Groups wont work after Update to V3.1.2

This forum is now locked, since Gold Support is no longer offered.

Moderator: SourceGear

PACEGMBH
Posts: 54
Joined: Tue Jun 28, 2005 7:18 am
Location: GERMANY

Groups wont work after Update to V3.1.2

Post by PACEGMBH » Thu Sep 22, 2005 3:17 am

Hi there,

today I updated from 3.1.1 to 3.1.2
A couple of minutes ago a user told me that he isn't able to check out files anymore.
After testing around I figured out that the rights given to a group won't work anymore.

e.g.

The user FRED is member of a group DEV.
The group DEV has been given R/C/A to a repository PROJECT.

Before the update everything worked well. Today I've got a bunch of users which aren't able to checkout files.
Now I have assigned rights on a per user basis.
But I'd like the groups thing working.

Have you got any suggestions ?

Regards,

John

jclausius
Posts: 3706
Joined: Tue Dec 16, 2003 1:17 pm
Location: SourceGear
Contact:

Post by jclausius » Thu Sep 22, 2005 8:06 am

John:

Vault 3.1.1 and less was incorrectly calculating security rights in certain cases. Here is how the Vault 3.1.2 Server determines rights:

1) Does the user have rights assigned to the folder or any folder ancestor? If so, the closest folder assignment (moving up the ancestor list) is used.

2) If no user right is assigned from step 1, does any group have an assignment to the folder or folder ancestor(s)? If so, the closest folder assignment (moving up the ancestor list) is used.

3) If no user or group rights are assigned from step 1 and step 2, use the user's default rights.


So in your case, can you look at user rights assigned to FRED, rights assigned to ALL of FRED's groups (including DEV), and FRED's default rights. Do you see a conflict where FRED may have a USER right denied along PROJECT's ancestors? This user right may be over-riding the group right.
Jeff Clausius
SourceGear

PACEGMBH
Posts: 54
Joined: Tue Jun 28, 2005 7:18 am
Location: GERMANY

Post by PACEGMBH » Mon Sep 26, 2005 12:17 am

No, I don't see a conflict.

The only objects given permissions to the repository are the groups DEV and the project manager (PM)

1) No single user has rights assigned anywhere in the repository except PM who has full access everywhere inside the repository.
2)The group DEV has got rights assigned to it and is the only group FRED is a member of.
3)Default rights for Fred are no rights.

FRED isn't able to check out any file. Regarding the rights given to his group DEV, he should be able to.

I've got much expertise with groups, nested groups and rights.
But I don't understand the way Vault 3.1.2 acts.

Any other ideas ?

Regards, John

kasti
Posts: 108
Joined: Tue Apr 20, 2004 4:21 am
Location: Austria

Post by kasti » Mon Sep 26, 2005 7:15 am

Yes, got the same problem:

Reproduce like this:

Create group "testgroup"

"testgroup" has R rights to "$"
"testgroup" has RCA rights to "$/Testproject"

Create user "testuser"

"testuser" is only part of "testgroup", no other rights (Default rights dont matter)

-> check out in "$/Testproject/Subfolder/fileA.txt" not possible


Reproduced in Vault 3.1.2.3511 ;-)


Ciao,
Herbert.

PACEGMBH
Posts: 54
Joined: Tue Jun 28, 2005 7:18 am
Location: GERMANY

Post by PACEGMBH » Mon Sep 26, 2005 7:56 am

@kasti:
Thanks. Thought I was the the only one encountering that problem.

@all:
One guy in Austria and one in Germany having problems.......
Anybody else ?

jclausius
Posts: 3706
Joined: Tue Dec 16, 2003 1:17 pm
Location: SourceGear
Contact:

Post by jclausius » Mon Sep 26, 2005 8:28 am

Herbert / John:

I'm still not able to recreate this problem. I've outlined my steps w/ screenshots against a Vault 3.1.2.3511 server (about.png).

1) Brand new Vault 3.1.2 install. Enabled Default Repository's Folder security.

2) Using the Admin account create the folowing tree structure

Code: Select all

$/
$/Testproject/
$/Testproject/Subfolder/
$/Testproject/Subfolder/fileA.txt
3) Created group testgroup. Assigned R to $/ and RCA to $/Testproject/ - see screenshot (group_assignment.png)

4) Created user testuser w/ No default rights, and assigned them to testgroup. (testuser_1.png & testuser_2.png)

5) Logged in as testuser and then set working folder for $/ to c:\test\1

6) Checked out $/Testproject/Subfolder/fileA.txt with no errors. (testuser_checkout.png)

Is this the case you described above? Did I miss a step?

