Security and access FAQ — page 7
All FAQ topics / Security and access
296 questions · page 7 of 8
A History Log KEYS column stores a composite string like `COMPANY=01^LUMP_SUM_TRANS_ID=2^MIXED_PAYMENT_ID=4637^MIXED_PAYMENT_LEDGER_TRANS_ID=25^`, and each named value's length varies record to record (some are 1 digit, some are 2), so a fixed-position SUBSTRING approach no longer reliably extracts them — how is each named value extracted regardless of its length?
An AD account occasionally gets locked out after intentionally logging in via Database authentication (bypassing LDAP for IT troubleshooting purposes), with the system continuing to repeatedly retry AD authentication for that account even after logging out — restarting the middleware is the only fix found so far. Is there a less disruptive alternative to a full middleware restart?
In Apps9, users saw a popup warning when their account was approaching credential/password expiration (a grace-period notice); in Apps10, with the same user-profile setup, no such warning appears at all. Is there a setting to restore this behavior?
History Log entries exist for a core framework table (like FND_CLIENT_LOGON_TAB), but that table's Logical Unit doesn't appear at all in the normal Setup History Log screen. How do you actually reach History Log entries for a framework-level table like this?
Assigning additional Permission Sets to a user account (typically for executive/high-access positions needing broad system access) eventually produces 'Maximum of 148 enabled roles exceeded,' and recreating a single consolidated permission set with all the same functional roles attached doesn't fix it. What's actually causing this, and what are the real options short of giving the user IFSAPP_FULL?
Trying to access the IFS Middleware Server Admin Console (needed to configure REST-service authentication) fails with 'User Not Allowed' for every account tried, including IFSAPP and other full-admin application accounts — even though those same accounts work fine in both Enterprise Explorer and Aurena. What account should be used instead?
A user needs to be able to re-print/re-order a report from Archive that was originally generated by a different user, and gets an access error trying to do so. What setting actually needs to be granted for this?
Changing the password for IFSAPP (the application owner account) through the login screen returns 'IFS Application Owner can not be changed using this method' — how is the IFSAPP password actually changed?
When setting up Permission Sets for Aurena users, what overlaps and differences are there with Enterprise Explorer's own security setup — is Aurena security fully self-contained, does it affect IEE access too, and is there a way to grant one universal CRUD-access setting that applies to both clients at once?
Is there a way in Aurena's Permission Sets (via Projection Grants / Entity Action Grants) to allow Update access to a specific entity while specifically disallowing Create and Delete — the way Enterprise Explorer supports granting Modify-only access while revoking New/Remove?
A custom RMB menu item added to a screen (e.g. Sales Quotation Line) needs to be restricted to only a specific group of users — going into Custom Objects and using its Grant option doesn't seem to expose anywhere to actually revoke or grant access to that specific custom menu. How is this actually done?
Some users can't log in and get 'IFS account is already logged in by...' even though no matching session can be found by searching Solution Manager's Database Sessions monitor, or by querying fnd_session_runtime / v$session / gv$session directly — restarting their machines doesn't help. How is this stale-session lock actually cleared?
Is it possible to make a REST API access token last longer than the default 3,600 seconds, and if so how?
Using `CC_CASE_API.Accept__` to accept a Call Center Case on behalf of a different user than the one currently logged in — is there a supported way to do this, and is there anything important to be careful about?
A Custom Event on Inventory Part In Stock, meant to restrict certain users to only their default site while letting a designated second group of users also work across additional allowed sites tracked via a custom multi-site-allowed field, works correctly for the first group but incorrectly blocks the second group from transacting even on their explicitly allowed additional sites.
Trying to grant a specific database object (like a change-password database object) to the FND_RUNTIME permission set, following IFS support guidance for a password-change issue, the RMB Grant option simply isn't available on that permission set.
Authenticating users through Azure AD on IFS10, with the user's Directory ID synced from LDAP as their UserPrincipalName, fails with an unhandled 'object reference not set to an instance of an object'-style error. What actually causes this specific error?
