Hi @ronhu,

Any user who needs to login to IEE client needs to have the FND_ENUSER permission set granted. Within the structure of FND_ENDUSER, there is another permission set called FND_RUNTIME. FND_RUNTIME includes the ClientApplication activity. Therefore, please check if the user has the FND_ENDUSER permission set granted. 

If the user does have FND_ENDUSER, check it’s grant structure to see if FND_RUNTIME is included. You can also check FND_RUNTIME to verify ClientApplication activity is granted to it. As both these are Foundation1 permission sets, they should never be altered. 

Hope this helps!

@Charith Epitawatta Thank you.