All objects in Central repository set to READ ONLY!

Hello, Wednesday 7/20/2011 all the objects in the central repository were full access for all groups. (Only have 3 groups).

Thursday, for some reason, all the objects in the central repository got set to Read only for all groups. I don’t know what happened. I’m thinking it had to have been something on the database side.

We’re running Oracle 11g, R2, with Data services (EDGE) 3.0 with no service packs.

Anyone have any idea how to restore full permissions. As of now we can’t do anything withour jobs… We’re having to export them from local repositories and import them to deploy the jobs and modify them… :frowning:

Please advise!!!


travisk (BOB member since 2008-07-16)

Permission Level for groups is setup on the Management Console Level.
So what permission it reads in the Console or in the Central Repo screen?

I mean to ask if you get WRITE issues on AL_*** tables or getting permission issue?


ganeshxp :us: (BOB member since 2008-07-17)

The management console just has users and groups. The users and groups never changed.

But there is no permissions in the management console, it looks like it’s just someone has access or you don’t. It’s a secure central repository and all the passwords appear to be functional or you wouldn’t be able to see the jobs.

So, are you saying to verify the access to the AL_**** tables in the database schema of the repository. That’s something I still need to check… I wasn’t sure if it could be a database issue or if it was more a Data Services issue.


travisk (BOB member since 2008-07-16)

I mean to ask like what error message you get when you upload any object to central?


ganeshxp :us: (BOB member since 2008-07-17)

The error message is a generic message saying the user only has read permissions. (I’d have to generate it again to get the exact message.)


travisk (BOB member since 2008-07-16)

Then I would say it is someone who went and changed the setup in management console. If it is DB level issue then it will tell something like the user don’t have a write privilege on a AL_LANG and some tables. Check the console.


ganeshxp :us: (BOB member since 2008-07-17)

O.k. I verified, new objects can be added to the Central repository and the user has full permissions on the new objects he adds.

However, for all users, the objects in the central repository are set to read only except the newly added objects.

So… what user can change the permissions on the objects from readonly to full, if no one has any more access than read only. How do you set the permissions of the objects if no one has access to change the permissions?

Are we pretty much screwed?


travisk (BOB member since 2008-07-16)

Then you mean to say that the Management Console --> Central Repositories Tree–> corresponding CENTRAL REPO you looking for --> Users and Groups Tree --> Groups Tab

Here in this does a Full Access Group exists? If so, then the user you look for is present in that group?

If these are not aligning, then I too do feel that your repositories are screwed?? :?


ganeshxp :us: (BOB member since 2008-07-17)

Well, there’s no options to define in the management console, what access the groups have. I have 3 groups in the corresponding central repository. In the management console, and users are assigned to all 3 groups. But there’s no place to specify what permissions the groups have. It’s always been that a user assigned to a group with access to the central repository has full access.

Then in designer a person can change the permissions of each of the object if one so wishes. but no one has anything but read only permissions in the central repository itself within designer.

Is there anyway around this?


travisk (BOB member since 2008-07-16)

Oh ya it is my bad. So were you able to edit the permissions by right click on a object, permissions --> Objects or Objects & Dependents and modify something there?


ganeshxp :us: (BOB member since 2008-07-17)

I found one group that has full permissions to the project folders. However, all dependants in the project folders are read only.

I tried adding a new user and a new group to the dev central. And all permissions defaulted to read only. I’m not sure why everything defaults to read only.

Is there a field in the database that we can update to full access permissions instead of read only?

I’ll post this as a support ticket to SAP at this time… What a bizarre mess!!


travisk (BOB member since 2008-07-16)

Well I digged something for you.

There is a table named AL_OBJ_PERMS where there are columns named
NORMNAME, OBJECT_TYPE, GROUP_ID and PERMISSION.

I am little bit unsure of this table. Because, we basically have 2 groups - one a Read Only and another a FULL group. I do see lot of objects in this table for the FULL Group and not for the READ ONLY Group???
PERMISSION I just believe 1=READ and 2 = FULL ??
Hey don’t go at my statements am just guessing it :roll_eyes:


ganeshxp :us: (BOB member since 2008-07-17)

Yup, you’re right. SAP came back with the same information.

All the objects in that table are set to a 2 for all the group codes we have.

So, something is really majorly messed up. Data services isn’t reading the permissions in the database correctly.

I responded to SAP and am awaiting a response.


travisk (BOB member since 2008-07-16)

Do you make any hot backup/cold backup of the CENTRAL Repo DB?? If so bring it back that way for getting out of the mess?
My ideas are not bad 8)


ganeshxp :us: (BOB member since 2008-07-17)

Had the same issue when imported the code into the central repo through al_engine. There were no entries in the al_obj_perms table.

Manually added as below to give the administrator group (1) full permissions. (Not sure of the consequences, I tried in a DEV repo and it seems to be working after initial checks, but try at your own risk)

insert into al_obj_perms
select distinct NORMNAME,OBJECT_TYPE,1,2 from al_lang ;

Repositroy DB : Oracle 11g, BODS 4.1

Regards,
Abhishek


dbz_a (BOB member since 2010-01-09)

Hello,

I am facing this issue after migrating DS to cloud environment. Seems something went wrong during central repository migration from old system to new system.
All the existing objects in central repo are read only. But I am able to add new objects in central repo.

I checked al_obj_perms table, there I can see value for permission is 2.

Can someone please help to fix this issue?.

Thanks


DbUoRdAsI :india: (BOB member since 2012-05-08)