Clarity

Hello

I am a system administrator and have full access right.

There is a project, on its Teams -Participants page, there is only one person, who no longer works.

The project manager is not a collaboration manager hence not able to add participants or make any one collaboration manager.

How can I grant access right to make the project manager a collaboration manager?

Please advise.

Thank you.

Hi,

Only a collaboration manager can add more participants and make them as collaboration manager. Even a user with full admin access cannot do it if he is not the collaboration manager.

I created a script to add a specific user as collaboration manager for all active projects and will share that with you in sometime. You can set it to run each night or as you like so that all projects will have admins set as collab mgr.

Also, if your organisation creates projects using templates, it is a best practice to add atleast one admin or generic user as collaboration manager in the template.

Thanks,

Ashmi

Hi,

Collaboration manager can only add participants or make any one collaboration manager.

There is knowledge to add participants or make any one collaboration manager by XOG.

I hope it is helpful for you.

How to XOG in a Participant or Collaboration Manag - CA Knowledge 

Regards,

Shoichi

This worked fine.

Many thanks.

use the script below in a process to add collab mgr to all active prj where the specified user is not already a collab mgr. Provide xog user and collab mgr username in custom script parameters

<gel:script xmlns:core="jelly:core"
xmlns:gel="jelly:com.niku.union.gel.GELTagLibrary"
xmlns:file="jelly:com.niku.union.gel.FileTagLibrary"
xmlns:soap="jelly:com.niku.union.gel.SOAPTagLibrary"
xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"
xmlns:sql="jelly:sql" xmlns:util="jelly:util"
xmlns:xog="http://www.niku.com/xog"
xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:xsl="http://www.w3.org/1999/XML/Transform">

<!-- Set datasource -->
<gel:setDataSource dbId="Niku"/>
<!--INITIALISATION: Set Parameters, Output Header-->
<gel:parameter default="1" var="DEBUG"/>
<gel:parameter default="" var="v_xogUserId"/> <!-- give user ID that has XOG rights and will be used to perform XOG -->
<!-- Parameter for collaboration manager -->
<gel:parameter default="" var="Collaboration_Mgr_Username"/> <!-- provide user you want to set as collaboration manager -->
<!-- Error Flag variable-->
<core:set value="false" var="v_errorFlag"/>

<!-- Retrieve a Session ID to be sent with the XOG package as authentication -->
<core:if test="${v_errorFlag == false}">
<core:catch var="v_exception">
<!--Invoke class instances-->
<core:new className="com.niku.union.security.DefaultSecurityIdentifier" var="v_secId"/>
<core:invokeStatic className="com.niku.union.security.UserSessionControllerFactory" method="getInstance" var="userSessionCtrl"/>
<!--Log into clarity by initialising class instance-->
<core:set value="${userSessionCtrl.init(v_xogUserId, v_secId)}" var="v_secId"/>
<core:set value="${v_secId.getSessionId()}" var="v_thisSessionId"/>
<!-- <gel:log category="GEL" level="INFO">session id - ${v_thisSessionId}</gel:log> -->
</core:catch>
<core:if test="${v_exception!=null}">
<core:set value="true" var="v_errorFlag"/>
<gel:out>[GEL] Unable to retrieve a Session ID: ${v_exception}</gel:out>
<gel:log category="GEL" level="ERROR">Unable to retrieve a Session ID: ${v_exception}</gel:log>
</core:if>
</core:if>

