[SOLVED] ACLs quit working after 3.3.14 update to 4.0.8

[kruegerM]

I migrated my test system from 3.3.14 to 4.0.8. Metadata views great, items create great, processes are good - except for ACLs.
Some of our ACLs are set for items in the process. Depending on which state (Action) an item is in, the item's Status drop-down should be limited to different values. Sometimes limited to only one.
This is no longer working; all possible values for the drop-down are showing in each task/action. I verified the new numbering for Action Dialogues matched what is in the ACL (nice work, by the way!).
The ACLs for a regular support ticket are working fine; available Services is dependent on which Queue is selected.
I'm seeing no errors in the SysLog or apache's error_log.
I'm stumped.

M

[wurzel]

Hi,

the ACLs needs to be migrated, too. There are sometimes diffuclties in doint this.
Do you have an example of "what is not working" ?



Flo

[kruegerM]

I ran the two DBUpdate scripts, the RebuildConfig and DeleteCache. Were there extra steps I missed on migrating the ACLs?
Here's an example of the non-working ACLs:

Our first ActivityDialog is for creating a new RFC. The RFCStatus has 22 possible values, only 3 should display here: "In-Work", "Request Manager Approval", and "Cancelled". This is the current 3.3.14 behavior. However, in the 4.0.8 migration, all 22 values are showing. Comparing old ACL to new ACL, I see the ActivityDialogEntityID changed from AD23 to ActivityDialog-cceb5dcf603cb50aa05ddde8ed2bf91c. The new long ID matches the one in the Process for that dialog.

[wurzel]

Hi,

can you show the content of your ZZZACL.pm ?

Cheers
Flo

[kruegerM]

Here is the data from my ZZZACL.pm n- the first ACL is the one for my example earlier:

Code: Select all

# OTRS config file (automatically generated)
# VERSION:1.1
package Kernel::Config::Files::ZZZACL;
use strict;
use warnings;
no warnings 'redefine';
use utf8;
sub Load {
    my ($File, $Self) = @_;

# Created: 2014-11-16 07:04:44 (kruegerm)
# Changed: 2015-06-25 15:00:57 (kruegerm)
$Self->{TicketAcl}->{"AD23 - Submit Data"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        'Original',
        'Request Manager Approval',
        'Cancelled'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-cceb5dcf603cb50aa05ddde8ed2bf91c'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:44 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD24 - Committee Review"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        'Denied',
        'Committee Approved',
        '-',
        'Edit',
        'Committee'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-f040f06b243436adf9bdc63a9598911a'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:44 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD25 - Edit for Secondary Approval"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        'Request Emergency Manager Approval',
        'Original'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-87c7d99129a0cebb2966e0bce8408477'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:45 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD26 - Manager Approval 1"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        '-',
        'Rejected',
        'More Data Required',
        'Approved by Manager'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'DynamicField' => {
      'DynamicField_16TypeOfChange' => [
        '1-Minor',
        '2-Major',
        '3-Significant',
        '5-Standard'
      ]
    },
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-38872a945ccb4e52caa3b4254da37d84'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2015-01-07 11:02:02 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD26 - Manager Approval 2"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        '-',
        'Rejected',
        'More Data Required',
        'Approved - Request Emergency Approval'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'DynamicField' => {
      'DynamicField_16TypeOfChange' => [
        '4-Emergency'
      ]
    },
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-38872a945ccb4e52caa3b4254da37d84'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:45 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD27 - Add Imp Record"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        'Active',
        'Closed'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-1a63cfd13d25a5f0c9fa9c78b3ce13a0'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:45 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD28 - Secondary Approval"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        'Rejected',
        '-',
        'Approved by Emergency Manager',
        'More Data Required'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-5d499567aea71ec3dc96a1f2b22ca9c2'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:44 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD29 - Implementation"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        'Finalize',
        'Implementation',
        '-'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-8a273c9cf82a0054eb53e02314e23726'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:44 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD30 - Finalize"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        '-',
        'Closed',
        'Failed',
        'Standard Change',
        'Implementation'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-6d39b17d7ccd499c648a86e2c796a130'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:45 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD31 - Assign Implementer"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        'Implementation'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-5d443dc0d2d7dca70179e0bc344291fb'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:44 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD32 - Edit for CM"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        'Original',
        'Send to Change Manager'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-6900512b766deff4a5de59ea0433ce1d'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:44 (kruegerm)
# Changed: 2015-06-24 16:05:22 (root@localhost)
$Self->{TicketAcl}->{"AD33 - CMReview"} = {
  'Possible' => {
    'Ticket' => {
      'DynamicField_46RFCStatus' => [
        '-',
        'Cancelled',
        'Committee',
        'Edit'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Process' => {
      'ActivityDialogEntityID' => [
        'ActivityDialog-4575284bb50a99c8b10d3a4d25972a23'
      ]
    }
  },
  'PropertiesDatabase' => {
    'Process' => {}
  },
  'StopAfterMatch' => 0
};

