topic Re: Managing Access Rights at Group Level - Import permission always on in Product Forum

Managing Access Rights at Group Level - Import permission always on

JMartins — Sat, 10 Jul 2021 00:59:50 GMT

Hi all

I'm configuring Access Rights at the group level on a multi-team environment and, for some groups, we don't want some roles to be able to Import Processes or Objects.
The thing is that the Import Business Object and Import Process permissions are grayed out and always on.
I can't remove them from the Role because they are needed on other groups.
How can I remove the import permission?
Is it a bug or it's by design?

Re: Managing Access Rights at Group Level - Import permission always on

ewilson — Tue, 13 Jul 2021 15:41:56 GMT

Hi @JMartins,

What version of Blue Prism are you running?

Cheers,
Eric

Re: Managing Access Rights at Group Level - Import permission always on

JMartins — Tue, 13 Jul 2021 18:06:59 GMT

Hi, @ewilson

We're using 6.10.2.

Thanks.

Re: Managing Access Rights at Group Level - Import permission always on

Walter.Koller — Thu, 15 Jul 2021 08:09:23 GMT

I also noticed this change of applied permissions from v6.4 to v6.9. I assume it will be similar to v6.10
As soon as the user role as import permission, it is always active and greyed, not being able to turn it off for individual groups/folders.

This actually makes sense when considering how BP handles the code and the references (names) to it.
Normally an object (VBO, process) has a 1:1 relation between the XML code stored in the repository and the name that is shown in Studio.
But it is possible to create another reference to the same XML code, thus having two names in different groups/folders but pointing to the same object.
Considering this, following scenario is possible (and happend to us several times) in v6.4:
A user has import permissions and is allowed to import into group GroupA but the import rights have been revoked for GroupB.
The idea is to prevent any unwanted imports and overwriting of objects in GroupB.
However, the user will be able to import the same object in GroupA, which will overwrite the original object in GroupB.
In the end the individual group level import permissions could not prevent anything.

I think the way how imports work is slightly different in v6.9 but the general principles stayed the same I assume.

I would have preferred if the possibility of having several references would have been removed.
The current way on how it works now, is really an issue when managing several teams in one environment.

Re: Managing Access Rights at Group Level - Import permission always on

JMartins — Thu, 15 Jul 2021 10:47:32 GMT

Thanks @Walter Koller for your explanation.

This is a bummer!

[...]The idea is to prevent any unwanted imports and overwriting of objects[...]
This was exactly my goal, to prevent rookies from messing up other users work, but from your explanation I can see it doesn't seem achievable.

I believe that imports on 6.10.2 still works the same way.
After the upgrade I imported all utilities (from the VBO folder) to a new group and I got a few warnings about overwriting some object ids although the newly imported and existent objects were in completely different groups.

The problem remains to be solved but now I know why! 🙂
Thanks again