This has been giving me a headache all morning, and some of it could be my stupid assumptions, but here we go. We have an AD group for our first level support team that grants them the ability to see certain nodes for a service. This AD group has been granted access, with account limitations with "group of groups", "group of nodes", and "group of application names". The "Group of Groups" allows them to see the general structure based on our groupings, the "Group of Nodes" then grants them access to those specific nodes, because apparently granting access to the group doesn't let them see the actual node members. Up to this point, I'm fine. The users in the AD group can now see the groups, the nodes, and the SAM application templates that are assigned to the nodes, and the associated status for node/application. The problem is, the users cannot click through the applications/components. So I assumed this was because I'd not granted access to the application. Here is what I've done:
- Group of Application Names (then selected all the applications that are applicable)
- Group of Application Templates (then selected all the applications that are applicable)
- Specific Applications (then clicked through all the applications on all the nodes that are applicable)
When they click on an application name, or a component, on any of the nodes they have access to, they get the error:
You do not have permission to view Net Object "AA:69"
The application ID changes depending on what item clicked, but the error is still the same, no matter how I grant the limitations. I've verified the AD group is added as a SAM "user" role, rather than "admin". Anybody got any clue as to what I'm doing wrong?