If you look at the security rights for users which cannot checkout, what does the security settings look like? See my testuser_2.png for an example.
Attachments
testuser_checkout.png
checkout of testuser
testuser_checkout.png (37.66 KiB) Viewed 11925 times
testuser_2.png
security rights of testuser
testuser_2.png (19.68 KiB) Viewed 11925 times
testuser_1.png
edit screen of testuser
testuser_1.png (20.85 KiB) Viewed 11925 times
group_assignment.png
testgroup assignments
group_assignment.png (13.9 KiB) Viewed 11925 times
about.png
Help -> About
about.png (10.62 KiB) Viewed 11925 times
Jeff Clausius
SourceGear

jclausius
Posts: 3706
Joined: Tue Dec 16, 2003 1:17 pm
Location: SourceGear
Contact:

Post by jclausius » Mon Sep 26, 2005 8:39 am

PACEGMBH wrote:No, I don't see a conflict.

1) No single user has rights assigned anywhere in the repository except PM who has full access everywhere inside the repository.
2)The group DEV has got rights assigned to it and is the only group FRED is a member of.
3)Default rights for Fred are no rights.
John:

From within the Admin tool, can you move to the Users tab, highlight FRED, and then click the Security Rights button. What rights are assigned to Fred?
Jeff Clausius
SourceGear

kasti
Posts: 108
Joined: Tue Apr 20, 2004 4:21 am
Location: Austria

Post by kasti » Mon Sep 26, 2005 8:56 am

weird, exactly what I did, everything looks the same.

I have added some attachments....
Attachments
vault1.JPG
vault1.JPG (34.16 KiB) Viewed 11917 times
vault2.JPG
vault2.JPG (22.24 KiB) Viewed 11917 times
vault3.JPG
vault3.JPG (109.5 KiB) Viewed 11917 times

jclausius
Posts: 3706
Joined: Tue Dec 16, 2003 1:17 pm
Location: SourceGear
Contact:

Post by jclausius » Mon Sep 26, 2005 9:07 am

Herbert:

What do the security rights for testuser look like (screenshot)?
Jeff Clausius
SourceGear

kasti
Posts: 108
Joined: Tue Apr 20, 2004 4:21 am
Location: Austria

Post by kasti » Mon Sep 26, 2005 9:19 am

here you go:

jclausius
Posts: 3706
Joined: Tue Dec 16, 2003 1:17 pm
Location: SourceGear
Contact:

Post by jclausius » Mon Sep 26, 2005 9:20 am

Herbert:

Can you try again?
Jeff Clausius
SourceGear

kasti
Posts: 108
Joined: Tue Apr 20, 2004 4:21 am
Location: Austria

Post by kasti » Mon Sep 26, 2005 9:20 am

Second try:
Attachments
vault4.JPG
vault4.JPG (34.95 KiB) Viewed 11900 times

jclausius
Posts: 3706
Joined: Tue Dec 16, 2003 1:17 pm
Location: SourceGear
Contact:

Post by jclausius » Mon Sep 26, 2005 9:26 am

Herbert:

I'm scratching my head here.

Were my steps "exactly" the same steps you used? If you follow the steps (for a new group / user) in the same order as I outlined above, do you still see the problem?

Perhaps there is something weird if the user is created first, and the group created second? Anything else that you can think of that looks different from my example?
Jeff Clausius
SourceGear

kasti
Posts: 108
Joined: Tue Apr 20, 2004 4:21 am
Location: Austria

Post by kasti » Mon Sep 26, 2005 9:33 am

Jeff, maybe you still got my database which I uploaded sometime ago? Maybe you could try it there. The "Test Repository" should not have changed recently.

I have no idea otherwise, you seem to have done exactly what I did....

jclausius
Posts: 3706
Joined: Tue Dec 16, 2003 1:17 pm
Location: SourceGear
Contact:

Post by jclausius » Mon Sep 26, 2005 9:35 am

Let me dig through the FTP archive and see what I can find.
Jeff Clausius
SourceGear

Locked