Access right problem - Project Edit

[MatthewPalicki]

This should be a simple solution, but growing frustrated trying to resolve it. I need to identify which Global Access Right grants the ability to edit the "Active" (Y/N) attribute on the Project Object.

 

I'm using one shared "admin" account to edit project information from the Projects List View. I can edit literally any attribute I add to the list view - except "Active".

 

I add this user account into our "All Rights" group, and retry, and then I CAN edit "Active". The problem is, I have been unable to ascertain which additional right that is granted through my "All Rights" group that gives the proper permissions. I already thought we had added all relevant sounding Edit/Project/Management rights to this user account. But obviously we are missing something. The "All Rights" group has over 400 individual rights in it, and I really do not feel like going through them one at a time.

 

I had a ticket with CA support and they were unable to answer this, and suggested I try the Communities.

 

Thanks

[Legacy User]

I assume that by editing you mean that the Active box is checked, its grayed out and you can't uncheck it.

 

If my assumption is correct, know that you can't make a project inactive if Financials are still active on the project.

 

To check if Financials are active, go to Properties\Financial subpage and make sure Financial Status is set to Closed, then save.  Go back to Properties\General page - Active box should now be editable.

 

I'm unaware of any right specific to the Active checkbox alone.  In fact, we've been asking for this kind of "field level" security for years - CA PPM doesn't have it.

 

Another scenario might be that a process has the Active field locked.  If a process has locked the field, a small 'pad-lock' icon should appear next to the field.  For this, you'll need a process to unlock (remove the pad-lock) the field.

 

Dale

[MatthewPalicki]

Thanks Dale for the reply. I'm actually talking about the ability to perform in-line editing of the attribute (Yes/No) from the Projects List View. Its nothing related to financials or anything like that, because as stated; it works when the user is in the "All Rights" access group, but does not when they are removed from that group.

[Legacy User]

Got it.

 

The last response from Urmas is one that we have used (Check Resource's Group).  Works well, for us.

[Nick Darlington]

My first thought would have been to check whether or not the attribute was enabled for editing on the grid (there are fields with this option available), but since you can edit it when placed in another group of rights, my next suspicion would be that at either project or program level, you may have placed this attribute into a secured subpage - in which case you could end up conditionally only having view access to the attribute instead.

 

So I would be thinking to check your subpages on the program and project property edit views and see which ones are having the Secured checkbox set, and then check those rights/permissions accordingly.

[MatthewPalicki]

Thanks Nick for the reply. Yes I did check to ensure it is accessible for grid editing, and as you noted it works fine when added to another Access Rights group.

 

You are also correct that within the Project Properties, I have the Admin attribute placed on a subpage that is not accessible to all users. So I also suspected something to do with these permissions. But likewise, I could not find determine what it is about this "All Rights" group that allows the user to inline edit the attribute when they are in that group, but denies access when they are removed from that group.

[MatthewPalicki]

Nick I think you are probably spot on:

 

On the PROJECT OBJECT,

 

The “Active” attribute is placed onto a subpage, “IT Administration”.

 

This subpage has a display condition securing its access: ( checkGroup( "cats_all_rights", ctx, "EQUALS" ) )

 

In other words: Check Resource's Group = 'OI - All Rights'

 

 

To me, this is a logical and perfect explanation for what we are seeing. When the NPD.ProcessAdmin user is IN the All Rights group, they have inline edit access to this attribute, because they have access to the secured subpage on which it is placed. When they are removed from that group, they lose the access to the subpage, and thus, the attributes contained therein.

 

 

Here’s my problem: I don’t want to keep the NPD. ProcessAdmin user in that All Rights group. And I cannot figure out how to append the Expression in the display conditions. I am not how that original display condition was derived – I can find nothing in the expression builder that lets me build expressions such as “checkGroup”. Ideally, I would like to just append what is there by adding “OR Resource = NPD.ProcessAdmin”.

 

 

 

Help!

 

[Deactivated User]

Just to go back to the original question these are the rights that will do that.

[Deactivated User]

Say you have

Click the drop down to select OR from And/Or

Make sure the the radio button next to operation is checked

Then you have the options available which open when you open the drop down for Operation

There is no Resource option available, The partition is no good in this case neither does the OBS sound good. How about creating a group for that?

That is fairly simple compared to other options.

 

or just type it to the end ( checkGroup( "ApplAdminRl", ctx, "EQUALS" ) ) ||  ( checkGroup( "ID_of_you_new_proc_admin_group", ctx, "EQUALS" ) )

 

The options in Object are related to the Project object and are hard to relate to users.

 

(Edited just to fix another of those typos)

[MatthewPalicki]

Boom. You nailed it. I was missing that the "Operation" dropdown selector does not appear until after you try to start building an expression off of Project Object. I appended the display condition to add the access right group which my user account is already a member of. This did, in fact, resolve the inline edit restriction issue.

 

Thanks!!

[Deactivated User]

Yeah that is (just) one of those spots in CA PPM where you don't see  and don't have and understading of the options a selection offers until you actually make a selection a proceed.