New tool: Access Checker
Hello everyone,
It's been a while that I'm back but I have a lot of work and so little time for this blog.
However, things promise is a promise, here is a small tool that could make your life easier.
Have you ever encountered this error message:
SecLib::AccessCheckEx failed. Returned hr = -2147187962, ObjectID: 1ef9f412-6601-dd11-8655-0019b9dfe618, OwningUser: 98bbc999-96a2-de11-aeaf-0019b9dfe227 and CallingUser: 037c1c90-96a2-de11-aeaf-0019b9dfe227
You do not really know what object and what user it is and especially what rights might fail him. With this tool, you can put all these IDs and know what are the privileges of the user regarding this record.
- Indicate which entity you want to inspect
- Enter the identifier of the object in question
- Searching for a user with its name or its unique identifier
As usual, if you need improvment or detect a bug, do not hesitate to contact me
The tool can be downloaded just below (and in the archive with all tools)
Comments
Welcome back! This is a very useful application. Good work.
If you ever find yourself making other changes to this app, I can see it being useful to see the ID in CRM that corresponds to the each privilege (create, read, ect). When you scroll over the privilege you would see the GUID for that privilege. I mention this because sometime CRM throws back an error message mentioning the privilege ID that the current user is lacking. It would be useful to be able to match up the privilege with the ID. Then again, you can always run a simple SQL query to get the privilege that's failing.
Just wanted to throw out the suggestions.
Great app!
-Andrew Zimmer
Your idea is interesting, I will add this when I have time (which doesn't seem to happen soon :/)
Thanks anyway for the feedback
Maybe I'm doing something wrong?
1- I specify a connection name (I guess anything goes)
2- I use the windows integrated Authentication. My active directory user is a CRM admin, so it should be okay.
3- I don't check SSL or IFD
4- I specify the server name. I guess you only give the server name. So no special format like: "http://myserver/myorg". I only put: "myserver"
5- I specify the port
6- I press "get orgs" and it crashes at this point.
Can someone give me a hand?
Thanks in advance!
But if ut crashed, it seems that something is wrong in your configuration (name or port, for example)
One thought.. Is there a way to determine what type of entity an objectID is? I had to try several entity types getting failures (no object ID of that type) before I figured out which type I was dealing with.
My issue was that a salesperson could not create a quote from an opportunity that had been assigned to him. Turned out you need to have the Append and Append To rights on the Account record... These rights also allow the salesperson to Create Order from an Active quote.
Thanks again.
Doug
Unfortunately, it is not possible to determine the entity from the ID...
I could add a global search through all entities but that would take a very long time to proceed...
The true goal of this tool is to avoid you to browse all roles of a user to determine which privileges he has or not regarding a specific record
SecLib::AccessCheckEx failed. Returned hr = -2147187962, ObjectID: 6879CD2C-5C4A-E011-BD80-001AA0C35C21 , OwningUser: 8848f924-d62d-df11-881a-001aa00c35c21 and CallingUser: 4469c4a2-182a-e011-b294-0011aa00c35c21
when I chek the objekt with ID 6879CD2C-5C4A-E011-BD80-001AA0C35C21
help me, please)
CRM 4.0 tools I developed are just designed for OnPremise and IFD deployments
I don't have time to do it...
If you can give me an email address, I will send it to you
Very helpful tool.
I find an unwanted privilege ID but how can I find out which Security Role/Sharing/or Assignment caused this unwanted access?
Very helpful tool.
I find an unwanted privilege ID but how can I find out which Security Role/Sharing/or Assignment caused this unwanted access?
The only way is to review all roles for that specific privilege. If you can't find it, then you have to look in the sharing dialog. If it is not there, it could also be an inherited sharing (see parent record sharing dialog)
Recently we faced to a new problem with MS CRM 4 User's access to others objects: Some users have unwanted access rights to other business units that they prohibited in their Roles definitions. Therefore we need to track and find out which Role, Sharing, or assignment is the source of this problem?! Can you help me? (any recommend in SQL will be helpful + I have the unwanted privilege ID with Access Checker)
If not, is there any way to reset/reconfigure/rebuild every privileges to the whole of microsoft crm 4 database?
But you can look in the table PrincipalObjectAccess. This table list all security access.
If the column AccessRightMask is filled, then it is an explicit sharing. if the column InheritedAccessRightMask is filled, then it is an inherited sharing (see parent record).
The column ObjectId refers to the entity record
The column PrincipalId refers to a team or a user
Can you write a simple a sql for listing all parent records of an entity please?