Reassigning OBS security via XOG

[Rob-BBT]

I have a process that builds out a resource management OBS and then XOG's it in.

 

Part of the OBS assigns OBS level security to managers like this:

 

 

                  <unit code="B66486" name="B66486 -DOE, JOHN">

                    <associatedObject objectCode="A71847" objectType="resource" />

                    <associatedObject objectCode="A71960" objectType="resource" />

                    <associatedObject objectCode="A71976" objectType="resource" />

                    <associatedObject objectCode="A72170" objectType="resource" />

                    <associatedObject objectCode="A72200" objectType="resource" />

                    <associatedObject objectCode="B80116" objectType="resource" />

                    <associatedObject objectCode="B83727" objectType="resource" />

                    <associatedObject objectCode="C48939" objectType="resource" />

                    <Security>

                      <UserSecurity rightCode="ResourceApproveTime" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

                      <UserSecurity rightCode="ResourceEditCalendar" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

                      <UserSecurity rightCode="ResourceHardBook" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

                      <UserSecurity rightCode="ResourceEnterTime" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

         

                    </Security>

                  </unit>

 

And this generally works.  The user JOHN DOE gets OBS unit and descendant rights to the B66486 - DOE, JOHN node.

 

Now, we want to add a right so that the user can have full edit rights over the resource.  So, I added the following node to the Security section:

 

          <UserSecurity rightCode="ResourceEditFull" rightMode="OBS_UNIT_AND_CHILDREN" userName="B66486" />

But when I re--run the XOG, the Resource Edit right does NOT get applied to the resource.

 

Now, I do have the complete="true" option set in the obs element:

 

  <obs description="Resource Manager OBS" code="BBT_RESMGR_OBS" name="Resource Management" isSecurity="true" complete="true">

 

When I run it, the XOG stats show that 317 resources were updated with 0 failures, but the processing time is way too fast - like 1 second, whereas if the OBS has to be built from scratch, it takes about 4 minutes.

 

So what else am I missing here?

 

I'd like the OBS structure to be completely rebuilt so that it catches all of the changes when it runs.

 

 

 

[navzjoshi00]

Can you remove the rights and re-add them?

 

Also, have you checked this ?

 

https://communities.ca.com/message/100516969#100516969

 

 

NJ

[Rob-BBT]

Manually removing the rights defeats the purpose of what we are trying to do.

 

If I blow away the OBS and rebuild it from the script the additonal rights come in. 

 

Also using the complete=true flag will in fact rebuild the OBS structure itself but does not update the security rights. 

 

I tested changing my resource manager to someone else and re-ran the process and the OBS updated to move me under the new person, but DID not update the security rights attached to that person.

[navzjoshi00]

Were you able to find a solution for this ?

 

Would be great if you can share the solution

 

NJ

[Rob-BBT]

It looks like this is a bug in 13.3 that affects large OBS's with several levels.  It doesn't seem to be an issue when you have a simple 1 or 2 level OBS but mine is 10 levels.

 

I did find a workaround however!

 

You have to first uncheck the option to use the OBS for Access Rights and then in your XOG set isSecurity=true to reapply the use for access rights.

 

Programaticaly, I am doing this via a stored procedure as I copied the code from the core XML files - there are 3 SQL statements that need to be executed to remove OBS security:

 

 

            UPDATE prj_obs_types

            SET is_security = 0,

            last_updated_by = 1,

            last_updated_date = GETDATE()

            WHERE id = [OBS TYPE ID]

 

 

            DELETE FROM cmn_sec_assgnd_right

            WHERE instance_obs_type_id = [OBS TYPE ID]

 

 

DELETE FROM cmn_sec_assgnd_right

            WHERE (instance_id IN (SELECT id FROM prj_obs_units WHERE type_id = [OBS TYPE ID]) and instance_type in

            ( select lookup_code from cmn_lookups where lookup_type = 'OBS_UNIT_ASSOCIATION' ) ) or (principal_id IN (SELECT id FROM prj_obs_units WHERE type_id = [OBS TYPE ID] 

 

) and principal_type in

            ( select lookup_code from cmn_lookups where lookup_type = 'OBS_UNIT_ASSOCIATION' ) )

 

 

This is my own workaround and not an official one from CA Support though I did show it to a CA tech person that is working with us on our implementation and he seemed to think it should work.

 

My testing has been positive so far - basically I call my SP that handles these 3 SQL updates and then proceed to XOG in the new file and it works as I expected.

[navzjoshi00]

Thanks for sharing this

 

NJ