[rt-users] Some users are losing their rights every night

Tue Aug 18 10:23:15 EDT 2009

I cleared the Mason cache and I will see if the issue occurs again. The user was still experiencing the problem immediately after clearing the cache though (I then assigned him Global User Rights as a workaround -- see below). 

I have not made any known local modifications to the RT codebase.

For one user, I assigned him rights under Configuration > Global > User Rights and so far this is working as a work-around for him. When he logged in next, he was able to see the permissions assigned to him. If this work-around sticks, then I am thinking the issue must be closely related to either Group Membership or Group Rights for these particular users. I will have to wait and see if he loses his rights again.

This is not an ideal situation as now he has these rights globally (and he should only have rights to specific queues). But, this is a trusted user who also uses RT very frequently so it is acceptable. I am wary to do this for the other user who also experiences this problem regularly.

Thank you all for your help and ideas. If you have any more ideas or if you know of any logs I can look at for clues, I am happy to continue troubleshooting.

Nathan Hurt
Barracuda Networks, Inc.
-----Original Message-----
From: Kenneth Marshall [mailto:ktm at rice.edu] 
Sent: Tuesday, August 18, 2009 9:13 AM
To: Ken Crocker
Cc: Nathan Hurt; 'rt-users at lists.bestpractical.com'
Subject: Re: [rt-users] Some users are losing their rights every night

On Mon, Aug 17, 2009 at 02:38:59PM -0700, Ken Crocker wrote:
> Nathan,
>
> This is certainly a conundrum. The only thing I can think of is that there 
> is some configuration setting that causes an automatic re-set OR some 
> setting that removes certain settings when RT is re-started. Something like 
> that. I have never heard of anything like this on RT for years. Sorry.
>
> Kenn
> LBNL
>
Nathan,

Have you made any local modifications to the RT codebase? Have you
tried clearing your Mason cache and restarting RT?

