You don't have permission to modify this document category's permissions.

book

Article ID: 171782

calendar_today

Updated On:

Products

Workflow Solution ServiceDesk

Issue/Introduction

Opening a ticket (most commonly, a ServiceDesk Incident) in a process view page, the Process Documents (Incident Attachments) web part shows an error message. This happens regardless of whether there are documents in the process' documents category or not.

You don't have permission to modify this document category's permissions.

Cause

1. There is a known issue with specific Workflow versions where Process Documents web part actually requires 'Can modify this category's permissions' permission on that specific document category. This should not be the case as simply showing a list of documents (including to users with very few permissions) should not require this level of access.

This affects the following Workflow versions:
- Workflow 7.6 Pointfix Roll-up versions 7.6.4383. 519 to 7.6.4383. 521. The issue is fixed in the latest Workflow 7.6 Point Fix Roll-up version 7.6.4383.522:
INFO2509Workflow 7.6 Point Fix Roll-up
- Workflow 8.1. The issue was fixed in Workflow 8.1 RU1.
- Workflow 8.1 RU5/RU6/RU7. The issue has been reported as occurring again in Workflow 8.1 RU5 and RU6. The issue is being actively worked on by Symantec Engineering.

2. This error message can be a bit misleading. In addition to lacking the specific permission, it can also indicate lack of a permissions entry for the logged-in user on document category in all Workflow versions.

No actual permissions are required for the Process Documents web part except the 'Can view this category' that is minimum and granted automatically when permissions entry is created. Note that 'Can view all documents in this category' is necessary for seeing the actual documents in web part but lacking that permission web part simply states that there are no attachments.

Resolution

1. As a workaround - especially if you are experiencing the issue in 8.1 RU6/RU7 - document category permissions including 'Can modify this category's permissions'  are granted by 'Grant Ticket Access' rule action.

The problem is generally with ServiceDesk as custom projects can be modified to grant the permission.

Generally, the primary concern is to get Support groups to see all the Incident attachments with users seeing Incident attachments being secondary. To achieve this, we recommend adding a rule in 'OnIncidentReceived' ruleset - which runs at the creation of every Incident - with action 'Grant Ticket Access' to necessary groups.

2. In this case, the approach is largely the same - make sure users or groups have permissions on the document category. In ServiceDesk or custom projects with Automation, 'Grant Ticket Access' rule action will do the trick.

Specifically regarding ServiceDesk:
- The appropriate level of permissions is automatically granted for users or groups that have Work Incident task being assigned to them.
- There is a difference in how rulesets are being run for an Incident when it is being created (before the Work Incident task). In SD.IncidentManagementSimple project, OnIncidentReceived ruleset is always run when Incident is created. Then, OnTicketAssigned ruleset is run when Incident comes with an assignment (usually, from Advanced Feeder) but not when Incident does not have an assignment (usually, from Simple Feeder). If 'Grant Ticket Access' action is used in OnTicketAssigned ruleset, it would not apply to an Incident submitted with Simple Feeder until Incident is Reassigned - after which OnTicketAssigned ruleset does run.