I've implemented SSO with Salesforce using ADFS. Currently all users can login to Salesforce via SSO. I'd like to limit SSO to a subset of users based on user groups defined in AD. How can this be accomplished?
123251
We've set up Single Sign on with SAML. Our IdP is OneLogin and using their link, we are able to connect.  We now want to disable password login for some users in Salesforce.  points me towards a "Use Single Sign On" or "Is Single Sign On Enabled" permission (depending on the age of the document) on the user profile, however I cannot find this permission. Does anyone know where to find it?
27871
On Linux (Debian Squeeze) I would like to disable SSH login using password to some users (selected group or all users except root). But I do not want to disable login using certificate for them.  edit: thanks a lot for detailed answer! For some reason this does not work on my server:  Match User !root PasswordAuthentication no   ...but can be easily replaced by  PasswordAuthentication no Match User root PasswordAuthentication yes
103310
I have a list where new users are added as they input there information. The problem is that if a user do a search they can pull up other users ss. How can I prevent other users from searching in the search for other users information. If that make sense?
87224
My scenario: I have some groups with full - and inappropriate - access to all Sql Server instances. I want to change that.  My Plan: Give full and automatic access to all databases (it is customer databases and this groups must be allowed to change any property if necessary).  Restrict permissions on Instance Level, because this groups should not be allowed to do any unexpected change on instance properties.  I don't want to create a user in databases, because our external customer could drop the user ( they have db_owner permission )  Someone have any idea? Tks
31506
So what I read everywhere is that, in order to connect to Salesforce via the API, you'll have to authenticate using OAuth.  But this involves creating a Connected App, which is 'cumbersome' for normal users. They just want to login and go.   How do e.g. Jitterbit and Mavensmate etc solve this? I don't install Jitterbit/Mavensmate in my org, do I? There's no connected app in my org. Yet, they can access my data when I provide my username and password+token.  How can I connect to Salesforce without running via OAuth and a Connected App or installing something in the org?
59386
I'm looking for a way to add an Active Directory user to a Mac and let them administrate the machine, without making more than just that user an administrator.  Right now, I'm using Directory Utility to add an AD group, we'll call it Domain Devs, to the Allow Administration By: list. This would allow Bob, Nancy, Paul, and Bill to administer the computer. But this machine is supposed to go to Bob, so I only want him to administrate it. I then have to go to the login options and tell it to only allow Bob to log into the computer.  So while Bob, Nancy, Paul and Bill can administer it, only Bob can log in.  There is a concern that other users will be able to log into or gain access to the machine through another method of login or security breach and have administration rights to the system.  We're looking for a way to do something similar to what happens in Windows when you take a user in AD and add that specific user to the local Administrators group, so Bob could be added to that specific computer and have admin rights and any other domain user can log in and have just limited user rights.  Is there a way to do this, add a specific AD user to the Mac as an administrator without using a group in AD with just that user in it?
84549
We in our club have a computer with Windows 7 Professional that every club member may use. And everyone has their own separate account.   Those accounts have to have administrator priveleges since I want everyone to be able to install any software and use any feature they want. However, there is a single thing that they shouldn't be allowed to do - that is, look into another users' profiles. Now when anyone goes to 'c:\Users(Any User Name)' a little prompt appears that this folder is secured and whether you really want to look inside. Simply clickinh 'ok' give you access to any profile.  I tried disabling taking ownership for Administrators group in Group Policies but that had no effect. How can I effectively prohibit administrators looking into each others' profiles and documents?
