iwgroup remove/add users through program - Permission denied error

Hi,

We are trying to add/remove users through a perl program, which is called in assignment workflow.

iwgroup remove-users GRPNAME DomainUser1 DomainUser2 DomainUser3

ERROR:00013: Permission denied

We opened the group through Admin UI, so we came out of the screen. Is there any permission restriction on iwgroup usage? Like, when an admin is using the assignment workflow then only iwgroup will work. Please advice...

Thanks.

Env: TS 6.7.2 SP2,Windows 2003

Find more posts tagged with

Comments

Adam Stoller

Hi,

We are trying to add/remove users through a perl program, which is called in assignment workflow.

iwgroup remove-users GRPNAME DomainUser1 DomainUser2 DomainUser3

ERROR:00013: Permission denied

We opened the group through Admin UI, so we came out of the screen. Is there any permission restriction on iwgroup usage? Like, when an admin is using the assignment workflow then only iwgroup will work. Please advice...

Thanks.

Env: TS 6.7.2 SP2,Windows 2003

Are you trying to actually change the membership of a group - or the group that is assigned to a grouptask in the workflow?

The method you're describing would do the former and requires that the user performing the command have the permissions to modify group membership (either as the Manager of the group or as an Admin or Master user)

If you want to change the sharedby value for a grouptask spend a bit more time looking at the perldoc for TeamSite::WFtask

Srinivasa Talla

"Ghoti" - Thanks alot - you put me in right direction. The person, who is trying to change the group members through program(part of workflow), is just an existing member of the group. This is existing working code of TS 6.5. Now we need to make sure that the Assigner should be a manager in the code. We tested the same code by making the user as manager, it is working fine.

Is this same with unlocking files through program in a workflow?

Is there any way to run the above commands through program as a manager/admin on the fly(without actually making the user as manager)?

Adam Stoller

"Ghoti" - Thanks alot - you put me in right direction. The person, who is trying to change the group members through program(part of workflow), is just an existing member of the group. This is existing working code of TS 6.5. Now we need to make sure that the Assigner should be a manager in the code. We tested the same code by making the user as manager, it is working fine.

Is this same with unlocking files through program in a workflow?

Is there any way to run the above commands through program as a manager/admin on the fly(without actually making the user as manager)?

If the user is not an Admin or Master and also not a Manager of the group, I don't believe that TeamSite will allow them to alter the group membership (or delete the group itself) - period. How you work-around that issue is a matter of design, which is up to you at this point.

Srinivasa Talla

That is true while using the User Interface. But when we are using commands from a perl program, we were thinking the program will run with system/admin privileges. So it is not correct. If someone confirms the possibility to mimic like that, it would be really helpful.

nipper

That is true while using the User Interface. But when we are using commands from a perl program, we were thinking the program will run with system/admin privileges. So it is not correct. If someone confirms the possibility to mimic like that, it would be really helpful.

That would be a serious security hole in TeamSite if the command line let you do things you shouldn't

Srinivasa Talla

That would be a serious security hole in TeamSite if the command line let you do things you shouldn't

That is true. So the conclusion is - whatever the rules we have for UI will apply for command prompt(CLT) usage also.

What would be the best command(CLT) for changing a member of group as Manager?

Adam Stoller

That is true. So the conclusion is - whatever the rules we have for UI will apply for command prompt(CLT) usage also.

What would be the best command(CLT) for changing a member of group as Manager?

My guess would be

iwgroup add-admins group admin(s)

run by a TSMaster or someone who is already an admin for that group.

Srinivasa Talla

Thanks for your quick advice. It may be true, because I didn't find anything to add as manager. Little bit confusion - In the UI, they used 'Managers', but in CLT it is 'Admins'. Anyway the meaning is same. Thanks.