User member of Administrators group does not have rights to access the CMC

[JulienM]

Hi the community,

We are with a SAP BO 4.1 SP6 Patch 2: when we create an enterprise user via the CMC, we add it to the Administrators group, and then we try to log in to the CMC via this user, we have the following error:

You do not have access rights to log on to the application

Do someone already faced that type of issue ? Or are we missing something ?

The only way to be able to connect to the CMC is to add the security for each user on the CMC Application directly. But after when trying to promote from Dev to Qas, it does not work. We have the same problem on each platform (Dev, Qas, Prod).

Thanks for your help!

[JulienM · Accepted solution]

Thanks for your help.

As you know any user which is created in the BI platform is part of the everyone group.

The everyone group has the VIEW right for CMC, and Administrators group has FULL CONTROL. There are no other group in the Security configuration for the CMC application.

My understanding was that the Administrators group will always be on top of everyone. For example, I deny access for Top level folder for Everyone but Administrator can still see all the folders.

Usually I just create an enterprise account, made it parts of the administrators group and then he has access to everything instantly.

Thanks

[Former Member · Accepted solution]

Hello Julien,

Like you said every user present in BO is a part of the Everyone group, this also applied to the users in Administrators group or any other for that matter.

So if you deny a certain right let's say to View a certain object, it causes a conflict.

Because a more restrictive right always takes precedence.

So Deny + Grant = Deny.

Grant +Grant = Grant

Grant + Not Specified = Grant.

Deny + Not Specified = Deny.

So you it is not a good idea to Deny a certain right, you should keep it unspecified in most cases.

So users who don't have it explicitly granted, won't be able to acess it.

Regards,

Vaidehi

[JulienM]

Hi,

You were all good. Some rights were hidden in Advanced setting for the everyone group and it was denying the access to the CMC. I didn't saw it before.

I don't know how these rights appears here but it was there.

Sorry. And thank you for your help!

[Former Member]

The problematic users/groups might be inheriting the rights from other groups which are restricting access to CMC. You can cross check that and accordingly make changes so that the user had a clean access to CMC.

[Former Member]

Please check the rights for Everyone group assigned on CMC application area.

Also for Administrators group, you can modify the security by removing the inheritance.