I want to give a bunch of users access but instead of creating individual users in my DB, I’ll grant an AD group access and then put the users into that group. I added the AD group, adjusted the permissions to match a local user but that didn’t seem to work. Is this even possible? For sysadmins it seems to work as a couple of us can login without even creating a user and RDM. The software create a user but it doesn’t do so in the DB as it’s giving us access via the AD group which is a sysadmin. I wanted the same thing for regular users but it seems to have been a total failure. Can I do what I want to do or is this not possible?
My 2nd issue is with permissions. I have the following structure [denotes assigned security group]
Blades[shared]
Teams [none]
-Group1 [Group1]
-Group2 [Group2]
-Group3 [Group3]
--FolderA [none]
--FolderB[none]
---FolderBB[none]
-Group4[Group4]
Since my first test above was a horrible failure, I delete the group in SQL and created a new user via RDM and selected the box to create the SQL user and login.
In RDM I selected Add/Edit/Delete then clicked the view option for [shared] and view, add, edit, delete for [Group1]
Problem is, this user can’t see Group1 folder but does see Group3 and can happily create new entries in Group3 which they shouldn’t be able to. A refresh/RDM relaunch and I can see both Group1 and Group3 but still can create items where they shouldn’t be able to.
Furthermore, the permissions I see on those folders don’t seem to match the permissions this user sees (which is probably why he is allowed to create items when he should be)
Next, I unchecked access to Group1 and just them view permission on Group2. They were able to create a new item in Group2. I unchecked the view/edit/delete boxes to gray out the columns. The user was able to start the process of create and then clicked ok, they got an insert permission was denied (I get a window with a stack trace showing the problem happened in the sql connection)
I’m still testing this software so it was a new DB created with 8.9.2.0 and we’re using 8.9.4.0 (there’s features in the beta we need before deploying).
It’s not easy to explain but the permissions aren’t behaving at all like I expected or like what I saw when using sql logins (and creating new data sources with said logins to test)
Any help is appreciated.
Thanks
Hi,
Security group and role are two different things. You should not try to match your security group with your Active Directory group because you can only apply one security group to a session. For now, the role management is only available in RDMS and it's integrated with the Active Directory.
We plan to add the role management with the SQL Server data source but it won't be integrated with the Active Directory.
For the login issue, could you verify the permission in File-> My Data Source Information?
David Hervieux
My data source information doesn’t match what is being shown in the session. I adjust what the user can see/edit and we closed and reopened the app. The data source info was showing as correct but what could be seen under sessions was totally wrong.
Initially I clicked the refresh button but that didn’t help as it didn’t seem to pickup the changes I made in the admin screen.
This was after another admin, after opening the app 8.9.2.0, wouldn't see anything under sessions. We had to delete the data source and readd it and then he could see everything.
There was a bug in 8.9.2. Could you try the version 8.9.5?
David Hervieux
Doing a little more checking and when I create a few different datasources using a local db accounts, everything seems to work as expected when i change between them and adjust permissions and refresh.
When using AD integrated authentication, nothing seems to work as expected.
I'm running SQL 2012 and i'm using the default user account that is created to run the server service (NT Service\MSSQLSERVER). This user doesn't have access to the domain. Is there some AD check that needs to happen and the DB can't query the domain?
Is it possible that when you use the Integrated Security, the user does not match with the one created? They need to exists in RDM even with the Integrated Security.
David Hervieux
I double checked and user exists correctly in RDM. I upgraded the user 8.9.5. They opened RDM and everything seems fine. I added a view to a couple groups but I had to close and reopen the program for it to take affect (refrehsing didn'thelp). When we reopened, at first there was just one sub folder showig with nothign else. We had to switch to a different data source and then switch back and then it was correctly updated.
Furthermore, and maybe this is by design, I have the following permissions set but it doesn't seem to prevent creating new entries even they only view permissions are set. If I try to edit my newly created item it says i don't have permission (as I woudl expect) but I shouldn't have been able to create something in the first place.
Maybe i'm doing things all wrong but nothing seems to be working as I would expect.
permissions.jpg
As soon as you have the Add checkbox checked, you can create an entry. From you screenshot, it seems that you have the Add right for the first group.
David Hervieux
correct. problem I can also create a new entry in the other groups which are view only
I will verify that specifically. Just to be sure, you don't see the view only security group in the combo?
edited by dhervieux on 8/1/2013
David Hervieux
Hi david , i need some info about Devolutions , how to use This RDM do you have any Video or tut ??
Yes we have some videos:
http://remotedesktopmanager.com/Support/Video
David Hervieux
Sorry David, i'm not following what you're asking me to check
Thanks david i will watch this if i get any problem i will give u a reply :)
i am unable to start this plz help me out how to start this rdm
can you plz explain from team viwer ? plz i am using trial version
@foxtrot
I have reproduced the problem and I'm working on it.
David Hervieux
Hi David,
Thanks very much. I'll wait for the fix and then try again. Hopefully all these weird issues I'm having will be solved.
Hi David,
Seems like the permissions are working better now however....
In my original example I realized that having the Teams folder set to none allows people to create stray entries and it also seems like you can drag and drop items into a sub folder where you don't have add/edit permission. (I was able to move one groups folder into another and then back out again when it was under Teams with no security. Oops :)
To fix this, I figured I need to put a view only permission on the Team folder. Problem is, now I can't create anything in a sub folder where I do have permissions. I keep getting an error saying I don't have permission to add to Teams (but the RDP window is showing I'm trying to save to teams\Group1)
Related to this, is there a way to have RDM pickup changes to permissions without closing and reopening the program? I tried a refresh and I tried change to local data source and back to the SQL one but it didn't seem to work. I have to close and reopen the program. Is this expected?
Hi,
If you only have the view, you won't be able to create anything in it. I will fix the problem with the drag and drop and you should be good. For the refresh of you user rights, hold Ctrl and click on the refresh button in the quick toolbar.
David Hervieux
Just wanted to let you know that 8.9.9.0 seems to have fixed the permission problem.
Thanks
That's a good news. Thank you for your patience
David Hervieux