45700
I want to check the current user exisit in a AD group inside the SharePoint Group using SPServices JQuery. I used the below code snippet but not successed. Any suggestions?   $().SPServices({         operation: "GetGroupCollectionFromUser",         userLoginName: $().SPServices.SPGetCurrentUser(),         async: false,         completefunc: function (xData, Status) {              if ($(xData.responseXML).find("Group[Name='SP Group Name']").length == 1)              {               }             else              {              }         }      });
109135
I know-know I can search and read but anyway I would need to ask in order to escape possible typos, personal misunderstandings and to better remember.     I develop on a machine with installed Sharepoint 2010 Sever where I have local groups:     Administrators Description: Administrators have complete and unrestricted access to the computer/domain   WSS_Admin_WPG Description: Members of this group have write access to system resources used by Microsoft SharePoint Foundation      **Does the description of "Administrators" ("computer/domain") imply all privileges of "WSS_Admin_WPG" ?    Does the description of **WSS_Admin_WPG (in part of "system resources used by Microsoft SharePoint Foundation") imply Sharepoint Server?**    The WSS_Admin_WPG group has entries of:     "BUILTIN\Administrators (S-1-5-32-544)" group   and some user domain accounts   Is "BUILTIN\Administrators (S-1-5-32-544)" group the same (alias to?) as "BUILTIN\Administrators" entry I observe among Sharepoint Farm Administrators (through "Central Administration")?       Is the entries of domain accounts excessive (or necessary)     in "WSS_Admin_WPG" if these accounts make part of "Administrators" group?     in "Farm Administrators" if these accounts are part of "BUILTIN\Administrators (S-1-5-32-544)" group?     What are relationship (difference) between "BUILTIN\Administrators" and "Administrators"?
85133
A searched for answers but have found nothing on here...  Long story short: a non-profit organization is in dire need of modernizing its infrastructure. First thing is to find an alternatives to managing user accounts on a number of Linux hosts.  We have 12 servers (both physical and virtual) and about 50 workstations. We have 500 potential users for these systems. The individual who built and maintained the systems over the years has retired. He wrote his own scripts to manage it all. It still works. No complaints there. However, a lot of the stuff is very manual and error-prone. Code is messy and after updates often needs to be tweaked. Worst part is there is little to no docs written. There are just a few ReadMe's and random notes which may or may not be relevant anymore. So maintenance has become a difficult task.   Currently accounts are managed via /etc/passwd on each system. Updates are distributed via cron scripts to correct systems as accounts are added on the "main" server. Some users have to have access to all systems (like a sysadmin account), others need access to shared servers, while others may need access to workstations or only a subset of those.  Is there a tool that can help us manage accounts that meets the following requirements?   Preferably open source (i.e. free as budget is VERY limited) mainstream (i.e. maintained) preferably has LDAP integration or could be made to interface with LDAP or AD service for user authentication (will be needed in the near future to integrate accounts with other offices) user management (adding, expiring, removing, lockout, etc) allows to manage what systems (or group of systems) each user has access to  - not all users are allowed on all systems support for user accounts that could have different homedirs and mounts available depending on what system they are logged into. For example   sysadmin logged into "main" server has main://home/sysadmin/ as  homedir and has all shared mounts  sysadmin logged into staff workstations would have nas://user/s/sysadmin as homedir(different from above) and potentially limited set of mounts, a logged in client would have his/her homedir at different location and no shared mounts.   If there is an easy management interface that would be awesome. And if this tool is cross-platform (Linux / MacOS / *nix), that will be a miracle!   I have searched the web and so have found nothing suitable. We are open to any suggestions. Thank you.  EDIT: This question has been incorrectly marked as a duplicate. The linked to answer only talks about having same homedirs on all systems, whereas we need to have different homedirs based on what system user is currently logged into(MULTIPLE homedirs). Also access needs to be granted only to some machinees not the whole lot. Mods, please understand the full extent of the problem instead of merely marking it as duplicate for points...
