Give access to security group

[davidgray]

Hello, 

In tools|security groups I have create a group called "IT" 

I have then right clicked on this and added a security group from the active directory.  

This security group is db_owner on the SQL server database where all my connections are.  

How do I assign this to an environment?  I can view all the connection from the database, however 
my colleagues cannot.  I am an administrator of the environment and they are not. 

Thanks

[DevOma]

ASGRD uses a "object-level permission system" - so you need to set permissions on the objects in the navigation window - you can assign security groups in Properties=>Permissions and by default these permissions will be used for all child objects - but you can override at every level like you want.

So you should give your Security Groups at least the "READ" permission to see all objects

[maestr0]

Hi Oliver,

I would like to jump on this train (although we are on version 2022, but could be version-independant). In case you want me to open up a post in the 2021/2022 forum, please let me know.

We currently have all permissions based on AD usernames, but we would like to move over to AD groups as our number of ASG users is growing. For this example I have two ASG security groups.

SecGroup A --> my AD username is part of this SecGroup
SecGroup B --> AD group C is part of this SecGroup and I'm a member of AD group C

Part of our folder structure has read access for SecGroup A. This same folder structure has read/write access for SecGroup B. Therefore I should be able to change the entries. I can't.

When I check the SecGroups where I'm part of, it only comes back with SecGroup A, not SecGroup B.

What could be the issue here? Thanks a lot for your assistence.

[DevOma]

Please check Tools=>Assigned Security Groups - are both groups listed or just Group A?

[maestr0]

Hi Oliver,

Just SecGroup A is shown.

Cheers.

[DevOma]

I've just tested in my dev environment - and it works for me - but we have "some users" who reported similar problems like you - I don't know - perhaps permissions? Perhaps caching options of AD? Did you try with BuildIn-Groups like "Domain Users" just for testing?

[maestr0]

Assigning "Domain Users" to SecGroup B worked. I then have the permissions to change the related entries. Removed "Domain Users" and assigned another AD group which was created approx 3-4 weeks ago and that worked as well. The mentioned group AD group C was created only yesterday. Might indeed be a caching issue somewhere. Will give it a week to see if it starts working via AD group C. Not sure how I would be able to manually trigger "something" to get it sorted sooner. Thanks.

[DevOma]

Ok thanks for your feedback - I don't know either how and when this caching is done - and how to refresh it - but like in your tests there is some caching mechanism - hopefully it reflect your changes soon!

[maestr0]

Got it figured out (for me at least)! As many of us, I'm working primarily from home via VPN. My VPN connection to the office only starts after my Windows logon and therefore my group membership info is not getting updated. Issue is described here:

Group membership changes do not update over some VPN connections - Windows Client | Microsoft Docs

The described work-around worked for me:

1. Sign in to the client computer, and then connect to the VPN as you usually do.
2. When you are sure that the client computer is connected to the VPN, lock Windows.
3. Unlock the client computer, and then sign out of Windows.
4. Sign in to Windows again.


Afterwards the permissions in ASG ofcourse reflected the correct membership info.

Hope this helps other people as well.

[DevOma]