<!--Retrieve the clarity application server URL-->
<core:if test="${v_errorFlag == false}">
<core:invokeStatic className="com.niku.union.config.ConfigurationManager" method="getInstance" var="v_config"/>
<!--Always use Scheduler URL first-->
<core:set value="${v_config.getProperties().getWebServer().getSchedulerUrl()}" var="v_clarityURL"/>
<!--If Scheduler URL is not set use the Application Server Entry URL-->
<core:if test="${v_clarityURL == ''}">
<core:switch on="${v_config.getProperties().getWebServer().getWebServerInstance(0).getId()}">
<core:case value="nsa">
<core:set value="${v_config.getProperties().getWebServer().getWebServerInstance(1).getEntryUrl()}" var="v_entryURL"/>
</core:case>
<core:default>
<core:set value="${v_config.getProperties().getWebServer().getWebServerInstance(0).getEntryUrl()}" var="v_entryURL"/>
</core:default>
</core:switch>
<core:set value="${v_entryURL}" var="v_clarityURL"/>
</core:if>
<util:tokenize delim=":" var="v_urlComponents">${v_clarityURL}</util:tokenize>
<core:set value="${v_urlComponents.get(0)}://" var="v_httpMethod"/>
<core:set value="${v_urlComponents.get(1)}" var="v_serverName"/>
<util:tokenize delim="/" var="v_serverName">${v_serverName}</util:tokenize>
<core:set value="${v_serverName.get(0)}" var="v_serverName"/>
<core:set value="${v_urlComponents.get(2)}" var="v_portNumber"/>
<!--Determine if port number is present in entry URL. If not use App Server Entry port. This section is not working with ondemand so changed action to ignore the port if a port is present-->
<core:choose>
<core:when test="${v_portNumber != null}">
<core:set value="${v_config.getProperties().getWebServer().getWebServerInstance(0).getPort()}" var="v_portNumber"/>
</core:when>
<core:otherwise>
<util:tokenize delim="/" var="v_portNumber">${v_portNumber}</util:tokenize>
<core:set value="${v_portNumber.get(0)}" var="v_portNumber"/>
</core:otherwise>
</core:choose>
<core:set value="${v_httpMethod}${v_serverName}:${v_portNumber}/niku/xog" var="v_clarityURL"/>
</core:if>


<!-- SQL STATEMENT: Read Collaboration Manager information-->
<gel:log category="GEL" level="INFO">Reading Collaboration Manager information...</gel:log>
<core:if test="${v_errorFlag == false}"> <!--b1-->
<core:catch var="v_exception">
<sql:query var="v_collabmgr" escapeText="false"><![CDATA[
select
cmn.external_id COLLAB_MGR_EXTERNAL_ID
, decode(cmn.language_id, 1, 'English', '') xog_userLanguage
, cmn.user_name xog_userName
, decode(cmn.user_status_id, 200, 'ACTIVE', 201, 'INACTIVE', 201, 'LOCK') user_status
, decode(srm.is_external,1, 'EXTERNAL', 0, 'INTERNAL') xog_userType
, srm.EMAIL COLLAB_MGR_EMAIL
, srm.FIRST_NAME COLLAB_MGR_FIRST_NAME
, srm.LAST_NAME COLLAB_MGR_LAST_NAME
, srm.unique_name xog_resourceId
from
SRM_RESOURCES srm, cmn_sec_users cmn
where
cmn.id = srm.user_id
and cmn.user_name in ('${Collaboration_Mgr_Username}')
]]>
</sql:query>
<!-- <gel:log category="GEL" level="INFO">row count - ${v_collabmgr.rowCount}</gel:log> -->
</core:catch>

<core:if test="${v_exception != null}">
<gel:log category="SQL ERROR" level="ERROR">Unable to retrieve Data from DB: ${v_exception}</gel:log>
<gel:out>[SQL ERROR] Unable to retrieve data from DB: ${v_exception}</gel:out>
<core:set value="true" var="v_errorFlag"/>
</core:if>

<core:if test="${v_collabmgr.rowCount == 0 and v_errorFlag == false}">
<gel:log category="SQL STATUS" level="STATUS">SQL returned no rows: ${v_collabmgr.rowCount}, no username/ incorrect username given for Collaboration Manager in process custom parameter</gel:log>
<gel:out>SQL returned no rows: ${v_collabmgr.rowCount}, no username/ incorrect username given for Collaboration Manager in process custom parameter</gel:out>
<core:set value="true" var="v_errorFlag"/>
</core:if>

