this in
wagtail admin > settings > groups > other permissions > check "can access wagtail admin"
And might be clear that you have'nt given Admin Access Role.
We have the angularjs application where we have different roles associated to the users. For ex: the two roles are Admin and Local. Based on the role, we show some menu items for the Admin and adds more features/screen to the Admin .
The userInfo with the Admin Property is returned from the login response and based on what we decide which all menu and screens to be rendered .
But if we user the developer tool, and the set the break point where the admin property is used, and set the admin property as true the user even he is a local user would be able to access admin privileges .
In short who has some idea about the javascript code can get the admin privileges . Is there any idea other than minification of the code to prevent this kind of security threats
Thanks
As the front-end of your application will run on the client machine there is actually no way to stop a user from debugging or modifying the code. Thus it's impossible to prevent someone from tricking their local instance of the application to think it's signed in as an administrator.
If you simply want to hide the admin interface, one possibility is to have separate (or additional) templates for administrators and restrict access to these based on the user's privilege. If there is anything to be gained from this is up to you. You will still need to validate the rights to execute any privileged action on the server anyway. Obtaining administrative privileges on the client must never be the same as obtaining them on the server side.
I am currently working on my first AngularJs + Meteor app. In this app, user can either register using $meteor.createUser or can use Facebook to login i.e. $meteor.loginWithFacebook. After logging in, on one page I am displaying user's friends from Facebook who have used this app. If user has logged in using Facebook then that page is working properly. But if user has registered using normal Meteor login [$meteor.createUser], then on that page I have to display Login with Facebook button. When user logs in with Facebook on this page, it is creating new document in users collection. But I am using Meteor.userId() as primary key in all tables. So I have following options:
Option 1:
delete current document of user [_id no 1]
log in with Facebook
change _id of a document created while logging
with facebook to _id no 1
Option 2:
Assign "_id no 1" to user while he registers using Facebook
But I have not found any way to do so. How to do it? I am not able to change _id of document present in users collection. Please help. Thank you in advance.
I think you have to merge those accounts. This package will be helpful:
https://atmospherejs.com/mikael/accounts-merge
I'm creating an app using ionic/angularjs using Backand as the backend service. I have it setup to use a MySQL database.
1) When I create a user through the SDK (version 1.8.2 from the CDN), the user shows up in Registered Users area but does not get a row in the 'users' table. Someone mentioned that I should have Anonymous Access set to User as they said this is a permissions issue but that did not solve the issue for me.
2) I can manually add a user through the Backand GUI and the user gets a row in the 'users' table as I would expect.
3) I can not manually delete users or rows in the 'users' table through the Backand GUI. I get an error stating that the "Delete My App User" failed to perform. You can't specify target table 'users' for update in FROM clause. I haven't modified the Security Actions at all. They're all default. Updating a user receives a similar error.
4) I created a blank app in Backand and updated my app with the new tokens and app name. I was able to login to that app using login credentials that were created on the original app but were not a part of this app. Does this mean users can access any Backand once registered with one app on the system?
Am I just really missing how 'users' registration and logins are suppose to work in Backand?
Any guidance would be appreciated. Thank you in advance.
You can read more on the Back& security concept here.
User can only access to the app he was registred into. In your case I believe the second app has anonymus access, so you have signed in to the first app and got access token, and using the anonymus header you accessed the second app.
Please use incognito window mode for the second app and then you could debug two apps.
You can also review Back& User example to play around with the security.