CloudHealth FlexOrgs: Permission Resolution and API Key Generation Issues

Products

• CloudHealth

Issue/Introduction

A user belonging to a custom group with the necessary permissions (Read, Update, and Generate API Key) is unable to generate their own API key.

Even after logging out and back in to refresh permissions, the option to generate the key remains unavailable or restricted.

Environment

Architecture: FlexOrgs 

Cause

In CloudHealth FlexOrgs, permissions are additive across all assigned user groups and their associated role documents. However, the system follows a "Deny overrules Allow" logic for conflict resolution.

If a user is a member of multiple groups:

1. Group A (Allow): Assigned a Role Document that explicitly allows API key generation.
2. Group B (Restricted): Assigned a Role Document (e.g., a standard user role) that does not include the permission or implicitly restricts it.

The restriction or lack of permission in Group B will take precedence over the "Allow" in Group A, preventing the user from performing the action.

Resolution

To resolve this conflict and allow the user to generate their API key, follow these steps:

1. Identify Group Memberships: Review all User Groups the affected user is currently assigned to.
2. Verify Role Documents: Check the Role Documents associated with each group to identify which one contains the more restrictive permissions.
3. Remove Conflict: Remove the user from the more restrictive group (e.g., a standard group that does not permit API key generation) so that only the group with the correct "Allow" permissions remains active for that user.
4. Refresh Session: Instruct the user to:
   • Log out of CloudHealth.
   • Close the current browser session.
   • Start a new browser session.
   • Log back in to apply the updated permission set.