Clarity

Expand all | Collapse all

Reassigning OBS security via XOG

Jump to Best Answer
  • 1.  Reassigning OBS security via XOG

    Posted 11-03-2014 10:46 AM

    I have a process that builds out a resource management OBS and then XOG's it in.

     

    Part of the OBS assigns OBS level security to managers like this:

     

     

                      <unit code="B66486" name="B66486 -DOE, JOHN">

                        <associatedObject objectCode="A71847" objectType="resource" />

                        <associatedObject objectCode="A71960" objectType="resource" />

                        <associatedObject objectCode="A71976" objectType="resource" />

                        <associatedObject objectCode="A72170" objectType="resource" />

                        <associatedObject objectCode="A72200" objectType="resource" />

                        <associatedObject objectCode="B80116" objectType="resource" />

                        <associatedObject objectCode="B83727" objectType="resource" />

                        <associatedObject objectCode="C48939" objectType="resource" />

                        <Security>

                          <UserSecurity rightCode="ResourceApproveTime" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

                          <UserSecurity rightCode="ResourceEditCalendar" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

                          <UserSecurity rightCode="ResourceHardBook" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

                          <UserSecurity rightCode="ResourceEnterTime" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

             

                        </Security>

                      </unit>

     

    And this generally works.  The user JOHN DOE gets OBS unit and descendant rights to the B66486 - DOE, JOHN node.

     

    Now, we want to add a right so that the user can have full edit rights over the resource.  So, I added the following node to the Security section:

     

              <UserSecurity rightCode="ResourceEditFull" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />



    But when I re--run the XOG, the Resource Edit right does NOT get applied to the resource.

     

    Now, I do have the complete="true" option set in the obs element:

     

      <obs description="Resource Manager OBS" code="BBT_RESMGR_OBS" name="Resource Management" isSecurity="true" complete="true">

     


    When I run it, the XOG stats show that 317 resources were updated with 0 failures, but the processing time is way too fast - like 1 second, whereas if the OBS has to be built from scratch, it takes about 4 minutes.

     

    So what else am I missing here?

     

    I'd like the OBS structure to be completely rebuilt so that it catches all of the changes when it runs.

     

     

     





  • 2.  Re: Reassigning OBS security via XOG

    Posted 11-03-2014 11:17 AM

    Can you remove the rights and re-add them?

     

    Also, have you checked this ?

     

    https://communities.ca.com/message/100516969#100516969

     

     

    NJ



  • 3.  Re: Reassigning OBS security via XOG

    Posted 11-03-2014 01:34 PM

    Manually removing the rights defeats the purpose of what we are trying to do.

     

    If I blow away the OBS and rebuild it from the script the additonal rights come in. 

     

    Also using the complete=true flag will in fact rebuild the OBS structure itself but does not update the security rights. 

     

    I tested changing my resource manager to someone else and re-ran the process and the OBS updated to move me under the new person, but DID not update the security rights attached to that person.



  • 4.  Re: Reassigning OBS security via XOG

    Posted 11-18-2014 03:56 AM

    Were you able to find a solution for this ?

     

    Would be great if you can share the solution

     

    NJ



  • 5.  Re: Reassigning OBS security via XOG
    Best Answer

    Posted 11-18-2014 07:57 AM

    It looks like this is a bug in 13.3 that affects large OBS's with several levels.  It doesn't seem to be an issue when you have a simple 1 or 2 level OBS but mine is 10 levels.

     

    I did find a workaround however!

     

    You have to first uncheck the option to use the OBS for Access Rights and then in your XOG set isSecurity=true to reapply the use for access rights.

     

    Programaticaly, I am doing this via a stored procedure as I copied the code from the core XML files - there are 3 SQL statements that need to be executed to remove OBS security:

     

     

                UPDATE prj_obs_types

                SET is_security = 0,

                last_updated_by = 1,

                last_updated_date = GETDATE()

                WHERE id = [OBS TYPE ID]

     

     

                DELETE FROM cmn_sec_assgnd_right

                WHERE instance_obs_type_id = [OBS TYPE ID]

     

     

    DELETE FROM cmn_sec_assgnd_right

                WHERE (instance_id IN (SELECT id FROM prj_obs_units WHERE type_id = [OBS TYPE ID]) and instance_type in

                ( select lookup_code from cmn_lookups where lookup_type = 'OBS_UNIT_ASSOCIATION' ) ) or (principal_id IN (SELECT id FROM prj_obs_units WHERE type_id = [OBS TYPE ID] 

     

    ) and principal_type in

                ( select lookup_code from cmn_lookups where lookup_type = 'OBS_UNIT_ASSOCIATION' ) )

     

     

    This is my own workaround and not an official one from CA Support though I did show it to a CA tech person that is working with us on our implementation and he seemed to think it should work.

     

    My testing has been positive so far - basically I call my SP that handles these 3 SQL updates and then proceed to XOG in the new file and it works as I expected.



  • 6.  Re: Reassigning OBS security via XOG

    Posted 11-18-2014 11:18 PM

    Thanks for sharing this

     

    NJ