Project Access in 25R1

As far as I know, the Project Access Logic does not check whether a user is an administrator at all. It does check if the user is the AppOwner (IFSAPP) but that’s a special use case.

The typical checks one are :

WHERE (EXISTS (SELECT 'X' FROM  project_access_on pao
                           WHERE pao.project_id = PROJECT_TAB.project_id)
OR     EXISTS (SELECT 1    FROM  Person_Info_tab pi
                           WHERE pi.person_id = PROJECT_TAB.manager
                             AND pi.user_id   = Fnd_Session_API.Get_Fnd_User)
OR     EXISTS (SELECT 1   FROM  Fnd_Session f WHERE f.Fnd_user = Fnd_Session_API.Get_App_Owner)
OR     EXISTS (SELECT 1   FROM Fnd_Session f, person_info_tab pi, team_member_tab tm, project_access_definition_tab pc 
                          WHERE pi.user_id = f.Fnd_User 
                            AND tm.person_id = pi.person_id 
                            AND tm.team_id = pc.team_id 
                            AND pc.project_id = project_tab.project_id
                            AND NOT EXISTS (SELECT 1 
                                            FROM sub_project_tab sp 
                                            WHERE sp.project_id = Project_tab.project_id))
OR     access_on_off  = 0)

So there’s a few different checks such as the logged in user being IFSAPP, the Project Access checks being set to Off, logged in user being the project manager, or the user being part of the defined project access rules.

I’m not seeing any real difference in these checks in 25r1.

But if you can’t approve the ones where you are actually set up as the manager for the project and all sub projects that sounds a bit weird, could you show us an example ?

Which user are you using ? (A regular end user or a system user)

Hi Simon,

thank you very much for your response. We also investigated the issue a little bit and found out the following:
 

Procedure SUB_PROJECT_API.Check_Access_To_Entire_Project 
Contains  user_sub_projects cursor:
   

CURSOR user_sub_projects IS
      SELECT count(*)
      FROM   sub_project
      WHERE  project_id = project_id_;
-> SUB_PROJECT view: 

SUB_PROJECT view contains the following condition:
WHERE EXISTS (SELECT 'X' FROM project_access_on pao
                         WHERE pao.objkey = sub_project_tab.rowkey) 

Unfortunately, sub_project_tab.rowkey is NOT populated if a project is created as a copy of a project already existing in IFS. This is a great majority of our projects.

If a new project including the whole structure is entered manually or imported from MS Project, sub_project_tab.rowkey is populated.

We are using regular end user.

Br
Antonin

I am also adding an example SUB_PROJECT_TAB records of 3 projects created in different ways each:
'NGA10291' - created by importing from MS Project

'NGA10299' - created as a copy of a project already existing in IFS (NGA10291 in this case) 

'NGA10301' - created manually

please see thye attache file ‘25R1 Project Access Issue.png’

Br

Antonin

Ok, thanks for the addition because it’s very easy to follow what went wrong now. The rowkey not being populated is actually a fairly concerning sign, because that really should always be populated on insert as a guid.

I’d definitely recommend raising this as a bug in your support center, clearly outlining that this happens when you copy a project, and add the screenshot you’ve just shown us here.

Hello OROMLCAK,

We are running into this same issue, did you open a case with IFS support/ did you hear anything back?

Side note, if you activate the rowkey on the entity then I think it solves the problem.

Thanks

Hello Ian,

we had to activate ROWKEY in SUB_PROJECT_TAB.
Go to Entity page, query for SubProject entity and set Rowkey to active (Yes), using ‘Activate Rowkey’ button at the top.

This will generate the missing rowkeys in SUB_PROJECT_TAB and the project access is enabled.

I hope this helps

See the attachments also

Best regards

Antonin

Looks like that solves our problem, thanks for the help Antonin!

Has this been solved without having to go in an change things as a customer? We aim to upgrade to 25R1 soon and we are heavy on Projects, but we hope for a seamless upgrade.