Page Permissions not working, what am I missing?

PowerShell Universal
1 
Product: PowerShell Universal
Version: 2.6.1

Just got PS Universal and excited to get everything moved to it. I am messing around with pages and permissions and am not getting the expected behavior( I am probably doing something wrong).

I created a new role ( Service-Desk) and manually added 2 accounts to it(by going to the accounts and selecting the role from the drop down, Windows Auth is setup).

I then create a page and add the Service-desk role and also the Administrator role.

When I go to the page with the admin account I see the logo on the top left along with navigation and the page description below.

When I go to the page via the account with the service-desk role nothing is displayed just a white screen. If I remove the account from the new role I get the Unauthorized so I know permissions are working. I added a button to the page and the admin sees the button but the Service-Desk does not see it. Is this expected behavior or am I doing something wrong?

Thank you
Mike

1 Like
2

This should work. I’ll test it out in my lab and report back.

2 Likes
3

I can reproduce this: Custom roles do not work with pages · Issue #796 · ironmansoftware/issues · GitHub

5

@adam,
Hey Adam, It looks like this was fixed in 2.7.0. It looks like it gets further but still have problems.
The user can now see the page and the form on it but if they click any button they get an Error! page.
image
I have tested on a few different pages.
image

Thank you,
Mike

6

Can you grab me a log from that machine and send it my way? I’m curious what the 500 error is.

7

Sure, are you talking about the log for PSU or something else and how would you like me to send it over?
Mike

8

I’m looking for the PSU logs. You can download them from Settings \ General \ Diagnostics.

9

I dont see a way to send them through the form. How do you want me to get them to you? do you want me to enable debugging and re-produce before exporting them also?

10

You can email me at adam@ironmansoftware.com to get them to me.

Please reproduce and then export. It may have a previous error in there but if you reproduce first, it’ll be easy to correlate.

11

Emailed,
Thank you.
mike

1 Like
12

I can reproduce this. The issue happens when the user does not have the permissions to execute the script. We need to improve the user experience here.

Here’s how I worked around it. I have a custom role page that is assigned to my custom role.

image
image1094×416 11.4 KB

I have created a script that I want to execute from the page.

image
image825×335 9.36 KB

I setup my form to call the script.

image
image861×561 17.2 KB

The final step is to setup access controls to allow access to the script from the custom role. In accessControls.ps1, I’ve assigned the role view and execute permissions directly to the script.

$Type = ([PowerShellUniversal.AccessControlType]::Execute -bor [PowerShellUniversal.AccessControlType]::View)
New-PSUAccessControl -Role 'Custom' -ObjectId 'Scripts\AccessControls.ps1' -ObjectType 'Script' -Type $Type

Now my custom role can execute the form.

image

1 Like
13

Giving access to the script would allow them to go into the admin psu and run it right? Will do some more playing around but i figured if they had access to the page that is all they needed and did not have to give individual script access.

Thank you
Mike

14

This worked, to make it easier I created a tag and assigned the permissions to the tag. This way I just need to take the script and I can see who has access. I do wish the admin side was gated behind a permission so users do not stumble apron it. While it does not show them to much other then jobs ran and by who.
Thank you for your time
Mike

1 Like