Insufficient permissions in 2011 - hard to figure out

(0) Share

Report

Posted on by Community Member

Hi all,

I have the following problem that's driving me nuts:

We have two business units of which one is the subsidiary. It has inherited security roles, which are otherwise broad but the subsidiary security role only has visibility to it's own accounts and contacts etc..

Last week I trained an user of the subsidiary business unit, and everything worked as it was supposed to. But come Monday, that same user was not able to open contacts or accounts owned by him!

He can create new accounts and contacts, but once they have been saved and closed, he can't open them but gets "Insufficient permissions".
List view ("My active accounts") shows his accounts, but he can't open them.

Security role access rights are set to just below organization level across the board for customers and accounts. Changing them makes no difference.

Only two things changed over the weekend: I broadened the viewing privileges to entire organization experimentally, and then rolled them back to business unit+subsidiaries level. And the user installed the Outlook plug-in. That plug-in works fine, except of course he can't open or edit accounts or contacts.

I'm running out of ideas, so all suggestions are welcome!

rgds,

Teppo

*This post is locked for comments

I have the same question (0)

All responses (19)

Answers (1)

Community Member on at

Like (0)

Report

This is obviously broken somewhere - if a record is show in a view, you must be able to read it by definition, and therefore open it.

A couple of possibilities:

Check the security role in case it is the form they cannot access, rather than the record - go to the customisation tab of their security role(s), scroll down to Miscellaneous Privileges and look for ISV Customisations - this needs to be on for them to use some customised objects (typically this problem affects things like custom Ribbons not being visible in Outlook, but worth checking for your scenario too)

Various security settings are cached on the CRM web (application / front-end) server to improve performance. Perhaps this is not being updated when you make changes, or the cache has been flushed because of the changes and not rebuilt properly. Try an IISReset on the web servers (outside of working hours - this will disconnect users temporarily and disrupt their work). If this works, monitor the situation, and if it persists or happens for another user, get a support call logged. This is not a suitable fix, but is a workaround and helps to figure out where the problem is.

Was this reply helpful? Yes No
Royal King 27,686 on at

Like (0)

Report

Enable the tracing in the server if it's an on-premise CRM. In trace you should be able to see which privilege system complaining about . One more thing to check is if you have any lookup on the form check whether user has read privilege on those entity as well.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Do you have any JS or Plugins set to fire onLoad? Try moving the user to a different BU and then back to the original. This will shed any Security Roles associated with that user account.

Was this reply helpful? Yes No
Aileen Gusni 44,524 on at

Like (0)

Report

Hi Teppo,

Check the CAL License user of that User, is it only Administrative? Change to Read-Write if it has not. (it is under System User setting for that particular user record)

But, if it has Read Write, then you should try to assign him System Admin first to check, is that okay.

Hope this helps!

Thanks.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Thank you everyone for your suggestions!

Here's what I tried so far, although unsuccessfully:
- Moving the user to the higher-level business unit, and assigning to him the same security roles as we have for all our other users. Still got "Insufficient permissions", as I did also after I moved him back to the ner BU.
- I checked the custom tab under the security role, but his intended security role has the same privileges as our other users have, and they haven't got any problems.
- I gave him also ClickDimensions Core security role in addition to his subsidiary BU security role, in case there's something on the forms that requires CD access (all our other users have CD Core role as standard). No change, and besides if this was the problem why did opening forms work last week?

I don't think we have any special stuff (JS or plugins) firing OnLoad. Our installation is basically On-premise, but it is a hosted solution so I don't have unrestricted access to all server stuff or user management. I have to ask about IISreset and the CAL thing from the hosting provider.

Was this reply helpful? Yes No
Aileen Gusni 44,524 on at

Like (0)

Report

Hi TNE,

Can try to assign them to System Admin for a while?

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Hi Aileen,

I tried that, and now accounts and contacts open but in a funny-looking popup I've never seen before: Left navigation opens only when I click on a vertical pane on the left, and there's a separate "Edit"-button I have to click before the normal form opens. And when I take away the SysAdmin role, the situation returns to "Insufficient privileges". Here's the upper left-hand corner of the funny-looking form popup:

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

And why does this forum software offer rich formatting if you can't attach images???

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Have you tried to use a different browser or on a different computer.

Was this reply helpful? Yes No
Aileen Gusni 44,524 on at

Like (0)

Report

Hi TNE,

Need your help to give the screenshot, you can insert image after you click the Use rich formatting, can you? Its maximum size is 64 kb

Yes, agree with Damon, try to use different browser?

Thanks!

Was this reply helpful? Yes No