<core:if test="${v_collabmgr.rowCount != 0 and v_errorFlag == false}"> <!-- block 1 -->
<!-- <gel:log category="GEL" level="INFO">entering block 1...</gel:log> -->
<core:forEach items="${v_collabmgr.rowsByIndex}" trim="true" var="row">
<core:set var="v_COLLAB_MGR_EXTERNAL_ID">${row[0]}</core:set>
<core:set var="v_xog_userLanguage">${row[1]}</core:set>
<core:set var="v_xog_userName">${row[2]}</core:set>
<core:set var="v_user_status">${row[3]}</core:set>
<core:set var="v_xog_userType">${row[4]}</core:set>
<core:set var="v_COLLAB_MGR_EMAIL">${row[5]}</core:set>
<core:set var="v_COLLAB_MGR_FIRST_NAME">${row[6]}</core:set>
<core:set var="v_COLLAB_MGR_LAST_NAME">${row[7]}</core:set>
<core:set var="v_xog_resourceId">${row[8]}</core:set>
<!-- Uncomment to debug
<gel:log category="GEL" level="INFO">v_COLLAB_MGR_EXTERNAL_ID - ${v_COLLAB_MGR_EXTERNAL_ID}</gel:log>
<gel:log category="GEL" level="INFO">v_xog_userLanguage - ${v_xog_userLanguage}</gel:log>
<gel:log category="GEL" level="INFO">v_xog_userName - ${v_xog_userName}</gel:log>
<gel:log category="GEL" level="INFO">v_user_status - ${v_user_status}</gel:log>
<gel:log category="GEL" level="INFO">v_xog_userType - ${v_xog_userType}</gel:log>
<gel:log category="GEL" level="INFO">v_COLLAB_MGR_EMAIL - ${v_COLLAB_MGR_EMAIL}</gel:log>
<gel:log category="GEL" level="INFO">v_COLLAB_MGR_FIRST_NAME - ${v_COLLAB_MGR_FIRST_NAME}</gel:log>
<gel:log category="GEL" level="INFO">v_COLLAB_MGR_LAST_NAME - ${v_COLLAB_MGR_LAST_NAME}</gel:log>
<gel:log category="GEL" level="INFO">v_xog_resourceId - ${v_xog_resourceId}</gel:log>
-->
</core:forEach>

<!-- Create the XOG WRITE XML shell using the variables -->
<gel:parse var="v_xml_root">
<NikuDataBus xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../xsd/nikuxog_user.xsd">
<Header action="write" externalSource="NIKU" objectType="user" version="14.2.0.237"/>
<Users>
<User externalId="${v_COLLAB_MGR_EXTERNAL_ID}" userLanguage="${v_xog_userLanguage}" userName="${v_xog_userName}" userStatus = "${v_user_status}" userType="${v_xog_userType}">
<PersonalInformation emailAddress="${v_COLLAB_MGR_EMAIL}" firstName="${v_COLLAB_MGR_FIRST_NAME}" lastName="${v_COLLAB_MGR_LAST_NAME}"/> <Resource resourceId="${v_xog_resourceId}"/>
<Groups>

</Groups>
</User>
</Users>
</NikuDataBus>
</gel:parse>
<!-- printing write xml file shell-->
<!--uncomment to debug-->
<!--
<gel:log>
<gel:expr select="$v_xml_root"/>
</gel:log> -->

</core:if> <!--end of block 1 if -->
</core:if> <!--end of b1 -->

<!-- Get list of projects for which user is not collaboration manager -->
<gel:log category="GEL" level="INFO">Getting list of projects...</gel:log>
<core:if test="${v_errorFlag == false}"> <!-- b2 -->
<core:catch var="v_exception">
<sql:query var="v_prj_list" escapeText="false"><![CDATA[
SELECT
INV.ID INV_ID
, INV.NAME INV_NAME
, INV.CODE INV_CODE
, ('CLB_PROJECT_MANAGERS'||(to_char(INV.ID))) Collab_GROUP_ID
, ('project '||(to_char(INV.ID)||'CM group')) Collab_GROUP_NAME
, ('CLB_PROJECT_MEMBERS'||(to_char(INV.ID))) participant_GROUP_ID
FROM INV_INVESTMENTS INV
JOIN INV_PROJECTS P ON P.PRID = INV.ID
JOIN SRM_RESOURCES srm ON srm.USER_ID = (select id from cmn_sec_users where user_name like '${Collaboration_Mgr_Username}')
, cmn_sec_users cmn
WHERE
cmn.id = srm.user_id
and INV.ODF_OBJECT_CODE = 'project'
and inv.is_active = 1
AND P.IS_TEMPLATE = 0
AND srm.USER_ID NOT IN (SELECT USER_ID
FROM CMN_SEC_USER_GROUPS
WHERE GROUP_ID= (SELECT ID FROM CMN_SEC_GROUPS G
WHERE G.GROUP_ROLE_TYPE='SEC_GROUP_TYPE'
AND G.PRINCIPAL_TYPE='CLB_PROJECTS'
AND G.GROUP_CODE = 'CLB_PROJECT_MANAGERS' || To_char(INV.ID)
AND G.PRINCIPAL_ID = INV.ID)
)
]]>
</sql:query>
<gel:log category="GEL" level="INFO">Number of projects - ${v_prj_list.rowCount}</gel:log>
</core:catch>

