Security and access FAQ — page 2
All FAQ topics / Security and access
296 questions · page 2 of 8
Following Microsoft's SCIM configuration documentation for Entra ID, the "3. Provision User Accounts" step doesn't appear as an available option.
Where are the access permissions for a Tabular Model created in IFS Cloud actually managed, since there's no obvious IFS screen for it?
When provisioning users into IFS Cloud through Azure/Entra ID user provisioning (SCIM), is there a way to prevent a new Person record from automatically being created alongside the User record?
SCIM/Azure AD SSO is configured, but users can still log in with a plain username and password in addition to "Log in with SSO," even though the intent was to restrict authentication to Azure AD only.
Users intermittently fail to log in with a `DB_SWITCH_SESSION: Could not switch database proxy session to user` error (an ORA-00022 or similar variant), even though all accounts are confirmed granted CONNECT, and the error resolves itself after one or more retry attempts.
Is there a SQL-based way to identify user accounts that haven't logged in for a long time (to find inactive accounts), without enabling full database auditing?
Is there a way to automatically grant a default Permission Set to users as they're provisioned into IFS Cloud through Azure AD SCIM, rather than needing to assign it manually after each user is created?
"User with * Person ID is not allowed to create new documents" appears for a specific user account, like the application-owner user — how is this resolved?
A specific projection's REST API documentation/endpoint is inaccessible under the Compatibility Application Type used for integrations ("Int"), returning a login prompt that doesn't accept any valid credentials, even though the same projection works fine under the default ("Main") application type and SSO/login itself works elsewhere.
Is it possible to connect more than one Azure AD tenant to a single IFS Cloud environment — for example, a regular tenant for internal employees and a separate Azure AD B2C tenant for external users?
Is there a way to query a user's actual last-login date/time directly from the database, since IFS Cloud doesn't have the same server-log category that Apps8 used for this?
Is there a log that tracks which pages/screens a specific user has opened or accessed?
How do you assign multiple Functional Permission Sets to a new End User Permission Set?
When provisioning users via SCIM with Azure AD, the auto-generated "Identity" value (built from given name + family name) needs to be a custom value instead — is there a SCIM attribute that can override this?
A permission set's Access Level is set to Read Only for a Resource Monitoring Gantt-style page, but users can still drag to move items and adjust durations directly on the Gantt.
Is there a way to query which Permission Sets are granted to which Users directly through a projection API, rather than checking manually through the client?
The debug console / log window shows database trace information when logged in as an admin, but it's suppressed when reproducing an issue as a specific end user. How do I let that user see it too?
Setting up SSO/Azure AD in IFS Cloud for the first time — what's the difference between the 'AD User Mappings' screen and 'Create New Identity Provider', and which one actually establishes the connection to Azure AD?
A quick report runs fine with full access, but users with a specific permission set get 'Insufficient privileges' (SE_UNAUTHORIZED) trying to run it, even though they already have the underlying projection and entity granted. What's missing?
Our on-prem IFS Cloud database server is regularly spiking to ~99% CPU, and a top-sessions check points at IAM-related sessions as the cause. Where should I look?
A system/service account (like the built-in anonymous user) is unexpectedly consuming a Full user license instead of showing no license usage. What's usually wrong?
Is there a tool or automated way to convert permission sets built in IFS Apps 10 IEE (Enterprise Explorer) into IFS Cloud's projection-based permission sets when upgrading?
Direct ODBC access to the Oracle database is blocked in current IFS Cloud versions — is there still a supported way to read data directly from the database?
Is genuine row-level data security possible in IFS — for example, restricting which Customer records a user can see based on a field value on the Customer record itself — without a full code customization?
Can a Limited/Transaction User (LTU) be converted to a Full license user (and vice versa) without recreating the user, assuming the license limit allows it?
Is there a way to query which Aurena/IEE pages a specific user has access to (via their roles), including the page's translated/localized name rather than just its internal ID?
Only the creator of a Scheduled Database Task (Batch Schedule) can edit it — other users get 'You are not allowed to change this schedule, since it was not scheduled by you.' Is there a permission that lets someone else (who isn't the creator) edit it?
Can IFS Cloud automatically create a new user account the first time someone authenticates via SSO, rather than requiring the user to already exist (via SCIM or AD sync) beforehand?
A custom PL/SQL package's functions aren't all showing up under Database Objects when trying to grant a permission set access to them — some show, others don't, even though they're all in the same package. What's usually missing?
A screen (e.g. a Work Center-style form) only shows 'Media' under Attachments, with no Approval Routing section visible, even though an approval process is needed for that screen. How do you get the Approval Routing section to show up?
Configuring Azure AD as an external identity provider for SSO login works from a setup standpoint, but clicking 'Login with Azure AD' immediately shows an authentication error — before the user even gets to enter credentials. What's a likely cause on a remote/hosted environment?
Is there a way to track who changed a permission set assignment on a user, and when — there doesn't seem to be an obvious History Log setting or event trigger point for this.
Does IFS support IPv6?
Creating a user in Enterprise Explorer/Apps10 had a 'Business Roles' tab for assigning roles like Buyer, Planner, or Requisitioner directly on the user record — where's the equivalent in IFS Cloud's user creation screen?
After an Active Directory domain rename, users' Directory ID and email update correctly on the User Details screen in IFS Cloud, but the associated IAM User account (created for SSO) doesn't change and users can no longer log in with their new AD identity. Is deleting the stale IAM User record the right fix?
After a Cloud upgrade (e.g. to 23R1), users start getting projection access warnings/errors in tools like Report Designer, and checking permission sets shows many projection grants have changed from Full/Read-Only to Custom access level. What caused this, and how do you fix it in bulk?
Granting a user permission set access still results in 'access denied'/'not authorized' when they try to create Event Actions. What specific grants are actually needed?
Adding Sites to a user one at a time via the Sites per User page in Cloud is extremely slow compared to the equivalent screen in Apps V9 — is there a faster way to bulk-add sites to a user?
Is there any risk to changing the passwords on IFS's built-in IFSCONNECT and IFSINFO system accounts, or disabling them entirely?
No questions match. Try a broader term or reset the filters.