Infoview Access denied

[Former Member]

I have set up CR Server XI R2. Members of the Admin group are able to access infoview.

I created a group Called all staff. This group has all user in it. I want to grant all users of this group login access to info view.

I granted Login access in application settings. Yet, this group cannot login into info vew unless i make a member of admin group. Please help This group is only memmber of the everyone group. I have also granted everyone group access to infovview. yet still only admins have ablitly to login inot info view. Why is is to difficault to give acces to infoview. please provide step by step to grant access to infoviw for anew group.

[former_member109387]

- Logon to CMC

- Browse to BusinessObjects Enterprise Applications

- Select InfoView

- Select the "Rights" tab

- Here you will see the groups listed you have assigned rights to InfoView. The default is Administrators and Everyone, and you should have at least your "newgroup". Do not select any group names - if you do, you are no longer on the InfoView rights page - rather, for the newgroup line, under Net Access, select the "Advanced" hyperlink.

- Explicitly grant the right to "Log on to InfoView and view this object in the CMC".

[Former Member]

I tried the steps you stated above and the user have now lost their right to login in to info view.

[Former Member]

I have set the "business group" as member of everyone.

I explicitly granted rights to everyone.

I explicitly granted rights to the group"business"

I explicitly granted rights to admin.

Admin group inheritance = false

"business" group. Inheritance=true

Everyone group. Inheritance= False.

With the settings as they are now the business group has lost it's right to login. With business group as memeber of admin they can login. If i remove groupmember ship from admin they cannot login.

You would think the settings you stated would work but they do not.

[former_member109387]

Let's overview some basics of simplifying your deployment administration. Follow these guidelines, and your administration life will be so much easier.

1. The Everyone group should never have any subgroups. Ever. All accounts on the system are a member of the Everyone group. Adding subgroups to the Everyone group is redundant.

2. For simplicity's sake, Application level access should be set on the Adminstrators Group, and the Everyone group. I know there are customers who add groups to application rights. I don't understand why users would have an account on the system if they are not allowed access to InfoView, but it's your system.

3. From a report object perspective, the Everyone group should be set at the top level to "No Access". This will result in them having no rights on anything at all. You break this inheritance at the application level to give them access to InfoView and other apps. On folders and objects, you ADD groups, then assign (ADD) rights as desired.

4. If you can help it, never explicitly deny a right to any user or group for any object or application. Explicitly deny overrides any other setting. If a user belongs to group A and group B, and group A is explicitly denied a right, you can explicitly grant it for group B or the user all day long, and it will still be denied. Always try to put yourself in the position of adding groups/users, and adding rights, then inheriting as far down the folder tree as you can.

So, IF everyone who has an account on your system should be allowed to logon to InfoView, follow these steps.

1. Logon to the CMC

2. Select Groups

3, Select the hyperlink name for the Everyone group

4. Select the Subgroups tab

5. Remove any and all subgroups of the Everyone group.

Now, let's take away EVERYTHING for the Everyone group at the top level, then grant your user groups the ability to see the top level public folders. I would probably just grant them VIEW access, so that once they log onto InfoView, they can actually see top level folders.

1. In the CMC, go back to Home.

2. Select Settings. This is your top level for the whole deployment.

3. Select the Rights tab. Factory default, you have the Administrators and Everyone Groups. NB: Do not select these group names links - they will jump you out of the top level! To the right side of the Everyone Group, set the access level to "No Access". At this point no accounts are allowed to do anything, because you have granted nothing.

4. Use the Add/Remove button to add groups and grant them the canned "View" access, so they can at least see the top level folders and objects.

Then let's give people access to InfoView.

1. In the CMC, go back to Home.

2. Select BusinessObjects Enterprise Applications

3. Select InfoView

4. Select the Rights tab

5. If you want to allow all user accounts the right to logon to InfoView, you should only have the Administrators group and the Everyone group listed on this page. Remove all other groups. That's right, remove them. AGAIN - NB: Do not select these group names links - they will jump you out of the InfoView rights! There's an Add/Remove button, the interface is self-explanatory. After removing all other groups, to the right of the Everyone group, select Advanced. In the General section, explicitly grant the right to "Log on to InfoView and view this object in the CMC". In the InfoView section, I would explicitly grant all rights, but that's up to you. Save and you're done.