Cheers,
Ken

> On 8/17/2009 2:00 PM, Nathan Hurt wrote:
>>
>> Kenn,
>>
>>  
>> No. The box is still checked and I have also confirmed the group 
>> memberships are still in place. It seems like nothing has changed except 
>> they are seeing the default new user, no rights GUI when they log in. Of 
>> course, something must be changing somewhere. I just cannot seem to find 
>> it.
>>
>>  
>> Nathan Hurt
>>
>> Barracuda Networks, Inc.
>>
>> ------------------------------------------------------------------------
>>
>> *From:* Ken Crocker [mailto:kfcrocker at lbl.gov]
>> *Sent:* Monday, August 17, 2009 4:53 PM
>> *To:* Nathan Hurt
>> *Cc:* 'rt-users at lists.bestpractical.com'
>> *Subject:* Re: [rt-users] Some users are losing their rights every night
>>
>>  
>> Nathan,
>>
>> I understand your confusion. This is a tough one. I have another question. 
>> When the Users lose their rights, does the bottom box (making them 
>> privileged) on the User's profile get unchecked?
>>
>> Kenn
>> LBNL
>>
>> On 8/17/2009 12:28 PM, Nathan Hurt wrote:
>>
>> Thanks for the quick response.
>>
>>  
>> 1. I have granted all rights via the web ui.
>>
>>  
>> 2. I put users in a pre-defined group and then grant the group specific 
>> rights to different queues. There are very few exceptions to this rule. 
>> The users with the issue are exclusively assigned a group membership and 
>> the group is assigned group rights to a queue.
>>
>>  
>> 3. I don't have any daily cron jobs that I would consider out of the 
>> ordinary. This is pretty basic install across the board (RT and everything 
>> else on the server).
>>
>>  
>> 4. This does not only affect new users. I have two users who report this 
>> problem almost daily (if not, then it's probably because they haven't 
>> tried to log in to RT that day). The first user was one of the earliest 
>> users on this instance of RT. The second user was created weeks later. The 
>> other two users that have reported this issue have only reported it once 
>> (and based on their usage, it has never happened to them again).
>>
>>  
>> 5. The database is not backed up -- but you just reminded me to get on 
>> that asap J
>>
>>  
>> Nathan Hurt
>>
>> Barracuda Networks, Inc.
>>
>> www.barracuda.com <http://www.barracuda.com>
>>
>> ------------------------------------------------------------------------
>>
>> *From:* Ken Crocker [mailto:kfcrocker at lbl.gov]
>> *Sent:* Monday, August 17, 2009 2:12 PM
>> *To:* Nathan Hurt
>> *Cc:* 'rt-users at lists.bestpractical.com 
>> <mailto:rt-users at lists.bestpractical.com>'
>> *Subject:* Re: [rt-users] Some users are losing their rights every night
>>
>>  
>> Nathan,
>>
>> A couple questions first:
>>
>>    1. Do you grant all the rights via the WebUI?
>>    2. Do you put the Users in a pre-defined group or do you grant them
>>       "User" rights to those queues?
>>    3. Do you have any nightly "Cron" processes running?
>>    4. Does this happen to only the NEW users and if so, when did this
>>       start happening? I ask this because if it is only happening to
>>       new users, then I would find the cutoff date for new
>>       users/problem and see if there is a new operation, updated
>>       process, etc. that might re-set new users, but leave older ones
>>       alone.
>>    5. Is the DataBase backed up every night? If so, do they then turn
>>       around and re-load the backup, re-setting keys, indexes, etc.?
>>       If this is done nightly, maybe they are re-loading the wrong backup?
>>
>> Thiese answers should help us de-bug the problem.
>>
>> Kenn
>> LBNL
>>
>> On 8/17/2009 10:02 AM, Nathan Hurt wrote:
>>
>> HI All,
>>
>>  
>> I am new to administrating RT and I am not sure where to begin 
>> troubleshooting this problem. I have looked at the Wiki and have looked 
>> through the archived rt-users thread. I am currently using RT 3.8.2 on an 
>> Ubuntu server.
>>
>>  
>> Issue:
>>
>> Users have been granted rights through group membership and then that 
>> group is assigned to a particular queue or queues. I have confirmed that 
>> the users have been explicitly "granted rights" and allowed to "Access RT" 
>> in their user profiles. When they are initially granted rights, they have 
>> access to exactly what I have set for them. They can access queues, see 
>> tickets, comment, move tickets from queue to queue, and so on. The users 
>> leave for the day and attempt to log on the next day only to find out they 
>> do not have the correct permissions any longer. Their interface appears as 
>> if they are a user without rights.
>>
>>  
>> This does not seem to affect all users and it has never affected a 
>> SuperUser. When checking the user's profile I find that both the "rights" 
>> and "access RT" check boxes are both still checked. Also, the user still 
>> has all their normal group memberships. I do not see any reason why they 
>> should be seeing the "new user" screen. The workaround for me has been to 
>> uncheck the "rights" checkbox, save changes, re-check the "rights", and 
>> then save changes again. If the user logs out and back in, they will have 
>> the correct rights. Unfortunately, I find they will "lose" their rights 
>> within a day (sometimes this happens within one eight hour shift). I have 
>> been unable to narrow down the cause of this issue beyond what I have 
>> described.
>>
>>  
>> Out of about 100 users, I have had 4 users report this issue. Two users 
>> have this happen repeatedly and it is reported nearly every day. This is 
>> probably more widespread than I know (some users access RT every day, all 
>> day and some almost never).
>>
>>  
>> Please let me know if anyone has an idea of where to start looking for the 
>> problem or if more information is needed.  
>>  
>> Thank you,
>>
>>  
>> Nathan Hurt
>>
>> Barracuda Networks
>>
>> ----------------------------------
>> Check out the Barracuda Spam & Virus Firewall - offering the fastest virus 
>> & malware protection in the industry: www.barracudanetworks.com/spam 
>> <http://www.barracudanetworks.com/spam>
>>
>>    
>>
>> ------------------------------------------------------------------------
>>
>>
>>    _______________________________________________
>> http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users
>>  Community help: http://wiki.bestpractical.com
>> Commercial support: sales at bestpractical.com 
>> <mailto:sales at bestpractical.com>
>>   Discover RT's hidden secrets with RT Essentials from O'Reilly Media. Buy 
>> a copy at http://rtbook.bestpractical.com
>>
>> ----------------------------------
>> Check out the Barracuda Spam & Virus Firewall - offering the fastest virus 
>> & malware protection in the industry: www.barracudanetworks.com/spam 
>> <http://www.barracudanetworks.com/spam>
>>
>>  
>>
>> ------------------------------------------------------------------------
>>
>>
>>  _______________________________________________
>> http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users
>>  Community help: http://wiki.bestpractical.com
>> Commercial support: sales at bestpractical.com 
>> <mailto:sales at bestpractical.com>
>>   Discover RT's hidden secrets with RT Essentials from O'Reilly Media. Buy 
>> a copy at http://rtbook.bestpractical.com
>> ----------------------------------
>> Check out the Barracuda Spam & Virus Firewall - offering the fastest virus 
>> & malware protection in the industry: www.barracudanetworks.com/spam

> _______________________________________________
> http://lists.bestpractical.com/cgi-bin/mailman/listinfo/rt-users
> 
> Community help: http://wiki.bestpractical.com
> Commercial support: sales at bestpractical.com
> 
> 
> Discover RT's hidden secrets with RT Essentials from O'Reilly Media. 
> Buy a copy at http://rtbook.bestpractical.com

----------------------------------
Check out the Barracuda Spam & Virus Firewall - offering the fastest
virus & malware protection in the industry: www.barracudanetworks.com/spam