<core:if test="${v_exception != null}">
<gel:log category="SQL ERROR" level="ERROR">Unable to retrieve Data from DB: ${v_exception}</gel:log>
<gel:out>[SQL ERROR] Unable to retrieve data from DB: ${v_exception}</gel:out>
<core:set value="true" var="v_errorFlag"/>
</core:if>

<core:if test="${v_prj_list.rowCount == 0 and v_errorFlag == false}">
<gel:log category="SQL STATUS" level="STATUS">SQL returned no rows: ${v_prj_list.rowCount}, user ${v_COLLAB_MGR_FIRST_NAME}, ${v_COLLAB_MGR_LAST_NAME} is already set as collaboration manager for all active projects</gel:log>
<gel:out>SQL returned no rows: ${v_prj_list.rowCount}, user ${v_COLLAB_MGR_FIRST_NAME}, ${v_COLLAB_MGR_LAST_NAME} is already set as collaboration manager for all active projects</gel:out>
<core:set value="true" var="v_errorFlag"/>
</core:if>


<core:if test="${v_prj_list.rowCount != 0 and v_errorFlag == false}"> <!-- block 2 -->

<!-- generating Group tag for Participant group -->
<core:forEach items="${v_prj_list.rowsByIndex}" trim="true" var="row2">
<core:set var="v_participant_GROUP_ID">${row2[5]}</core:set>
<!-- insert participant Group tag for each project into write xml shell under Groups tag -->
<gel:parse var="v_grouptag_part">
<Group id="${v_participant_GROUP_ID}"/>
</gel:parse>
<!-- insert Group tag for each project, collaboration and participant group into write xml shell under Groups tag -->
<gel:set insert="true" select="$v_xml_root/NikuDataBus/Users/User/Groups" value="${v_grouptag_part}"/>
</core:forEach>

<!-- generating Group tag for collaboration Manager group -->
<core:forEach items="${v_prj_list.rowsByIndex}" trim="true" var="row2">
<core:set var="v_Collab_GROUP_ID">${row2[3]}</core:set>
<core:set var="v_Collab_GROUP_NAME">${row2[4]}</core:set>
<gel:parse var="v_grouptag_collab">
<Group id="${v_Collab_GROUP_ID}">
<nls languageCode= "en" name="${v_Collab_GROUP_NAME}"/>
</Group>
</gel:parse>
<!-- insert collaboration manager Group tag for each project into write xml shell under Groups tag -->
<gel:set insert="true" select="$v_xml_root/NikuDataBus/Users/User/Groups" value="${v_grouptag_collab}"/>
</core:forEach>


<!-- Printing complete Write XML file -->
<gel:log category="XOG" level="INFO">printing write XML file... </gel:log>
<gel:log>
<gel:expr select="$v_xml_root"/>
</gel:log>


<!-- XOG into Clarity -->
<core:catch var="v_xog_exception">
<soap:invoke endpoint="${v_clarityURL}" var="runresult">
<soap:message>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xog="http://www.niku.com/xog">
<soapenv:Header>
<xog:Auth>
<xog:SessionID>${v_thisSessionId}</xog:SessionID>
</xog:Auth>
</soapenv:Header>
<soapenv:Body>
<gel:include select="$v_xml_root/NikuDataBus"/>
</soapenv:Body>
</soapenv:Envelope>
</soap:message>
</soap:invoke>
</core:catch>

