Question

Forms group access not applying to all members

Forms

Updated December 14, 2015

asked on November 4, 2015

Hello,

I am having an issue where the Submitter role is applied to Laserfiche groups for various form. This seemed to be working fine until a couple months ago users started losing access to all their forms. If I add the user manually the access works fine.

Groups are Laserfiche Groups that show up in Named Users in System Security. For example, I will give the CMS ALL (includes every employee) group Submitter role to a Forms process but not all of them can see it in their processes.

Running Forms 9.2 which is set to synchronize users daily and most named users have their role set to "Inherit From Group" if any of that matters.

Thank you!

1 0

Replies

replied on November 23, 2015

Hello,

I tried on Forms 9.2.1.1069 and can’t reproduce the issue. I need your help to get more information.

1. Find two users which one can inherit, one can't inherit

2. Check from admin console that the two users do belong to the group

3. Remove the group from access right then add it back, check again whether the two users can inherit submitter right from the group

If the users can’t inherit submitter right from the group, create a new group including the two users, check whether the two users can inherit submitter right from the new group.

If the two users can’t inherit submitter right from the old group but can from the new group, please check the following questions in the old group (e.g. CMS ALL group)

1. Are these two users directly added to the CMS ALL group or their group is added to CMS ALL group?

2. How many members are in CMS ALL group?

3. How many Processes is the group applied to as Submitter?

Thank you for your help!

1 0

replied on November 24, 2015

Thanks for the suggestions! The issue definitely seems to be on the user level and not the group.

I ran the tests and nothing changed when I removed the group and added it back.

I created a test group with two users and gave it rights to a process. The user that didn't have any issues can see the Form fine but the user with the issue cannot see it.

1. Users are added directly to the CMS ALL group, there are no groups in it.

2. There are 147 users in the group. It is by far our biggest group.

3. Only 6 or 7 processes. We are still getting started with Forms so most are in testing and development.

Thanks for your help.

0 0

replied on November 25, 2015

Thanks for your information!

1 List all the groups for each of the two users from admin console. If the groups they belong to are not the same, change their groups to the same.

2 Give the test group you created access rights, check whether two users can inherit submitter right from the group.

If the two users behave the same, indicating that the access right is affected by other groups.

If one can inherit and one can’t inherit, we need to confirm it is issue in Forms or in Laseriche Server.

1 Create a document in Laserfiche client and right click to go to Access right tab. Uncheck “the Inherit rights from parent and include with specified rights” check box.

2 Add the test group in access rights tab and only allow browse. Confirm both of two users can’t read the document.

3 Allow test group browse and read, check both of the two users can read the document.

If one can read and one can’t read in step 3, the issue is in Laserfiche Server, please file a support case for Laserfiche Server and provide the version of your Laserfiche Server.

If both of the two users can read the document in step 3, the issue is in Forms, please file a support case for Forms and provide detail information. You can also check whether this issue exists in System security. Change the test group to “System Administrator” and other group the two users belong to “basic user”, check whether the two users can go to administration page.

Thank you for your help!

1 0

replied on December 4, 2015 • Show version history

Thank you very much for your help!

The issue may caused by the cookies. Can you help me record some screenshots in the following situations?

User login when remember me and can’t access the form.
Log out and manually log back, access the form successfully.
The user can’t access to the form again the next day

In the screenshots, please show the Value and Expires/Max-Age of the 3 cookies: .LFFORMSGROUP( important), .LFFORMSAUTH, ASP.NET_SessionId.

Firefox： Right click the mouse>Inspect element with Firebug (need to install Firebug first)> cookies > your form site. (can show value clear than Chrome)

Chrome: Right click the mouse >Inspect element> resources > cookies> your form site.

And I still have some questions.

1 What browser are you using?

2 What will you do before next day? Close the browser, restart the computer? If you do this right now, will the user have no access right to the form immediately?

Thanks very much!

1 0

replied on December 4, 2015

Thanks Zhenghua. I will take a look at the cookies next week when people have this issue.

I do know it has occurred on both Firefox 42 and IE11. I'll also try restarting the pc and see if that resets access again.

0 0

replied on December 7, 2015 • Show version history

Here is the cookie information collected from Internet Explorer before and after logging out/in.

NoRights.png (84.52 KB)

| Download

GroupRIghts.txt (2.97 KB)

| Download

Rights.png (124 KB)

| Download

0 0

replied on December 3, 2015

While it's not quite a resolution, I did figure out how to solve the issue.

The users that are losing access to Forms with their group rights have the Remember me box checked. If they log out and manually log back in the group rights are then applied and they can access the Forms.

What's weird is we did this to fix it and then the same user was missing access to the Forms again the next day (except ones where the user is granted rights and not a group). Once again logging out and logging back in fixes the issue temporarily but I'm not sure what is causing the disconnect between the user and the assigned group rights.

0 0

replied on December 10, 2015

Cookie .LFFORMSGROUP is missing in the first screenshot. I know one case that also has no .LFFORMSGROUP cookie. It happens when you use domain\yourname@domain.com to login. If that’s the case, please use domain\yourname to login.

If you log as domain\yourname and the issue still exists, when the user can’t inherit from the group, check whether the user name is in the “domain\yourname@domain.com” format from account page.

If this can’t help you, please open a support case. Thanks!

0 0

replied on December 14, 2015 • Show version history

I am having the same issue. I found if you gradually add the user to enough Active Directory groups the .LFFORMSGROUP cookie would eventually exceed 4k and fail to get created and then the user can't access any Forms processes. I tried the troubleshooting steps Zhenghua suggested but the only thing that seems to affect the user's access was adjusting the complexity of the user's AD group membership.

See my Answers post with screenshots.

1 0

You are not allowed to follow up in this post.

Question

Question

Forms group access not applying to all members

Replies

Sign in to reply to this post.