Enterprise group "Category" disabled

[mbouwman]

Hello,

After I changed some system settings for Assets and Inventory, I can't add Categories under the Enterprise group. Also within Inventory, the "Add Category" button is greyed-out.

I can't find the setting that logically disabled it.

Regards, Martin

[SNeddermeyer]

Could it be that it is not allowed because access to these objects has been restricted by a dedicated roles & rights definition.

BR, Steve

[mbouwman]

Hello Steve, No, I'm the Administrator. I also tested an account with an other role with full access on category.

Same problem 🙄 

[erwin_lindemann]

Can you confirm that:

1. In the 'Enterprise > Categories' view, there is no plus sign ('+') in the 'Actions' column that you can click on?

2. On an Inventory, after clicking on the 'Search' button in the 'Category' field, the checkbox for one of the existing categories is enabled?

[mbouwman]

Hello Erwin,

All Categories are hidden, 

but still in the database

[SNeddermeyer]

Hi mbouwman,
do you have a possibility to compare settings with an other system were access to categories is granted? Seems to me like a deny in a role.

[erwin_lindemann]

Hi Martin,

To analyze your configuration settings, can you run the following SQL code in SQL Server Management Studio on your [FNMSCompliance] database, please?

;WITH cteRoleRightUnique (GroupID, ResourceID) AS
(
	SELECT
		 GroupID
	   , ResourceID
	FROM [RoleRight] rr
	GROUP BY
		 GroupID
		, ResourceID
)
SELECT
	  ge.Path             AS [Role]
	, r.ResourceName      AS [Resource]	
	, ~rr1.Denied         AS [READ]
	, ~rr2.Denied         AS [MODIFY]
	, ~rr3.Denied         AS [CREATE]
	, ~rr4.Denied         AS [DELETE]
	, ~rr5.Denied         AS [LIST]
	, ~rr6.Denied         AS [EXECUTE]
	, ~rr7.Denied         AS [TRANSFER]
	, ~rr8.Denied         AS [CONFIGURE]
FROM  cteRoleRightUnique rru
JOIN  [GroupEx]               ge  ON ge.GroupID   = rru.GroupID
JOIN  [Resource]              r   ON r.ResourceID = rru.ResourceID
LEFT OUTER JOIN  [RoleRight]  rr1 ON rr1.GroupID = rru.GroupID and rr1.ResourceID = rru.ResourceID AND rr1.ActionClassID = 1
LEFT OUTER JOIN  [RoleRight]  rr2 ON rr2.GroupID = rru.GroupID and rr2.ResourceID = rru.ResourceID AND rr2.ActionClassID = 2
LEFT OUTER JOIN  [RoleRight]  rr3 ON rr3.GroupID = rru.GroupID and rr3.ResourceID = rru.ResourceID AND rr3.ActionClassID = 3
LEFT OUTER JOIN  [RoleRight]  rr4 ON rr4.GroupID = rru.GroupID and rr4.ResourceID = rru.ResourceID AND rr4.ActionClassID = 4
LEFT OUTER JOIN  [RoleRight]  rr5 ON rr5.GroupID = rru.GroupID and rr5.ResourceID = rru.ResourceID AND rr5.ActionClassID = 5
LEFT OUTER JOIN  [RoleRight]  rr6 ON rr6.GroupID = rru.GroupID and rr6.ResourceID = rru.ResourceID AND rr6.ActionClassID = 6
LEFT OUTER JOIN  [RoleRight]  rr7 ON rr7.GroupID = rru.GroupID and rr7.ResourceID = rru.ResourceID AND rr7.ActionClassID = 7
LEFT OUTER JOIN  [RoleRight]  rr8 ON rr8.GroupID = rru.GroupID and rr8.ResourceID = rru.ResourceID AND rr8.ActionClassID = 8
WHERE
	r.ResourceName = 'EntCategories'

Basically, this SQL will list all FNMS user roles, together with the privileges on the FNMS 'Categories' resource resulting from the FNMS user role.

The output of the SQL should look like:

If you could share the output of this SQL in your FNMS environment please, it should be relatively easy to fix your FNMS user role configuration settings 😁.

[mbouwman]

I'm a few weeks on holiday. I will run the query as soon as I'm back.

[mbouwman]

Hello Erwin,

Here the results of the query:

[erwin_lindemann]

The problem obviously is not related to incorrect configuration settings on any user role, as:

• All five roles configured in your environment have 'READ' and 'LIST' privileges on 'EntCategories'
• There is no role configured in your environment which has a 'Deny' configured on 'EntCategories'

Apparently, the FNMS stored procedure 'Grid_GroupExTreeEdit' returns no data in your environment.

You can test this by executing the following SQL after replacing the 'DOMAIN\FNMS-Admin' by a real domain user that has at lest read access configured on your [FNMSCompliance] database:

EXEC AS USER='DOMAIN\FNMS-Admin'

SELECT  
	 [N0].[CanCreate]
	,[N0].[CanModify]
	,[N0].[CanDelete]
	,[N0].[IsAdding]
	,[N0].[GroupTypeID]
	,[N0].[TreeKey]
	,[N0].[TreeName]
	,[N0].[Path]
	,[N0].[Region]
	,[N0].[HasRegion]
	,[N0].[GroupID]
	,[N0].[ParentGroupID]
	,[N0].[TreeParentKey]
	,[N0].[TreePath]
	,[N0].[TreeLevel]
	,[N0].[TreeChildCount]
FROM [dbo].Grid_GroupExTreeEdit(4, 'EntCategories', 1, null) [N0]

This query will probably not return any data in your environment, independently of the user that you impersonate in the statement in the first line.

One would need to do an online session for digging further and debugging why no data are returned.

[mbouwman]

You're right. No data is returned.

We've planned an update for FlexNet this summer. Can this problem be solved by te update?

[erwin_lindemann]

Afraid not 🤔.

My assumption is that the problem is in your data - specifically in the [GroupEx] and [MemberEx] tables in the [FNMSCompliance] database.

This sort of problem is typically not addressed by the SQL scripts executed during the migration to a new release of FNMS.

[mbouwman]

Hello Erwin,

Thanks for all the help. 

I've decided to start with a clean install instead of an upgrade. Our FNMS has been managed by different parties in the past and there are several small issues I hope to solve all at once

[humingjian]

Hi mbouwman

we have runed the same issue as yours.

may i ask once you decide to do a clean install. is all our historical data missing or do you have a better way to keep the data?

because we are considering a clean install but we don't know how to keep the data like software usage data, etc

thanks