Clarity: Create New from Template does not save the OBS Unit before checking security rights causing the project not to be created properly (PRJ-10016 or insufficient rights)

Document ID : KB000017938
Last Modified Date : 14/02/2018
Show Technical Document Details

Description:

In v12, the customer had the following access rights configuration to allow a user to create a new project from template with team members. This configuration works in v12. However after upgrading to v13, the same configuration does not work. It appears that perhaps the order in which the code is executed may cause this problem. Because the security configuration is set up to check rights based on an OBS Unit, I suspect that the OBS Unit is not being saved BEFORE the code checks the access rights for allowing the user to manage the project.

Use Case Configuration:

Admin:

Create a Group that grants OBS Unit rights for Project Edit Management and for Resource Booking Rights. Grant rights to create new projects and create new projects from a template. Add a new user to the group so that the user only has the specific rights assigned (User01). Create a Template that is associated with the specific OBS Unit and book some resources to the template.

User01:

The user is able to see the template and also have the ability to 'edit management' on this template, because the user has the right based on the OBS Unit saved on the template (the user can see the Team, 'Add' button and can actually update the template). The user is also able to create a new project (not from template), pick a different project manager, and assigned the appropriate OBS Unit. Once this project is created, the user will still have the ability to 'edit management' on the project due to the rights assigned by the group. If the user tries to create a new project from template, and picks a different project manager, the code is checking the access rights before the OBS Unit is being saved on the project and thus either causes the project not to be saved at all or partially saved (omitting the OBS Unit and the team members).

Steps to Reproduce:

  1. Login to Clarity as an administrator user
  2. Be sure your system has OBS definitions associated with Project and Resource objects that can be used for security access rights
  3. Administration, Resources (users) - create a new user (User01) ; do not assign additional rights
  4. Administration, Groups - create a new group ; (OBS Project Group) and add 'User01' to the group
  5. Assign the following rights to the group:

    OBS Unit:

    Project - Edit Management > Select a valid Project OBS Unit
    Resource - Soft Book > Select a valid Resource OBS Unit
    Resource - View > Select a valid Resource OBS Unit
    Resource - Hard Book > Select a valid Resource OBS Unit

    (NOTE: There should be existing resource profile records associated with the selected OBS Unit so that User01 can select another resource for the manager field in later steps)

    Global Access:

    Project - Create
    Project - Create from Template
    Projects - Navigate

  6. Home, Projects - create a new project template (OBS Template Project)
    Open the new project template, be sure the 'template' attribute is checked
    Set the Project OBS Unit to match the valid Project OBS Unit selected in the Group rights
    Go to the Team Tab and add some resources
    Save the OBS Template Project
  7. Login as 'User01'
  8. Click 'New from Template' (from overview page or projects list page)
    Select the 'OBS Template Project', click 'Next' button
    Change the Project Manager field to another resource
    Check to ensure the OBS Unit is showing on the create page
    Click 'Save' button

Expected Result: Project should be created with given access rights
Actual Result: Project is not created properly, PRJ-10016 error message or insufficient rights error message is shown

Solution:

WORKAROUND:

Create a new project first setting a different project manager and saving the OBS Unit, then use the 'Copy from Template' action.

-- OR --

Create new project from template, but KEEP the Project Manager set to the current user and then change the Project Manager after the project is created.

This may not be desirable because the current user will end up with Project Manager (auto) rights.

STATUS/RESOLUTION:

CLRT-74579
Resolved in CA PPM 14.1