Admin permissions in XNAT 1.7.6

80 views
Skip to first unread message

Stefan Pszczolkowski

unread,
Jan 23, 2020, 7:07:40 AM1/23/20
to xnat_discussion
Hi

I am the admin of our XNAT instance and I've just upgraded to 1.7.6, but it seems I have lost all the permissions towards projects, i.e., when I click on one project name I can only see the details, but cannot edit anything. I know the upgrade comes with changes regarding permissions so I'm wondering whether this is acutally an expected behaviour?

Best wishes,

Stefan

McKay, Mike

unread,
Jan 23, 2020, 9:49:56 AM1/23/20
to xnat_discussion
Stefan,

If you go to Administer-> Users from the top bar, click on your username, click Edit Advanced Settings, what is "Allow All Data Access" set to? We are trying to be more consistent about separating out site administration permissions from data permissions. My guess is that your user is not set to have Read, Edit & Delete All Data Access. If your user account was not set to have edit access to all data (and the user hadn't specifically been added to each of those projects) then what you're seeing is expected behavior. Otherwise that sounds like a problem we'll need to fix.

-Mike

From: xnat_di...@googlegroups.com <xnat_di...@googlegroups.com> on behalf of Stefan Pszczolkowski <stef...@gmail.com>
Sent: Thursday, January 23, 2020 6:07 AM
To: xnat_discussion <xnat_di...@googlegroups.com>
Subject: [XNAT Discussion] Admin permissions in XNAT 1.7.6
 
--
You received this message because you are subscribed to the Google Groups "xnat_discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to xnat_discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/dd155031-45b3-47f6-95d0-275ede66be1a%40googlegroups.com.

 


The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.

Stefan Pszczolkowski

unread,
Jan 23, 2020, 10:40:28 AM1/23/20
to xnat_discussion

Dear Mike


Thank you very much for your response. Prior to the change I had "Allow All Data Access" set to "Read, Edit & Delete" and now this has not changed (see screenshots below). Therefore this was a functionality I did enjoy prior to the change and now I seem not to have.


Many thanks!


Stefan






On Thursday, 23 January 2020 14:49:56 UTC, Mike McKay wrote:
Stefan,

If you go to Administer-> Users from the top bar, click on your username, click Edit Advanced Settings, what is "Allow All Data Access" set to? We are trying to be more consistent about separating out site administration permissions from data permissions. My guess is that your user is not set to have Read, Edit & Delete All Data Access. If your user account was not set to have edit access to all data (and the user hadn't specifically been added to each of those projects) then what you're seeing is expected behavior. Otherwise that sounds like a problem we'll need to fix.

-Mike

From: xnat_di...@googlegroups.com <xnat_di...@googlegroups.com> on behalf of Stefan Pszczolkowski <stef...@gmail.com>
Sent: Thursday, January 23, 2020 6:07 AM
To: xnat_discussion <xnat_di...@googlegroups.com>
Subject: [XNAT Discussion] Admin permissions in XNAT 1.7.6
 
Hi

I am the admin of our XNAT instance and I've just upgraded to 1.7.6, but it seems I have lost all the permissions towards projects, i.e., when I click on one project name I can only see the details, but cannot edit anything. I know the upgrade comes with changes regarding permissions so I'm wondering whether this is acutally an expected behaviour?

Best wishes,

Stefan

--
You received this message because you are subscribed to the Google Groups "xnat_discussion" group.
To unsubscribe from this group and stop receiving emails from it, send an email to xnat_di...@googlegroups.com.

McKay, Mike

unread,
Jan 23, 2020, 10:49:54 AM1/23/20
to Stefan Pszczolkowski, xnat_discussion
Do you see anything relevant in your XNAT logs (downloadable by going to http://your-xnat-url/xapi/logs/download)?

Once you've saved a copy of your logs, could you try clicking on your username in the top right when logged in, clicking on Manage Cached Resources, and then clicking on Reset Access Cache. I'm curious whether that will resolve the permissions issues you're seeing.

-Mike

Sent: Thursday, January 23, 2020 9:40 AM
To: xnat_discussion <xnat_di...@googlegroups.com>
Subject: Re: [XNAT Discussion] Admin permissions in XNAT 1.7.6
 
To unsubscribe from this group and stop receiving emails from it, send an email to xnat_discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/0eb20d77-7913-428c-829b-2010932e6866%40googlegroups.com.

