Per-Project permissions removed admin rights

Avatar
Permanently deleted user
Created

Hello,

I'm running Teamcity 6.5 (build 17795) on a windows 7 box.

I have been running this for a long time with no problems.  Recently I was going to experiment with limiting a users build access to one project.  So, I checked "Per-Project Permissions" and clicked save settings. Immediately I was kicked out of the admin interface.  It appears that all 3 users who previously had admin rights can no longer get to any of the admin menus. It just seems like all admin rights were removed from all our accounts.

I would prefer to avoid having to reinstall since I have 2 projects configured and running nicely at this time.

Is there any way to turn off "Per-Project Permissions" or give admin rights to users from the command line? Any other ideas on how to regain access?

Thanks,

Matt

Update:

I created an account with http://<serverurl>/setupAdmin.html. That account still does not have access to the admin menus and can't see any projects.  "There are no projects to show, because you don't have permissions to view projects. Please contact your system administator."

Votes

0

Share

4 comments
Avatar
Permanently deleted user
Created

So, I was able to remove the "per-project permissions" from the main-config.xml file and then restart the service.  This allowed me back into the admin interface. All the users still have "Give this user administrative privileges" checked, so I am confused why that would just ignore those permissions. But all is right with the world again and I'm just not going to mess with project permissions.

0
Avatar
Permanently deleted user
Created

I had the same problem today with TC 2017 running on Linux. After turning on the "Per-Project Permissions", I lost my admin rights. Interestingly, restarting the server fixed this, and I could reproduce it. It looks like the change was active in the process but not persisted in main-config.xml.

My workaround was to log in with the first user account created in TC which happens to be in the internal DB and not in LDAP. With this account I was able to set "Per-Project Permissions" to "true", it was persisted in main-config.xml, and then I was able to give the admin rights to the appropriate LDAP users.

 

0
Avatar
Denis Lapuente
Created

Hi Olivier,

I have been unable to replicate the issue so far. If you could check whether something was logged in the teamcity-server.log when trying to enable the per-project permissions and it wasn't persisted that might be of help.

0
Avatar
Permanently deleted user
Created

Hi Denis,

here is what I could find in the log:


WARN -   jetbrains.buildServer.SERVER - Access denied error for user 'ocroquette' (Olivier Croquette) {id=2} with message "You do not have enough permissions for this function" occurred while processing request: POST '/teamcity/admin/authAction.html?action=save&_guestLoginAllowed=&guestUsername=guest&textForLoginPage=&perProjectPermissions=true&_perProjectPermissions=&_emailVerificationEnabled=', from client 192.168.x.y, authenticated as 'ocroquette' (Olivier Croquette) {id=2}: jetbrains.buildServer.serverSide.auth.AccessDeniedException: You do not have enough permissions for this function (enable debug to see stacktrace)

 This account has admin privileges, at least before the action.

0

Please sign in to leave a comment.