Division permission does not restrict access settings on user record

We have a user administrator role who should only be able to view/create/edit users with access settings within their division.

The user administrator role is configured with division level access to view and assign business units. We also needed to enable system level view access to the organization entity (otherwise access settings weren’t displayed at all). Now our user administrator can create/edit users and give them access to business units.

The problem is they can see and grant access to ALL business units. A user administrator with limited access can easily create a new user for themselves with unrestricted access to all business units.

Is that how it’s supposed to work? It seems like something’s missing in the rules to determine what business units a user can assign in the access settings of a user record …

Topic

[andyhParticipant]

To clarify, what we’d expect is that Oro should disable the checkboxes for business units you do not have access to in the access settings section of a user record.

[Artem LiubeznyiSpectator]

Hi Andy,

Thanks a lot for raising this issue. Your expectations are correct, the “limited” administrator should indeed be able to view & assign users only to BUs they are able to operate according to their permissions.

We will address this issue ASAP. I will keep you posted on the progress.

Thank you.

[berbassParticipant]

Hey there,

Have the same issue here.
It would be nice if we can have a fix soon.

Thanks.

[Ivan KlymenkoSpectator]

Hello guys,
we plan to work on the fix during next 3 weeks and include it into closest release.
Thanks for your patience.

[andyhParticipant]

Hi, any progress updates for this one?

[Artem LiubeznyiSpectator]

Should be fixed in the current master branch, please check. Thank you.

[Author]

Replies