Lock Permission w/o custom content doesn't seem to work

Usage and Config Platform
1

I had an operator report to me they were not able to perform a “lock” action on a machine they managed. The operator and the role both allowed the operator to have “can lock” capability and the effective permissions said yes. After tweaking the different capabilities I granted “Custom Content” rights and then the operator could lock the machine.

Is this a bug or does “can lock” need “custom content” rights as well? Seems like a bug unless my setup is somehow special.

Pasted image796×311 152 KB

Here is what the operator was seeing prior to me granting custom content rights.

1 Like
2

Seems like an odd bug considering the other setting. Maybe that setting only applies to action settings or maintenance windows?

3

I am able to reproduce this in 9.5.0.311

Removing “Can Create Actions” also has the very predictable effect of preventing the operator from actioning the, “BES Client Settings: Lock Computer” fixlet in the BES Support Site

And disabling can lock does remove the locked button here:

So at least it would appear that this is the functionality that permission is suppose to effect

1 Like
4

It does seem like locking would require can create actions but shouldn’t require custom content.

Seems like a bug to me. CC: @AlanM

5

That seems like a bug. You obviously have to be able to take actions to lock the computer, but you don’t have to author anything. I think a PMR should be filed

1 Like
6

@sbl - was a PMR ever filed for this? I recently upgraded from 9.1 to 9.2.6 and I’m seeing this “Access Denied” behaviour for any non-master console operators - i.e. all except me - trying to edit computer settings when Custom Content is not enabled.

7

I think that changing computer settings /is/ custom content, unless you pre-author tasks for them.

As for those unable to lock/unlock without ‘custom authoring’ permission, does it work if you use the pre built lock/unlock tasks from the BES Support site?

1 Like
8

I guess you would be right if what is happening is that it is effectively creating a custom action behind the scenes, but it seems like this wasn’t the behavior before.

9

Exactly; this has changed from what was previously achievable. I want users to be able to modify the settings of computers under their remit, without being able to perform acts like creating tasks/baselines, etc.

I have advised them to use the Lock/Unlock Computer tasks and this is fine… however, I don’t believe they can use some of the other tasks, for example pertaining to their relays. So this inconveniences everyone.