User Permissions

Joshua_Walker

Im doing some testing with Action log comments with Change request. When i add a comment with the End user, i get 



WebConsole.log shows:

2016-06-08 12:05:46,744,Microsoft.EnterpriseManagement.Common.UnauthorizedAccessEnterpriseManagementException: The user ADDCAP\Formation does not have sufficient permission to perform the operation.

Im guessing the permissions are User Role in the  SM console but i dont know which one...? Domain user group is part of the End User Role already

merlenette_jones

If you navigate to SCSM>>Admin Tab>>User roles>> access the user role you are using>>navigate to the Queues tab. Is your CR queue selected within that user role?




Merle

merlenette_jones

You could try implementing a different role. Such as Change Managers can create and edit change requests and activity work items (such as review activities and manual activities) that are in their queue scope. Change Managers also have read-only access to other work items that are in their queue scope and to configuration items that are in their group scope.

The task section as I have not configured a role for granularity would be more of a trial an error based on the definition of the task

merlenette_jones

Joshua_Walker said:

Im doing some testing with Action log comments with Change request. When i add a comment with the End user, i get 



WebConsole.log shows:

2016-06-08 12:05:46,744,Microsoft.EnterpriseManagement.Common.UnauthorizedAccessEnterpriseManagementException: The user ADDCAP\Formation does not have sufficient permission to perform the operation.

Im guessing the permissions are User Role in the  SM console but i dont know which one...? Domain user group is part of the End User Role already

Hello Joshua,

Since you are using CR's are your end-users scoped to have access to the queue that contains the CR's

Merle

Joshua_Walker

merlenette_jones said:

Joshua_Walker said:

Im doing some testing with Action log comments with Change request. When i add a comment with the End user, i get 



WebConsole.log shows:

2016-06-08 12:05:46,744,Microsoft.EnterpriseManagement.Common.UnauthorizedAccessEnterpriseManagementException: The user ADDCAP\Formation does not have sufficient permission to perform the operation.

Im guessing the permissions are User Role in the  SM console but i dont know which one...? Domain user group is part of the End User Role already

Hello Joshua,

Since you are using CR's are your end-users scoped to have access to the queue that contains the CR's

Merle

Ah..that might be the problem...do you have a link to some steps i could follow. I have done scoping but im not totally confortable with doing proper scoping.

merlenette_jones

If you navigate to SCSM>>Admin Tab>>User roles>> access the user role you are using>>navigate to the Queues tab. Is your CR queue selected within that user role?




Merle

Joshua_Walker

Ah ok...i  will make one...i think that is what is missing...Since I dont have a for Incidents or Service Requests i didnt know i would need one for CR. Does the queue need anything specific in filter besides Active CR?

merlenette_jones

Joshua_Walker said:

Ah ok...i  will make one...i think that is what is missing...Since I dont have a for Incidents or Service Requests i didnt know i would need one for CR. Does the queue need anything specific in filter besides Active CR?

You can set the criteria to whatever you like but "Active CR" would be the easiest to test what you are looking to accomplish then you can tinker more with the filtering once you are more comfortable with the configuration

Joshua_Walker

ok..i have the queue set..now what?

merlenette_jones

You will need to recycle the cachebuilder service to rebuild user access to that queue

Joshua_Walker

nope...still the same error

merlenette_jones

So because the end use role is limited in scope I would suggest using an Advanced operator role and scoping that role to the level of access you would like them to have. End Users can use the self-service portal to create incidents, request software installation, view announcements, and search the knowledge base. Whereas Advanced Operators can create or edit any work items that are in their queue scope and any configuration items that are in their group scope. They can also create, edit, and delete the announcements that are displayed on the Service Manager Self-Service portal.

Joshua_Walker

ok.. will try that and get back to you

Joshua_Walker

But if i use Advanced Operators, i cant just select the CR queue i made since it is built in?

merlenette_jones

You'll need to create a custom role based of the Advanced Operator role. The OOB roles don't allow you to edit them

Joshua_Walker

My users dont have SCSM console on there machines but i dont want them to be able to edit fields of a opened ticket in the cireson portal except for adding attachments and adding action log. Do you know if there is a task i can scope them too instead of selecting all in the Adv Op Role?

merlenette_jones

You could try implementing a different role. Such as Change Managers can create and edit change requests and activity work items (such as review activities and manual activities) that are in their queue scope. Change Managers also have read-only access to other work items that are in their queue scope and to configuration items that are in their group scope.

The task section as I have not configured a role for granularity would be more of a trial an error based on the definition of the task

Joshua_Walker

thanks, will try it out and post my findings.

Joshua_Walker

Seems good and they dont seem to have access to the rest of the form which is what i want! 

Thank Merl

merlenette_jones

Good to hear!!! Glad I could help you out. 

Candice_Yeudall

Question about this...

Is a custom form being used here? Or are you just using the CR that comes build in? If you are using the built it have you tested with all the other WI to make sure that there are no adverse affects.

Joshua_Walker

Its built in (if your refering toto the portal forms)...nothing else seems to have changed