How do I resolve the error 'You do not have sufficient permissions to reply to this task.' when trying to reply to an Interaction Request Form from the Assign User Task operator?

[mrab]

This error leads me to ask,

1)  Is there a way to allow the user to reply to the Interaction Request Form without logging into Process Automation? 

I see the following in CA Process Automation Content Designer Reference under the 'Assign User Task Operator':

•  The Assignees parameters specify authorized CA Process Automation users or groups to approve or reject the user prompt. The Assign User Task operator only verifies user credentials when a user or group is specified.
•  When the user receives the email, the user clicks the task URL to continue to the CA Process Automation Login. After authentication, the form that is attached to the task displays, and the user can then directly reply to the task.

 

      Does the first comment imply that no login is required if no assignee parameters have been entered in the Assign User Task operator?

 

2) If the user must login, how does that work?
I have tried executing the steps in tech doc tec602447 to set up a Dynamic User Group policy that includes the 'Product User' policy.
I can see the dynamic group listed for the user under 'Manage Identities' in EEM.

Back on the parameters for the Assign User Task in Process Automation, I have neither a user or a group selected in the Assignee Parameters.  (I don't see any groups to select from anyway).

The user is getting 'You do not have sufficient permissions to reply to this task.' when trying to reply to the IRF.

 

Thanks for your help!

[Michael Niebuhr]

The action within a process design to choose a user to assign a task only checks to see if they are a member in EEM, it does not check to see what permissions that username may or may not have.

The actual permission check is only done when a user accesses the GUI

 

 

The 'Product User' policy only allows for login, it still restricts access to almost all activities other than login.  You will need to ensure your dynamic policy has all the permissions of the 'PamUser' policy: Environment, Library Browser, Operations, Product User, and Reports.

 

 

In Process Automation design you may need to search for the user specifically if it is not coming up.

[mrab]

Hey, thanks for the explanation on the permission checks!

 

I do have the different policies: Environment, Library Browser, Operations, Product User, and Reports on my dynamic policy, but continue to get the same error.

 

On your last comment, how would I 'search for the user specifically' in Process Automation?

[Michael Niebuhr]

To add users to a Task you can either add the names manually in a colon separated format wrapped in quotes:

 

Or click the magnifying glass and search for them specifically:

 

 

These users still have to exist in EEM if you enter them manually, the search option will create the list for you, but it does not automatically show users until they have been searched on.

 

 

 

 

Back to the error -  if you go into EEM and assign the user the 'pamuser' permission policy specifically, does that allow the task to be completed? 

If not then who was the task assigned to?  If a task is assigned to a specific user, only that user or a PamAdmin user will be able to complete that task unless the original user delegates the task to a coworker.

 

For example, If a process assigns a task to 'Bob' but somehow 'Jill' gets the link to that task and tries to complete it Jill would see a similar message about not having permissions unless Bob delegates:

 

 

but, if Jill was a member of the PamAdmin policy in EEM she would have permissions to take and complete, or delegate the task for Bob.

[mrab]

Okay, I see that the user lookup on the Process Automation side is pretty much hard-coding!

 

So on the EEM side, I went ahead and added 'PAMUsers' group under 'Application User Details' to the user getting the error.  I had the admin restart both Process Automation Orchestrator Service, and the EEM iTechnology iGateway service and we still get the same error.

 

Thanks!

[Michael Niebuhr]

So you have 'Username' who is a member of the 'PamUser' policy group, and have assigned the Task to 'Username' but after they log into Process Automation they get a permissions error when they try to complete the task?   If this is the correct steps I assume it should work, I might suggest this will be quicker to sort out if you open a support case.

 

 

 

You can setup Groups, or import groups from your directory server, and use those groups to assign tasks to:

 

Also, the users could be set dynamically, for example if you pull in a request user from Service Catalog that could be used to assign the user based on who opened the case in Catalog:

[mrab]

I was able to get this to work using your last suggestion.  I used the variable for the requestUser in the Assign User Task operator.  This allows the user to login to Process Automation and submit the reply, but is there any way to have it use SSO for this so that the user doesn't have to login?

 

Thanks for answering!  Your replies are helping me understand this better!

[Michael Niebuhr]

If Process Automation is setup to use NTLM they will not need to enter their credentials to access forms.

[mrab]

Yes!  I changed NTLM property in the oasis config properties file to true, restarted the orchestrator and it no longer needs the credentials.

 

Thanks for all your help!!