Error "Access is denied" running reports when 'CA PPM' folder permissions are incorrect

Products

• Clarity PPM SaaS
• Clarity PPM On Premise

Issue/Introduction

An error is seen by certain resource groups when running Clarity Advanced Reporting (Jaspersoft) reports:

Error Message

org.springframework.security.access.AccessDeniedException: Access is denied

Example of group and report impacted:

Project Manager users are unable to open their Project Status Report and receive the below error

Environment

Release: Any
Jaspersoft Advanced Reporting

Cause

Permissions on the 'CA PPM'  folder in the Advanced Reporting repository may be incorrect.

Resolution

Check the permissions on the 'CA PPM' folder

Check the permissions for this folder in the Jaspersoft repository

1. As an Admin user, go to Home -> Advanced Reporting.
2. Go to View-> Repository
3. Right-click on the 'CA PPM' folder and select 'Permissions'.
4. On the Role tab, check what is set for each role
5. Reset the permissions to the Out of the Box (OOTB) defaults and test the reports again to verify that the error no longer occurs. 

OOTB permissions

Below are the out of the box access rights

• CSK_ROLE_ADMINISTRATION - Read Only
• CSK_ROLE_ALL_REPORT_DOMAINS - Read Only
• CSK_ROLE_CUSTOM_MASTER_OBJECTS - Read Only
• CSK_ROLE_FINANCIAL_MANAGEMENT - Read Only
• CSK_ROLE_IDEA_MANAGEMENT - Read Only
• CSK_ROLE_INVESTMENT_MANAGEMENT - Read Only
• CSK_ROLE_PROGRAM_MANAGEMENT - Read Only
• CSK_ROLE_PROJECT_MANAGEMENT- Read Only
• CSK_ROLE_RESOURCE_MANAGEMENT - Read Only
• CSK_ROLE_TIME_MANAGEMENT - Read Only
• ROLE_ADHOC_DESIGNER - Read Only
• ROLE_ADMINISTRATOR - Administer *
• ROLE_ANONYMOUS - No Access *
• ROLE_DASHBOARD_DESIGNER - No Access *
• ROLE_DATASOURCE_DESIGNER - Read Only
• ROLE_DOMAIN_DESIGNER - Read Only
• ROLE_REPORT_DESIGNER - Read Only
• ROLE_USER - No Access

Screenshot below of access:

Workaround

Add the "Advanced Reporting - Administer" access to the group that the resource belongs to and re-run the reports.