Start with the user’s Rights tab (see Check what someone may do): most answers are there. The ideas are in Managing access.
The user lacks a permission. The error names it as required-permission.
No role holds it. Find the permission under Permissions to see which roles hold it, and give one of the user’s groups such a role.
The role is scoped and the page does not check scopes. A scoped right only works where the app checks the scope; elsewhere only unscoped holders pass. Assign the role without a scope, or ask a developer to make the page check it.
The page has no rule. A page the developers gave no rule admits only
platform admins. clojure -M:run authz-report lists such pages.
The scope comes from the member and resolves to nothing. The Rights tab shows (none, so no rights). The app knows no value for this user, say no department; fix that in the app’s data.
The record lies outside the user’s scope. The app answers not found rather than forbidden, so a user cannot learn what exists outside their part. Check the scope on the Rights tab against the record. To widen it, assign the role again with the other value, or without a scope.
The user holds no
admin.<entity>/read at all. Give a group of theirs admin.<entity>/viewer
for the entities they should see.
The sidebar and dashboard list only
what the user may read. Assign admin.<entity>/viewer.
They hold viewer, not editor. Buttons for
changes they may not make are not shown.
The role Admin makes a platform admin only without a tenant. A tenant user with that role needs groups like anyone else.
Users, groups, roles and permissions are managed by users with the role Admin only. That cannot be handed out through a group.
Too many failed attempts, please try again in 15 minutes, or a 429 from the API: see Locked accounts. Unlock on their Sessions tab ends it now.
A user who signs in with a correct password to Invalid email or password may be deactivated: check Active on their page.
Check the rules in Memberships from your identity provider first: the names must match exactly. Then:
The mapping is not set up. Without the developer’s :group-membership
hook, nothing comes from the provider.
You are looking in the wrong list. Provider members appear on the group’s page and the user’s Rights tab, not in a permission’s or role’s list of users.
Can you improve this documentation?Edit on GitHub
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |