I want to create an OAuth Application for my development purposes. But I am stuck in the problem. I do not know how to create this Application for my organization (for internal use only). Where can I find my organization or how can I create my organization and place there my projects (with internal scope).
As you understand I want to skip submitting my app for a review. How could it be properly done?
GCP Organization resource is the root node of the GCP (Google Cloud Platform) resource hierarchy and all resources that belong to an organization are located under the organization node. An Organization resource is automatically created when user associated with a G Suite domain creates a project or billing account. Each G Suite account is associated with exactly one Organization. Also Organization is associated with exactly one domain, which is set when the Organization resource is created. So you don't need to create organization by yourself if you're a G Suite customer because Organization resource has been provided to you automatically.
Please refer to this article for more information about Managing Organization and getting info about it.
As for creation of G Suite application for internal usage only it's quite simple. You just need to create regular project as described here and setup G Suite Marketplace SDK API. The most important thing before publishing you application to Marketplace is that you should set Visibility option value to "My Domain" (application will be only available to users at inside your domain) as described here. Please note that this option can't be changed after saving the configuration. If you set Visibility option value to "My Domain" for you G Suite application verification process is skipped by Google while publishing this application and you can easily use it for testing purpose inside and only inside you domain.
Related
I am writing a .NET desktop app that uses the Microsoft Graph API to access the contents of my OneDrive for Business storage. I am logging in to Graph using my Microsoft work/school account U1, in my organization O1. Another Microsoft work/school account, U2, in a different organization, O2, has shared a folder with me. The folder shows up in "Shared With You" when I browse my OneDrive interactively in a browser, and I can make changes to the folder there. It also shows up as a DriveItem in the returned list when my app uses the "sharedWithMe" API call documented here (with allowexternal set to true).
All good so far. The problem is when I try to actually retrieve the shared folder using the returned DriveItem. I am following the guidance in the doc page to use a call like
GET /drives/{remoteItem-driveId}/items/{remoteItem-id}
to retrieve the folder, and I have the "Files.ReadWrite.All" permission. I believe I am doing this correctly in my code, because it works fine on other items shared with me by users in my organization. However, with the folder shared by U2, this call fails with an "itemNotFound" error. I don't understand why this fails. Is this a problem with my code, or some configuration that needs to be done in my organization O1, or in their organization O2, or a combination? Or is what I'm trying to do just not possible across organizations?
I have found a couple other folks who have had similar problems, but the resolutions are inconclusive: see here, here, and here. These links have suggested a couple directions:
could this be a problem with some sharing setting on the part of organization O2? Unfortunately I don't have any control over this org. But if I can give them a clear request, preferably with some Microsoft docs to back it up, I think they would be receptive. For example, does organization O2 need to add/invite my account U1 as an external/guest user to their Azure AD? I don't know for sure if they've done that.
one of the comments suggested that my app would need to be a multi-tenant app for it to access resources in another tenant. I do not want my app to be multi-tenant in the sense of allowing people in other tenants to login to it, but I do want my account to be able to access resources in other tenants that have been shared with me. I tried changing the app registration for my app to multi-tenant, and that didn't make any difference.
in the multi-tenant vein, I found this Microsoft doc, which states "In the code of your multi-tenant app, get the authentication token for other tenants and store them in the auxiliary headers. The user or application must have been invited as a guest to the other tenants." In my code I am using Microsoft.Identity.Client.PublicClientApplicationBuilder to sign my account in and get an access token, using the authority for my tenant. It sounds like my access token is only valid for resources in my tenant - how do I get a token for another tenant in my code?
Thanks very much for any suggestions, be they pointers to docs, code suggestions, etc!
I am stumped trying to find a similar idea on how we can achieve this.
We are currently using a model-driven power app/Dataverse to house school applications. Once an application is submitted, our representatives will begin updating the application record "Application Status" custom field as they are going through the various steps.
Our partner wants to create a external website (just simple HTML/CSS/JavaScript) to display an application lookup where applicants can type in their application ID or send applicants direct-links to view the status of their application. (example: domain.com/application-status/?appid=1234)
This external, public website would have to connect to our dataverse/power app via the web api to make the request and display it to the applicant searching/viewing the website.
How can this be achieved? All I have read is that the user looking up data will need to have a Microsoft account and authenticated in our environment to view the data.
Can someone point me in the right direct on how to get this done (article or existing thread). Your help is highly appreciated.
This is normally being handled by the use of a PowerPlatform Portal.
Portals are designed to allow interactions with B2B/B2C.
This is, however, a hefty price tag.
Another way is to make your website use Rest API calls to your Dataverse tables.
To enable these, you need to create a client application registration in Azure and add this application user in your environment as an application user. Once registered, assign the appropriate rights(Sysadmin, Syscustomizer, whatever you want) and you can access your environment in two steps:
Generate an access token based on the scope of your environment, client id, and client secret.
Use the access token your application user has given to do your CRUD operations.
What is the benefit of implementing Active Directory based Security to servers like Jenkins?
The only benefit I can think is the admin of the sever does not need to add/remove users because user can login themselves using AD credential.
But In my case I do not want to have the whole company access my server. the server is only used by my team. How can I disable the whole company from login in. (case1)
Besides, I want to grant different permissions to different members in my team. The new members get less permission, the experienced team members get more permissions. I believe this is very common. But using Active Directory based Security looks like they get the same permission because they are in the same groups (case2)
So why should I use Active Directory based Security? Can I resolve the above two cases in a server configured with Active Directory based Security?
Some corporate environments make this a security requirement. In said environments they usually have an internal request system where users can request they have their credentials added to an appropriate group for access to Jenkins. This is better than Jenkins own database and having them email you, the Jenkins administrator.
Once AD Authentication is configured in Jenkins and appropriate groups created in AD you can do a one-time setup of those groups with the Role-Based Strategy plugin in Jenkins and define what those groups have authorization to do.
Plan your groups well and it is a function that you will no longer have to worry about.
Warning: Be very careful when switching over from Jenkins own database user authentication to AD authentication. If you don't get the BindDN details just right you can get locked out.
I have two projects in JIRA: software project and service desk project.
My goal it to enable my service desk customers to access the software project but in a limited way. E.g.:
clients could create stories,
comment on them,
assign priorities
and assist with assigning them to iterations / releases.
But they would not be able to perform and see some actions e.g.:
see the logged time
and ideally to keep some of the ticket / story fields and comments as internal use only so I can have technical discussions with my team without the client seeing them etc.
I can see in documentation that "Service Desk Customers can't log in to JIRA applications":
https://confluence.atlassian.com/servicedeskcloud/setting-up-service-desk-users-732528877.html
But is there any workaround to give Service Desk Customers access to JIRA applications? Is there any simpler method than making a REST API bind? If yes, then how it could be achieved?
The documentation is not clear. Add their accounts to the jira-users group and they will be able to log into JIRA as regular users. The point is that member of jira-users consumes a JIRA user license, while "pure" customer account does not.
As regular regular users they will have permissions just as you configure your project Permission Scheme, so everything is in your hands. Using roles you can restrict issue comments to those roles. There's also nice Comment Security Default plugin to use with that.
Is it possible to configure an access policy that would allow the job creator (or less preferably anybody with access to the project) access to the created instances, without granting similar access to the rest of the machines in the Google Cloud project (e.g., production machines)?
Thanks again,
G
The access policies that you define for the project are carried over to the instances backing up a job submitted in that project.
Details on the policies and related actions are outlined in the GCE documentation: https://cloud.google.com/compute/docs/access
Cheers,
r