If you do not want everyone to be able to access InfoView, then use the Add/Remove to add the specific groups, and grant them these rights.

[Former Member]

I am short on time this afternoon to implement the suggested setup. I will effect changes tommorrow. I will report back tommorrow after changes are applied. Thanks to all for your responses. They are greatly appreciated.

Regards...

[Former Member]

I did the following:

I have four groups all together.

1.Admin= Subgroup =MGMT

2.Everyone= no sub groups

3.MGMT =No subroups

4.Business Group=no sub groups

Settings/ rights:

1.Admin= fullcontrol

2.Everyone= No Access

3.MGMT = view

4.Business Group=view

Infoview/rights: Advanced=

Administrators = All rights explicitly granted : Rights not inherited form parent

Everyone= All rights explictly granted: IE view infoview: Rights not inherited form parent.

I have the settings as described in your last post and members of the Business group cannot login to info view. So far only members of the MGMT group can login.

Any ideas?

[Former Member]

Under: Home > Crystal Reports Server Applications > Check user rights button> I checked the rights of the Business group. It shows access to infoview as denied. So it appears to me they are not getting rights granted by the everyone group where it is explicitly granted. One would think that the business group should be added to the Info view groups to get access. Why is the business group not getting Access?

[Former Member]

I have also tested adding the Business group to infoview rights group with all rights explicitly granted and that also did not work.

[Former Member]

Would you be willing to do a webex session?

[former_member109387]

Hi Karl,

You would have to open a support ticket for that level of service (webex).

The fact that your check user rights shows the right was explicitly denied somewhere indicates you are close to resolution. Explicitly denied overrides any granting as a member of any other group - it will always deny. You have to track down where that is occurring.

Re-read my notes. I recommend removing all other groups at the infoview application rights page, and granting access via the Everyone group.

[Former Member]

Hi,

If you read my previous post I have done exactly that. I have applied all settings as described in you post. I am now looking for any where the rights are denied.

[Former Member]

I checked all the rights of groups at the info view access level the only group with "final Denied status" is the business group.

[Former Member]

As a test I granted the business group Info view access. I checked the user rights and it showed as logon granted. But Still no success. is it possible to just drop the group and add back. I have spent many hours trying to figure out this unintuitive inter face and follwed all the steps suggested and still the only way that it works is to grant access to my business group is to add to admin group which is really not an option other than if I grant object levvel premissions; which i do not want to do. Any suggestion on how to find out why it does not work?

[Former Member]

In the user rights section I checked access and it does nto say explicitly denied ist just show under fianl status as denied but not explicitly.

[Former Member]

I checked Access rights on infoview and the rights for the business group are not explicitly denied just final status shows denied.

[Former Member]

I tried dropping the group and adding back so that there werent any explicit denials for this group and the same final access level of denied. So far the application does not work as you would expect it to... If given the opportunity to suggest a different application to serve the data this app needs to be dumped in the bit bucket...

[Former Member]

I have marked the post unassign at this point because the advice seems correct but has not helped as of yet.

[former_member109387]

Sorry Karl, it can be difficult to track these down via msgs. If you are seeing the final status as denied, and it is not explicitly set where you are viewing it, it is being inherited, or it is being denied as a member of another group. Open a ticket - conducting a webex with a support rep, this should only take minutes to track down.

[Former Member]

Inheritance is turned off and explicit has not been set.

[Former Member]

And only one group has sub group and that group is admin so they can access info view. Thanks for trying to help Have a good holiday!!!

[former_member183750]

This forum is dedicated to topics related to legacy SDKs, including the Report Designer Component (RDC), OCX, VCL, and Crystal Reports Print Engine (CRPE).

Your query appears to concern the configuration of the Report Application Server and as such should be posted to the Business Objects Enterprise Administration forum:

Ludek