Stefan Pszczolkowski

unread,
Jan 23, 2020, 11:02:54 AM1/23/20
to xnat_discussion
Hi Mike

Unfortunately resetting the access cache did not solve the issue. When I login (and also when I click on a project) I get this in the logs:

2020-01-23 16:00:22,180 [http-bio-8443-exec-19] ERROR org.nrg.xdat.security.PermissionsServiceImpl - An error occurred trying to get the allowed values for user 'mszspp' action 'create' on data type 'xnat:subjectData/project'
org.nrg.xft.exception.ElementNotFoundException: Element not found: 'subjectData/project'
        at org.nrg.xft.meta.XFTMetaManager.FindElement(XFTMetaManager.java:189)
        at org.nrg.xft.meta.XFTMetaManager.FindElement(XFTMetaManager.java:228)
        at org.nrg.xft.meta.XFTMetaManager.FindElement(XFTMetaManager.java:183)
        at org.nrg.xft.meta.XFTMetaManager.GetWrappedElementByName(XFTMetaManager.java:319)
        at org.nrg.xft.schema.Wrappers.GenericWrapper.GenericWrapperElement.GetElement(GenericWrapperElement.java:149)
        at org.nrg.xdat.schema.SchemaElement.GetElement(SchemaElement.java:116)
        at org.nrg.xdat.security.PermissionsServiceImpl.getAllowedValues(PermissionsServiceImpl.java:468)
        at org.nrg.xdat.security.PermissionsServiceImpl.canAny(PermissionsServiceImpl.java:421)
        at org.nrg.xdat.security.helpers.Permissions.canAny(Permissions.java:465)
        at org.nrg.xdat.security.helpers.Permissions.canAny(Permissions.java:452)
        at org.nrg.xdat.security.services.UserHelperServiceI.canCreate(UserHelperServiceI.java:66)
        at sun.reflect.GeneratedMethodAccessor373.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:606)
        at org.apache.velocity.util.introspection.UberspectImpl$VelMethodImpl.doInvoke(UberspectImpl.java:395)
        at org.apache.velocity.util.introspection.UberspectImpl$VelMethodImpl.invoke(UberspectImpl.java:384)
        at org.apache.velocity.runtime.parser.node.ASTMethod.execute(ASTMethod.java:173)
        at org.apache.velocity.runtime.parser.node.ASTReference.execute(ASTReference.java:280)
        at org.apache.velocity.runtime.parser.node.ASTReference.evaluate(ASTReference.java:530)
        at org.apache.velocity.runtime.parser.node.ASTOrNode.evaluate(ASTOrNode.java:105)
        at org.apache.velocity.runtime.parser.node.ASTExpression.evaluate(ASTExpression.java:62)
        at org.apache.velocity.runtime.parser.node.ASTIfStatement.render(ASTIfStatement.java:85)
        at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:342)
        at org.apache.velocity.runtime.directive.Parse.render(Parse.java:260)
        at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:207)
        at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
        at org.apache.velocity.runtime.parser.node.ASTElseIfStatement.render(ASTElseIfStatement.java:92)
        at org.apache.velocity.runtime.parser.node.ASTIfStatement.render(ASTIfStatement.java:106)
        at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
        at org.apache.velocity.runtime.directive.Foreach.render(Foreach.java:420)
        at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:207)
        at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
        at org.apache.velocity.runtime.directive.VelocimacroProxy.render(VelocimacroProxy.java:216)
        at org.apache.velocity.runtime.directive.RuntimeMacro.render(RuntimeMacro.java:311)
        at org.apache.velocity.runtime.directive.RuntimeMacro.render(RuntimeMacro.java:230)
        at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:207)
        at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:342)
        at org.apache.velocity.runtime.directive.Parse.render(Parse.java:260)
        at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:207)
        at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
        at org.apache.velocity.runtime.parser.node.ASTElseIfStatement.render(ASTElseIfStatement.java:92)
        at org.apache.velocity.runtime.parser.node.ASTIfStatement.render(ASTIfStatement.java:106)
        at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
        at org.apache.velocity.runtime.directive.Foreach.render(Foreach.java:420)
        at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:207)
        at org.apache.velocity.runtime.parser.node.ASTBlock.render(ASTBlock.java:72)
        at org.apache.velocity.runtime.directive.VelocimacroProxy.render(VelocimacroProxy.java:216)
        at org.apache.velocity.runtime.directive.RuntimeMacro.render(RuntimeMacro.java:311)
        at org.apache.velocity.runtime.directive.RuntimeMacro.render(RuntimeMacro.java:230)
        at org.apache.velocity.runtime.parser.node.ASTDirective.render(ASTDirective.java:207)
        at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:342)
        at org.apache.velocity.Template.merge(Template.java:356)
        at org.apache.velocity.Template.merge(Template.java:260)
        at org.apache.velocity.app.Velocity.mergeTemplate(Velocity.java:339)
        at org.apache.turbine.services.velocity.TurbineVelocityService.executeRequest(TurbineVelocityService.java:412)
        at org.apache.turbine.services.velocity.TurbineVelocityService.handleRequest(TurbineVelocityService.java:284)
        at org.apache.turbine.services.velocity.TurbineVelocity.handleRequest(TurbineVelocity.java:74)
        at org.apache.turbine.modules.navigations.VelocityNavigation.buildTemplate(VelocityNavigation.java:95)
        at org.apache.turbine.modules.navigations.TemplateNavigation.doBuild(TemplateNavigation.java:69)
        at org.apache.turbine.modules.Navigation.build(Navigation.java:60)
        at org.apache.turbine.modules.NavigationLoader.eval(NavigationLoader.java:110)
        at org.apache.turbine.util.template.TemplateNavigation.toString(TemplateNavigation.java:109)
        at org.apache.velocity.runtime.parser.node.ASTReference.render(ASTReference.java:430)
        at org.apache.velocity.runtime.parser.node.SimpleNode.render(SimpleNode.java:342)
        at org.apache.velocity.Template.merge(Template.java:356)
        at org.apache.velocity.Template.merge(Template.java:260)
        at org.apache.velocity.app.Velocity.mergeTemplate(Velocity.java:339)
        at org.apache.turbine.services.velocity.TurbineVelocityService.executeRequest(TurbineVelocityService.java:412)
        at org.apache.turbine.services.velocity.TurbineVelocityService.handleRequest(TurbineVelocityService.java:284)
        at org.apache.turbine.services.velocity.TurbineVelocity.handleRequest(TurbineVelocity.java:74)
        at org.apache.turbine.modules.layouts.VelocityOnlyLayout.doBuild(VelocityOnlyLayout.java:119)
        at org.apache.turbine.modules.Layout.build(Layout.java:56)
        at org.apache.turbine.modules.LayoutLoader.exec(LayoutLoader.java:104)
        at org.apache.turbine.modules.pages.DefaultPage.doBuild(DefaultPage.java:149)
        at org.apache.turbine.modules.Page.build(Page.java:56)
        at org.apache.turbine.modules.PageLoader.exec(PageLoader.java:104)
        at org.apache.turbine.Turbine.doGet(Turbine.java:796)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at net.bull.javamelody.MonitoringFilter.doFilter(MonitoringFilter.java:239)
        at net.bull.javamelody.MonitoringFilter.doFilter(MonitoringFilter.java:215)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:317)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:127)
        at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:91)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:114)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:137)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:111)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.nrg.xnat.security.XnatInitCheckFilter.doFilterInternal(XnatInitCheckFilter.java:41)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:170)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.nrg.xnat.security.XnatExpiredPasswordFilter.doFilterInternal(XnatExpiredPasswordFilter.java:188)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.nrg.xnat.security.XnatBasicAuthenticationFilter.doFilterInternal(XnatBasicAuthenticationFilter.java:101)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.session.ConcurrentSessionFilter.doFilter(ConcurrentSessionFilter.java:155)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:200)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:116)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:66)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:105)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:56)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:157)
        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:331)
        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:214)
        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:177)
        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:347)
        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:263)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:498)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
        at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:1025)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1139)
        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
        at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1152)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:622)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.lang.Thread.run(Thread.java:748)

