Solved

Importing permission sets doesn't grant everything?

  • 8 September 2021
  • 4 replies
  • 315 views
NickPorter
Rank
Userlevel 6
Badge +18

We are seeing an issue in Apps9 UPD17 when exporting and importing a large permission set to create a cloned permission set.  It is a large but simple permission set with no hierarchy/structure.

It exports fine and generates a file that is very large (14MB).  However when it is imported it results in a new permission set with some things only partially granted or not granted at all that should be fully granted. 

The following message occurs when the import completes, always on the same ‘SYS.ALL_TABLES’:

As a verification test, if I immediately export the new clone permission after import, the XML file that is created then is about 1.5MB smaller than the one that was imported to create it.

Something is not importing cleanly, possibly based on the file size, possibly based on the error shown, maybe due to some kind of timeout?  The import process takes about 6-7 minutes.

Has anyone else encountered this?

icon

Best answer by NickPorter 8 September 2021, 19:17

View original
This topic has been closed for comments

4 replies

R
Rank
Userlevel 5
Badge +12

Hi @NickPorter 

I have seen the this with even smaller permissions sets and exporting as .sql and deploying through sqlplus always helped in such scenarios 

Cheers, Ruchira
NickPorter
Rank
Userlevel 6
Badge +18

Thanks @Ruchira.  I had forgotten about the SQL export/import process.  That probably would have worked well.

In the meantime I found that if I ran the XML import more than once it seemed to work OK. 

So... I run the XML import once to initially create the new permission set, then after getting the error shown in my posting, I then run it again and choose ‘Merge’ for the subsequent imports.  I did that until the only errors that were reported were ones I would expect (e.g. trying to grant to projections that do not exist in this environment).  The good news is that the n+1 runs of the import using Merge option run much faster than the initial import, and so far it looks like this has resulted in a clean clone.

Nick

 

durette
Rank
Userlevel 7
Badge +18

We’ve encountered this, too. The XML export only includes IFSAPP and IFSINFO objects and doesn’t include Oracle system privileges, grants to non-IFS roles, or grants on SYS objects.

 

FND_RUNTIME, for example, is supposed to have the CREATE SESSION privilege. Exporting and reimporting it will basically break the whole application.

If you find this forum useful, please consider paying back to the community in your own areas of expertise. -- Kevin Durette - https://www.linkedin.com/in/kevindurette
NickPorter
Rank
Userlevel 6
Badge +18

Thanks @durette .  I can totally understand those special roles with direct non-IFS objects, but the weird thing here is that the role being exported as XML is just a role created in Solution Manager, so I don’t understand why it would be trying to get involved with non-IFSAPP or non-IFSINFO objects?  It also is strange that running it, having it fail to import fully, then rerunning the import using the Merge option ends up (apparently) working.  Really feels like its running into some kind of timeout or ‘overload’ when trying to do the first import, and then the subsequent merges into the already-created role just efficiently apply the differences (i.e. the missing grants).

 

Terms & ConditionsCookie settings