Team Work View does not show up - but it should

Patrick_Hammer

In the Navigation settings there is a group definied which should see the View.

The user is in the group, but does not see the view "Team Work"

What to do?

Brad_Zima

Patrick,

Has the group been synced to SCSM via the AD connector? Check under Configuration Items - Users to verify it is present. Then check your Cache Builder logs to make sure there aren't any error messages related to the group not being found. If this is an existing group, try running the Users and Groups Sync & Scoped Access Sync jobs under Settings -> Cache Builder Maintenance in the portal. If it is a new group, try adding the group to a dummy announcement in the portal with a publish date in the past. This will sometimes cause Cache Builder to re-evaluate the new group membership.

Patrick_Hammer

Hi Brad and thanks,

I'm back to that problem and checked your points

-> It is no new group, only new member of a group. works for the others

-> Cache Builder has no errors

-> treid resync

-> User is in the Cachbuilder log in debug mode.

-> tried to to make a new announcement

Thank you.

Brad_Zima

Patrick,

Is the user a member of a very large number of groups in AD? I could be that the Kerberos Max Token size is too small.

Does the dbo.CI$Users table show the correct status under the Analyst column for the user?

Patrick_Hammer

It is a nested group, but there are less the 10 ad user in the groups.

The user is in the groups to times. One time with Analyst =1, one time with Analyst =0 (don't know the correct status)

I know switched the Analyst values, since the User originally with Analyst=0 was the new and 1 was old.

The reference user, where it works, has only one line with Analyst = 1 (which I now think should be the correct status)

Now I additionally found the table GroupMembership_CI$DomainGroup_CI$User - there was the the group (found in [CI$DomainGroup]) - and there has been only a link to the wrong user. So I added the link to the new one with an insert directly.

Got feedback, it works now. But was this a fix that lasts?

@Brad_Zima what do you think about that?

tia!

Brad_Zima

Patrick,

I would check under Administration -> Deleted Items to make sure there isn't a duplicate copy of the user object there and, if so, remove the user object from Deleted Items.

After checking, run through the steps outlined in the "A User Has Been Changed Or Removed..." section of the following article to clear out the CI$User table and rebuild it. This should ensure you don't have any duplicate records hanging out in the ServiceManagement database that are giving you access issues.

https://kb.cireson.com/article/how-to-completely-re-sync-data-with-the-cache-builder-in-the-cireson-portal/1142

Patrick_Hammer

Um alle Berechtigungen zu bereinigen, habe ich nun folgendes Statement ausgeführt:

   DECLARE @right VARCHAR(100) = '<Userid GUID goes here>';

   DECLARE @wrong VARCHAR(100) = '<Userid GUID goes here>';

   insert into [GroupMembership_CI$DomainGroup_CI$User] (DomainGroupId,UserId)

   select DomainGroupId,@right from [GroupMembership_CI$DomainGroup_CI$User]

   where userid = @wrong and DomainGroupId not in (

   select DomainGroupId from [GroupMembership_CI$DomainGroup_CI$User]

   where userid = @right)

Brad_Zima

Patrick,

Yes, I suppose you could do it that way as well. The Truncate Table is more heavy-handed but has a similar effect.

Patrick_Hammer

Hi Brad,

Today my changes are gone. So the cache is building wrong. Any ideas on that would ber the truncate table Version better? Or do I have to have a look at the Service Manager tables and change it there?

thanks

Simon_Zeinhofer

@Patrick_Hammer as you have the user twice, has the user changed his/her username or something like that, so the user got created a 2nd time?

We had this situation, when the username got changed, so the user (with the same AD Guid) was created a 2nd time, but that wasn't a problem, as the username was different. What was a problem though, was, that the old user was declared as a reviewer inside an SR template. As we have a script, which creates an SR and applies a template, the reviewer (which did not exist anymore) was created as well. So everytime a request with this deleted reviewer in it was created, the Analyst flag was set back to 0. So what we had to do, was to change the reviewer in the template to the actual new user and the problem was gone.

So what I would recommend is, that you have a look at the templates, where this user might have been added as a reviewer directly and change this reviewer to the new user. Afterwards stop the cachebuilder service, truncate the CiUser, CiDomainGroup and Lastmodified Tables and restart the cachebuilder.

For us that solved the issues.