<core:choose>
<core:when test="${v_xog_exception != null}">
<gel:log category="XOG" level="WARNING">XOG failed.</gel:log>
</core:when>
<core:otherwise>
<gel:set select="$runresult/soapenv:Envelope/soapenv:Body/XOGOutput" var="writeOutputRoot"/>
<gel:log category="XOG" level="INFO">runresult - ${runresult}</gel:log>
<gel:log category="XOG" level="INFO">v_xog_exception - ${v_xog_exception}</gel:log>

<!-- Display Write Output XML -->
<gel:log>
<gel:expr select="$runresult"/>
</gel:log>
</core:otherwise>
</core:choose>


<!-- CLOSE DOWN THE SESSION -->
<soap:invoke endpoint="${v_clarityURL}" var="logoutresult">
<soap:message>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xog="http://www.niku.com/xog">
<soapenv:Header>
<xog:Auth>
<xog:SessionID>${v_thisSessionId}</xog:SessionID>
</xog:Auth>
</soapenv:Header>
<soapenv:Body>
<xog:Logout/>
</soapenv:Body>
</soapenv:Envelope>
</soap:message>
</soap:invoke>

<gel:log category="XOG" level="INFO">logoutresult- ${logoutresult}</gel:log>

</core:if> <!--end of block 2 if -->
</core:if> <!-- end of b2 -->

</gel:script>

In addition to the technical responses provided by Ashmi and Shoichi, can I suggest to future proof you against this situation again that you add yourself and the other system admins in your team to all your project templates as participants and collaboration managers.

Re-activate the user account who has left.

Log on as that user.

Make your admin user a collaboration manager on the project.

De-activate the user account who has left.

I cannot log on as the user account because we have single sign on enabled.

To turn off SSO temporarily, it has to go through lengthy bureaucratic  process.

To David's point, you can switch off the SSO authentication for a specific "CA PPM" user, and should be able to logon as that user through On-Demand and then into CA PPM.

Like you have noted though, I would get approval from your info-sec team first.

well, I don't know how specific users can get logon screen by switching off the SSO individually?

In NSA, if SSO is ticked, then no one will get the logon screen.

Specific users can't turn off SSO - this has to be done from the 'Administration' menu => 'Resources' and you unselect "External Authentication".

Then you can login via ondemand and select the environment you want to access (of course the resource needs to be active).

Whenever we have CA Services working on enhancements with us, this is how they login to our instance of CA PPM as they are not authenticated through our SSO. We switch them 'on' or 'off' depending on whether they are engaged or not.

If you have further restrictions with your authentication / IAM / SSO setup, then I can't help you further, and you probably need to talk to a combination of your info-sec team and CA Support.

This is an on-premise installation and would like to have a facility to have some users able to login without SSO.

If that is the case, then you are going to have to liaise internally with your IT teams, because there could be any number of processes and procedures that they have implemented around the CA PPM web app.

Is there any database Insert/update that will get a person added as a Collaboration manager?

I could not get the XOG/GEL script working in a process.
I would prefer to run SQL Insert/Update in this instance.

Mayank,

Direct DB update on OOTB tables are not recommended!!

CLB_PROJECT_GROUP_KEYS, CMN_SEC_USER_GROUPS, CMN_SEC_USERS & INV_INVESTMENTS tables helps to get the collaboration manager details.

Relations between tables.

CLB_PROJECT_GROUP_KEYS.project_managers_group_id = CMN_SEC_USER_GROUPS.group_id

CLB_PROJECT_GROUP_KEYS.project_id = INV_INVESTMENTS.id

Thanks,

Agin

I created and run below query to identify who is assigned as Collaboration Managers for each Projects.

It seems working fine in-house environment.

SELECT INV.NAME Project_Name, CSU.USER_NAME Colloboration_manager
FROM CLB_PROJECT_GROUP_KEYS CPGK, CMN_SEC_USER_GROUPS CSUG, CMN_SEC_USERS CSU, INV_INVESTMENTS INV
Where CPGK.project_managers_group_id = CSUG.group_id
and CSU.id=CSUG.user_id
and CPGK.PROJECT_ID = INV.ID
ORDER by Project_Name

Thanks

Shoichi

great.