24R1 - Permissions issue - No way to remove lobby Access , Once Granted

Hey,

This is working for me in 24R1 :

Stupid question but are you sure your user has access to the Revoke Entity Action ?

Can you also check if you can Revoke from the Lobby Page itself , here ?

/main/ifsapplications/web/page/LobbyConfiguration/LobbyPermissionGrants

Hi @SimonTestard 

Remove Action Already Granted

We dont have this Page

/main/ifsapplications/web/page/LobbyConfiguration/LobbyPermissionGrants

i think you are in different Service Update , Please check the SU Version ?

Big apologies @hrdilshan , just realized I actually checked in a 23R2 environment, not 24R1!

Question for you though, on the Perm set Page, if you open Page Designer, do you see the actual command for Revoke, even though it is not visible on the actual row ?

Is the command still present ?

Hi @SimonTestard 

Same available , i enabled the check box Grants and visible

and Saved and published again

and

Refresh the whole Application 
 

But Still the same 

This has a different Enabled Condition though.

Can you display the attribute FndRoleDeliveryType on against the list or the parent perm set, to see if it’s set to Custom ?

In 23R2 it checks for this (which basically is always “NORMAL” except for IFS Managed Perm Sets where it’s “IFS Managed”, and this is what prevents you from granting/revoking lobbies to IFS Managed Permission sets :

This controls activation. So there seems to be a change in 24R1 that changes the enabled condition to check some other attribute, and I checked, I can’t find that entity attribute (FndRoleDeliveryType) at all in either the list attributes or the parent perm set attributes in 23R2.

Can you check if you can see that attribute and display it ? There’s a chance it’s not going to say “Custom” hence why it’s disabled.

You can also try simple removing the Enabled condition entirely and see if the command then becomes available.

Also since you CAN see the “Add” button, can you check the command Enable condition for the Add command ? Is it the same as Revoke, also checking for FndRoleDeliveryType, or is it different?

The 'Revoke' button is only enabled when the condition record.FndRoleDeliveryType = 'Custom' is disabled.

Thanks @sanflk issue is solved now

hrdilshan wrote:

 

To be clear, you shouldn’t really just disable the Enabled condition, that’s a security limitation put in place by IFS to avoid non Custom Permission Sets being granted lobby pages (effectively blocking people from adding permissions to Permission Sets delivered by IFS themselves, such as LTUs)

What was the FndRoleDeliveryType of the Permission set you originally tried to do this with, which was IFS_LOBBY ? It looks like Custom from your first screenshot, but I’d just want to clarify that

Because if it WAS set to Custom, it SHOULD have allowed you to do it regardless. If it was NOT Custom then IFS doesn’t want you to grant lobby pages to it! :)

If it IS Custom but the button still doesn’t appear, that is absolutely a problem somewhere in the condition that should be reported to IFS RND for bug fixing.

Does the “Add” command have a different Enabled condition ? Such as maybe checking for record.parent.FndRoleDeliveryType, instead of record.FndRoleDeliveyrType ?