Users are unable to access MonitoringViews for which they should have access to based on their global group membership.

Products

• CA Workload Automation AE - Business Agents (AutoSys)
• CA Workload Automation AE - Scheduler (AutoSys)
• Workload Automation Agent

Issue/Introduction

Users are not able to see a MonitoringView which was newly created for them within WCC.

 

Environment

Workload Control Center 11.4.xEmbedded Entitilements Manager 12.51.x

Resolution

 

A WCC administrator had created a new monitoring view for a group of users but they could not see it.  The view was given a name that included a prefix which matched the group of users global group membership.  The MonitorViewControl EEM policies were configured to grant all users access to any MonitoringView that had a name which was prefixed with their global group's membership name.  The MonitorViewControl policy was configured correctly. When the user's details were displayed within EEM (Manage Identities) they included many global group memberships but not one for the newly created view.  The LDAP admin confirmed the user, group and group membership relationship was correctly defined within LDAP.  EEM had been configured to point to the client's LDAP environment and included a custom mapping.  The custom mapping included a filter restricting the groups to a small subset of prefixes.  The newly created view's prefix group name was NOT included in the custom mapping.  This was the reason the users could not see the view. Once the groups prefix was added to the custom map's group filter the group membership displayed correctly in EEM's manage identities for the user. And the users were able to access the newly create MonitoringView from within WCC.

 

EEM -> Configure -> User Store -> Attribute Maps -> Mapping Name -> Ldap Group Mapping -> Group Search Filter