46990
B2B Scenario I am trying is that:  The following Roles exists in the system:  Super Admin Super Admin Staff Owner (client) Admin (owner i.e. client and creates admin to define sales counters) Sales Counters  That means there are users who'll create their own sub users e.g.  [FLAG-A] ROLE &quot;SUPER ADMIN&quot; creates a ROLE &quot;Owner&quot; and &quot;OWNER&quot; creates its own sub users ROLES i.e. &quot;ADMN&quot; &amp; &quot;SALES COUNTER&quot;. Each role obviously has its info to login to the system I tried to design database as following:  In this diagram I am assuming that main user creates sub user that in my view many to many relationship so I have to add table between them as &quot;USER_PERSON&quot;. Problem is to set &quot;WHO CREATED USER&quot; in the system. I mean which user has created sub user as described in [FLAG-A]  Please check this diagram
99639
We got multiple small websites (microsites) and one main high traffic one with big users base. Right now the requirement is to build authentication system which should allow users to loign with the same identity across the network.  All website are running on different domains, powered by Drupal 6 CMS and have separate databases (so sharing tables with prefix is not an option + it creates a huge mess in the db).  Here is the set of core requirements I came up with:   Users should be able to login with the same credentials to all sites within the network User’s data sharing between Main site (storage) and all micro sites within the network Data synchronization across the network when user changes the data (update email or password for example) The login/registration process should be seamless and consistent Register on any of the sites across the network and use that identity to login later on.   In the future there might be a need to add openid authentication options.  Basically we are looking at something similar stackexchange does, but not sure if they have central users base on not.  I was thinking about custom solution which will include 2 parts (modules), one will be stored on the Main site for users data storing and responding to requests from clients. Second part (module) will be placed on each microsite, which is going to send requests to the Master. Some kind of client - server setup.  One of the complications I see right away is #3. Data Synhcronization across the network.  I just don't want to reinvent the wheel and maybe some work is already done in this direction.  Looking forward to your ideas on how to approach this project.  EDIT:  Recently I've found couple related threads on the topic:
81924
I'm trying to find the best way for a basic security system for a website.  I know I want users and groups.  I thought I'd have:  user_table user_id user_name ...  group_type group_id group_name parent_id ...  group_table id user_id group_id   First one is the user, second one is the group, and the third one is the intermediary table that connects the two.  One user has many groups.  Does this sound ok?
104197
When i create new User Account and login with that credentials, it gives me this problem if admin doesnt have set thier values yet !!!**  AllotmentList = [select id, Days_Remaining__c from PTO_Allotment__c where Year__c =:year and Employee__c=:EmployeeList[0].id LIMIT 100]; //access only Current user Allotment details                 //to handle Listoutof Bound Exception wrote if-else          if(AllotmentList.size()&gt;0)         {         requests.PTO_Allotment__c=AllotmentList[0].id;         requests.Days_Remaining__c=AllotmentList[0].Days_Remaining__c;         }         else         {             //write a code when AllotmentList is empty ....         }
40092
I have a monitoring server that requires the SSH connection details of a non-sudo user account of each box it monitors. Is there a way that I can configure a specific user account such that it can only be logged into from a specific IP (or better yet hostname)? I do not want to restrict the ability of other users on the server to be able to connect from other addresses (otherwise I'd just use a firewall), or .
100386
I know that in the end it, can't be done.  But, what are the options to:    &nbsp; a) limit the options for persons to create multiple accounts, &nbsp; b) increase the chance of detecting multiple accounts / person    for a blog-like web service? (people can sign up for their own blog)  Update: I think the 'limit the options' has been answered nicely. (there is no reliable method, but we can raise the bar) However, I would still like to know what other options there are to detect multiple accounts?
81358
we use a lot of Linux-Servers with active-directory membership for user-authentication. This are made with the likewise-open packet. We tested the beta-Version of ubuntu Server 14.04 LTS. Everything works fine after one minute (install, domain-join, import registry, edit sudoers, done). Now, from beta to production-release likewise-open is removed from repository.  Is there any equivalent easy way for AD-domain-join and (AD-)group-based login-management (without manually installing and editing config-files for samba, winbind, nsswitch, pam etc....?  thanks a lot Silvio