McKay, Mike

unread,
Jan 23, 2020, 11:10:30 AM1/23/20
to Stefan Pszczolkowski, xnat_discussion
And just to rule out another possible cause, do you have any plugins installed? If so, which ones and what exact versions of each are you using?

-Mike

Sent: Thursday, January 23, 2020 10:02 AM
To unsubscribe from this group and stop receiving emails from it, send an email to xnat_discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/1ad16e6d-8583-4ec4-bba2-480c9f6a6c83%40googlegroups.com.

Stefan Pszczolkowski

unread,
Jan 23, 2020, 11:13:21 AM1/23/20
to xnat_discussion
Yes, just the Container Service Plugin v2.0.0-fat

McKay, Mike

unread,
Jan 23, 2020, 11:16:11 AM1/23/20
to Stefan Pszczolkowski, xnat_discussion
I don't know whether this is the cause of your permissions issue, but you should get the version of container services (2.1) that was released with XNAT 1.7.6. It has been modified to be compatible with the permission changes that were made to XNAT.

-Mike

Sent: Thursday, January 23, 2020 10:13 AM
To unsubscribe from this group and stop receiving emails from it, send an email to xnat_discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/92a2d6fc-ff52-4e0c-8458-371e44db5052%40googlegroups.com.

Stefan Pszczolkowski

unread,
Jan 23, 2020, 11:28:54 AM1/23/20
to xnat_discussion
Thanks Mike. That seems to have solved the problem from a UI point of view. However, I am stilll getting the stack trace posted above. Whether that's a problem or not, I don't know......

Many thanks again for your help!

Stefan

Stefan Pszczolkowski Parraguez

unread,
Jan 26, 2020, 9:54:42 PM1/26/20
to xnat_di...@googlegroups.com

Dear Mike


Thank you very much for your response. Prior to the change I had "Allow All Data Access" set to "Read, Edit & Delete" and now this has not changed (see screenshots below). Therefore this was a functionality I did enjoy prior to the change and now I seem not to have.


Many thanks!


Stefan




You received this message because you are subscribed to a topic in the Google Groups "xnat_discussion" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/xnat_discussion/tVWAAy_GYEU/unsubscribe.
To unsubscribe from this group and all its topics, send an email to xnat_discussi...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/xnat_discussion/DM6PR02MB510015B04C051FEA022C9E8FBF0F0%40DM6PR02MB5100.namprd02.prod.outlook.com.

This message and any attachment are intended solely for the addressee
and may contain confidential information. If you have received this
message in error, please contact the sender and delete the email and
attachment. 

Any views or opinions expressed by the author of this email do not
necessarily reflect the views of the University of Nottingham. Email
communications with the University of Nottingham may be monitored 
where permitted by law.



Reply all
Reply to author
Forward
0 new messages