CA Client Automation

What permissions are needed in security profiles for a user to be able to archive a software package?  The profile has (CVRWXD) to Software Package.

Those permissions should be sufficient to archive the package, but if the action is being denied, perhaps you need to look at the permissions on ‘upstream’ objects, i.e. software groups the package is a member of. Bear in mind that package archival also requires a write to all the groups the package is a member of, including ‘All Software Packages’, so the user would require write privileges to those groups as well. I’m not sure, but archival may also require a write to computers the package is deployed to so that also could be an issue.

Steve McCormick, ITIL

CA Technologies

Principal Services Consultant

Tel: +1-731-676-4223

Stephen.McCormick@ca.com

<mailto:Stephen.McCormick@ca.com>

The software is not a member of any software group other than ALL SOFTWARE.  It has permissions errors on packages which have not been staged/deployed also.

What are the users permissions on ‘All Software’?

Steve McCormick, ITIL

CA Technologies

Principal Services Consultant

Stephen.McCormick@ca.com

<mailto:Stephen.McCormick@ca.com>

Class Default (VRWXD)

Just a hunch, try giving him C as well. May not make a difference but stranger things have happened.

Steve McCormick, ITIL

CA Technologies

Principal Services Consultant

Stephen.McCormick@ca.com

<mailto:Stephen.McCormick@ca.com>

I don't see a 'C' permission for ALL SOFTWARE.

take a look at page 32 https://docops.ca.com/ca-client-automation/14-0/en/files/281709466/325070984/1/1459327198538/CA+IT+Client+Manager+Object… 

This may help

regards

Rich

I found that I had to give access to the AD Group to the Program Files (x86)\CA\DSM\SD\ASM\LIBRARY folder.  The AD group tied to the ITCM Security Profile does not have direct access to logon/manage the DM.  Shouldn't ITCM allow it based on the security profile?

Checking the permissions on the library folders was going to be my next suggestion. ITCM does not control those permissions. For a user to create, delete or modify the source of a package, they must have sufficient permissions in windows to access the library file structure.

Steve McCormick, ITIL

CA Technologies

Principal Services Consultant

Stephen.McCormick@ca.com

<mailto:Stephen.McCormick@ca.com>

Before adding the file permissions, the user could create a package, add a source, procedure, and seal.

When archiving, it has a permission error.

They are able to delete a package, just not archive.  I found a work around, but want to make sure there isn't something wrong within ITCM.

I should add, it is when archiving with 'purge files' checked.

The access to the SD Library is a very old quirk of the product! If the SD Agent on the computer running the DSM Explorer is configured for Nos-Less download then I believe no direct library access is required.

Yes that is true, but this is specifically related to a user making changes to a package (in this case archiving) via the GUI. Nothing to do with Agent download of a package from the SS.

I do feel that this could probably quite easily be corrected by having the API (and therefore the service running on the DM) perform the actions on the library on behalf of the user.

Steve McCormick, ITIL

CA Technologies

Principal Services Consultant

Stephen.McCormick@ca.com

<mailto:Stephen.McCormick@ca.com>

Hi Bill,

I could reproduce the error message "Copy Error: Access Violation [SDM080003] when trying to archive a package.

Using Process Monitor on Domain Manager I could see that process sd_apisrv.exe has an ACCESS DENIED on rsw.dat file of the package using the logged user on the console :

The solution is to give NTFS Full Control access to this user under C:\Program Files\CA\DSM\SD\ASM\LIBRARY (recursively) 

Thanks.

Regards

Jean-Yves