# Created: 2014-11-18 09:42:40 (kruegerm)
# Changed: 2014-11-18 10:13:53 (kruegerm)
$Self->{TicketAcl}->{"Ticket - ACL-CM Queue Not"} = {
  'Possible' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]CM'
      ]
    }
  },
  'Properties' => {
    'Ticket' => {
      'Type' => [
        '[RegExp]Incident',
        '[RegExp]Problem'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:44 (kruegerm)
# Changed: 2014-11-16 07:04:44 (kruegerm)
$Self->{TicketAcl}->{"Ticket - ACL-Network"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Network'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]Network'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-11-18 09:44:36 (kruegerm)
# Changed: 2014-11-18 09:45:14 (kruegerm)
$Self->{TicketAcl}->{"Ticket - ACL-RFC No"} = {
  'Possible' => {},
  'PossibleAdd' => {},
  'PossibleNot' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]RFC'
      ]
    }
  },
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:45 (kruegerm)
# Changed: 2014-11-16 07:04:45 (kruegerm)
$Self->{TicketAcl}->{"Ticket - ACL-Radiology/Cardiology"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Radiology/Cardiology'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]Radiology/Cardiology'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2015-03-26 07:48:58 (kruegerm)
# Changed: 2015-03-26 08:09:00 (kruegerm)
$Self->{TicketAcl}->{"Ticket - ACL-Reporting-"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Reporting-'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::Application Support::Reporting'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:45 (kruegerm)
# Changed: 2014-11-16 07:04:45 (kruegerm)
$Self->{TicketAcl}->{"Ticket - ACL-Servers"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Servers'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]Servers'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:45 (kruegerm)
# Changed: 2014-11-16 07:04:45 (kruegerm)
$Self->{TicketAcl}->{"Ticket - ACL-Telecom"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Telecom'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]Telecom'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-11-16 07:04:45 (kruegerm)
# Changed: 2014-12-31 08:12:14 (kruegerm)
$Self->{TicketAcl}->{"Ticket - ACL-Workstations"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Workstations'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]Workstations'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-12-31 08:15:53 (kruegerm)
# Changed: 2014-12-31 08:17:17 (kruegerm)
$Self->{TicketAcl}->{"Ticket - Audio Visual"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Audio Visual'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::Technical::Audio Visual'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2015-01-19 14:02:34 (kruegerm)
# Changed: 2015-01-19 14:39:06 (kruegerm)
$Self->{TicketAcl}->{"Ticket - Business Apps2"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Business Applications'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Queue' => {
      'Name' => [
        '[RegExp]IS::Application Support::Business Applications'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-12-31 07:58:09 (kruegerm)
# Changed: 2014-12-31 08:02:45 (kruegerm)
$Self->{TicketAcl}->{"Ticket - Clinical"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Clinical Applications'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::Application Support::Clinical Applications'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-12-31 09:02:10 (kruegerm)
# Changed: 2014-12-31 09:03:14 (kruegerm)
$Self->{TicketAcl}->{"Ticket - Custom Apps"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Custom Applications::'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::Application Support::Custom Applications'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-12-31 08:49:31 (kruegerm)
# Changed: 2014-12-31 08:50:06 (kruegerm)
$Self->{TicketAcl}->{"Ticket - LIS"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]LIS'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::LIS'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-12-31 08:37:07 (kruegerm)
# Changed: 2014-12-31 08:48:36 (kruegerm)
$Self->{TicketAcl}->{"Ticket - Mobile"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Mobile'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::Mobile'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-12-31 08:57:21 (kruegerm)
# Changed: 2014-12-31 08:58:02 (kruegerm)
$Self->{TicketAcl}->{"Ticket - Operations"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Operations::'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::Operations'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2015-01-27 13:17:35 (kruegerm)
# Changed: 2015-01-27 13:41:51 (kruegerm)
$Self->{TicketAcl}->{"Ticket - Patient Portal"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Patient Portal'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Queue' => {
      'Name' => [
        '[RegExp]IS::Application Support::Patient Portal'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-12-31 08:53:20 (kruegerm)
# Changed: 2014-12-31 08:55:05 (kruegerm)
$Self->{TicketAcl}->{"Ticket - Printers"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]Printers::'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::Technical::Printers'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

# Created: 2014-12-31 08:59:26 (kruegerm)
# Changed: 2014-12-31 09:00:44 (kruegerm)
$Self->{TicketAcl}->{"Ticket - VLA"} = {
  'Possible' => {
    'Ticket' => {
      'Service' => [
        '[RegExp]VLA'
      ]
    }
  },
  'PossibleAdd' => {},
  'PossibleNot' => {},
  'Properties' => {
    'Ticket' => {
      'Queue' => [
        '[RegExp]IS::Technical::Quotes / VLA'
      ]
    }
  },
  'PropertiesDatabase' => {},
  'StopAfterMatch' => 0
};

}
1;

[wurzel]

Hi,

mhh I can not see an error on the first glance.

Are you sure that you are not using root@localhost user for testing?

And any errors in the logs?

Florian

[kruegerM]

SysLog has no errors.

Apache errorlog has no errors.

We're on LDAP so I can't use root@localhost.

My account has all privileges.

If it were just the first Task, but it's all of them. However, my other ACL's are controlling Services by Queue fine.

[kruegerM]

In 3.3.14 - An ACL for my process would look as follows:

Match Settings
Properties
Process
ActivityDialogEntityID
....

After migration to 4.0.8, the same looked as follows:

Match Settings
PropertiesDatabase
Process
Properties
ActivityDialogEntityID
....

After removing the 'PropertiesDatabase' section from the all Process ACLs - it's working fine.