On the 'Grant Permission Set to User' screen, is there a way to filter one column, like Permission Set, to multiple specific values at once — neither commas nor semicolons work as a separator in the normal 'contains'-style filter?
Is it possible to schedule a task that automatically deactivates a specific list of users at a given time and reactivates them again later?
After hiding some columns on the Documents/Attachments tab via changes made to the Base Profile for a screen like Shop Floor Workbench, users with a disabled Personal Profile now see an error every time they log in and open that screen — turning Personal Profiles back on for those users avoids the error, but that isn't the desired configuration.
In Apps10, the IFS EE login dialog doesn't remember the last logged-in username, unlike some older versions — is there a setting to re-enable this?
A permission set has been configured with what looks like the correct grants to let a user create Custom Menu items, but the user still can't create one. Why?
Logging into Aurena produces an error for users on most permission sets, but users granted an app-owner-level permission set can log in without issue — what's the underlying difference causing this?
Is it possible to change the password for internal system users like IFS CONNECT, and other internal Foundation users, across cluster nodes in production, and if so, what are the steps and potential impact?
How do you actually grant a non-FNDADMIN user genuine, working access to the Aurena Page Designer / Navigator Designer — the specific projection names for these designers don't show up anywhere obvious via the debug console or log window when trying to figure out what to grant.
With two separate Base Profiles, is it possible to export ONLY a specific piece of configuration, like column order and layout for one particular form, from one profile and import just that piece into the other, rather than exporting/importing the entire profile wholesale?
Using the Change Password option in IEE works fine for changing IFSAPP's password, but fails with an error for any other user granted FND_CONNECT. Is there a setting or parameter that needs to be enabled to make self-service Change Password work for ordinary users?
A user with confirmed Change Management permission-set access, able to navigate and use the module's standard features directly, still can't see a Change Request that's connected to another screen, like Inventory Part, via Object Connection — even though a fully-privileged user can see the same connected object fine.
Is there a way to disable the Find and Replace RMB function for specific users in Enterprise Explorer, to prevent accidental bulk changes — the Debug Console doesn't point to any obvious item to restrict on a given Permission Set for this.
Clicking the Crystal Runtime Files link under Add-ons returns '{"error":{"code":"SE_UNAUTHORIZED","message":"Insufficient privileges."}}' — what permission needs to be added to download the Crystal runtime files needed to run Crystal Reports through Enterprise Explorer?
Is there a standard way, similar to Authorization Combination Rules or Authority Combinations, to restrict who can see budget figures, for example when displaying budget numbers to Department Managers in a Lobby?
How do you configure a Permission Set so a user has read-only access to a specific IFS screen, able to search but not save or create new records, rather than full CRUD access?
How do you enable Single Sign-On authentication on IFS Applications 8 SP1?
A permission set still can't grant access to the 'sticky notes' feature on a screen like Employee Equipment Card, even after granting the 'Activity' 'ManageNotes' permission.
A permission set lets a user go directly to the 'Report Shop Order Operation' screen and do everything needed there, but the RMB menu option 'Report Operations...' on the Shop Order screen itself stays disabled for that same user. What permissions actually need to be granted to enable that specific RMB option, and is there a general way to figure out which permissions gate a given RMB menu?
A user gets 'You do not have privileges to use the Quick_Report_API.Is_Qr_Po_Granted_For_User operation for Quick Report,' even though they've genuinely been granted access to that specific Quick Report.
How do you restrict a specific user to read-only access on a form like Price List or Quotation Line, using Permission Sets?
How do you grant access, for a newly created Permission Set, to a specific Navigator folder — both the ability to create new folders in the Navigator, and access to a specific folder someone has already created?
With multiple companies set up in IFS, GL Balance Analysis works fine for the main company but returns 'No data found' for every other company, even though the same user can open a session in all of them.
No questions match. Try a broader term or reset the filters.