Symantec Management Platform (Notification Server)

Hi everyone.
I'm having a problem importing reports from my Altiris 7 test environment to the production server. Both servers has the same configurations and runs the same software versions.
The import process works fine, and when I run the report as administrator it works too. I've set a security rule so that users can read and run these imported reports, but when I try to run a report as user I get an "Unknown Error".
Checking the event log, I've seen that the error refers to a "page error". Here's the dump:

Log File Name: C:\Program Files\Altiris\Notification Server\Logs\a.log
Priority: 1
Date: 4/2/2010 4:54:45 PM
Tick Count: 2746062
Host Name: MIGE114
Process: w3wp (4648)
Thread ID: 32
Module: w3wp.exe
Source: Altiris.Reporting.UI.ReportPage.ShowUnhandledError
Description: Page Error.

( Exception Details: Altiris.Reporting.Common.Exceptions.ReportInitializationException: Failed when initializing the Report View Control. ---> Altiris.NS.Exceptions.AeXUnauthorizedAccessException: The current user does not have required permission 'read' to load item 'Computer NON Gestiti (MI) Query (385e8bd8-0a64-45c0-808e-f0ff53066478)'.
   at Altiris.NS.ItemManagement.Item.RaiseItemLoadFlagsSecurityException(String message)
   at Altiris.NS.ItemManagement.Item.CheckCanGetItem(IItem item, IEnumerable`1 accessPermissions, ItemLoadFlags itemLoadFlags)
   at Altiris.NS.ItemManagement.Item.GetItemInternal(Guid itemGuid, IEnumerable`1 accessPermissions, ItemLoadFlags itemLoadFlags)
   at Altiris.NS.ItemManagement.Item.GetItem[T](Guid itemGuid, IEnumerable`1 accessPermissions, ItemLoadFlags itemLoadFlags)
   at Altiris.NS.ItemManagement.Item.GetItem(Guid itemGuid, ItemLoadFlags itemLoadFlags)
   at Altiris.Reporting.DataSource.ReportDataSourceReference.EnsureDataSourceRefs()
   at Altiris.DataSource.DataSourceReference.get_DataSource()
   at Altiris.Reporting.Report.get_DataSource()
   at Altiris.Reporting.UI.ReportViewControl.OnInit(EventArgs e)
   --- End of inner exception stack trace ---
   at Altiris.Reporting.UI.ReportViewControl.OnInit(EventArgs e)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Control.AddedControl(Control control, Int32 index)
   at System.Web.UI.ControlCollection.Add(Control child)
   at Altiris.Reporting.Web.Report.CreateChildControls()
   at System.Web.UI.Control.EnsureChildControls()
   at Altiris.Reporting.UI.ReportPage.OnInit(EventArgs e)
   at Altiris.Reporting.Web.Report.OnInit(EventArgs e) )
( Exception logged from:
   at Altiris.Diagnostics.Logging.EventLog.ReportException(Int32 severity, String strMessage, String category, Exception exception)
   at Altiris.Diagnostics.Logging.EventLog.ReportException(String strMessage, String category, Exception exception)
   at Altiris.NS.Logging.EventLog.ReportException(String strMessage, Exception exception)
   at Altiris.Reporting.UI.ReportPage.ShowUnhandledError(String message, Exception err)
   at Altiris.Reporting.Web.Report.OnInit(EventArgs e)
   at System.Web.UI.Control.InitRecursive(Control namingContainer)
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint)
   at System.Web.UI.Page.ProcessRequest()
   at System.Web.UI.Page.ProcessRequestWithNoAssert(HttpContext context)
   at System.Web.UI.Page.ProcessRequest(HttpContext context)
   at ASP.report_aspx.ProcessRequest(HttpContext context)
   at System.Web.HttpApplication.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
   at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)
   at System.Web.HttpApplication.ApplicationStepManager.ResumeSteps(Exception error)
   at System.Web.HttpApplication.System.Web.IHttpAsyncHandler.BeginProcessRequest(HttpContext context, AsyncCallback cb, Object extraData)
   at System.Web.HttpRuntime.ProcessRequestInternal(HttpWorkerRequest wr)
   at System.Web.HttpRuntime.ProcessRequestNoDemand(HttpWorkerRequest wr)
   at System.Web.Hosting.ISAPIRuntime.ProcessRequest(IntPtr ecb, Int32 iWRType)
)
( Extra Details:  Type=Altiris.Reporting.Common.Exceptions.ReportInitializationException Src=Altiris.Reporting.UI

  Inner Extra Details:  Type=Altiris.NS.Exceptions.AeXUnauthorizedAccessException Src=Altiris.NS )

 

Then I created a new report manually, specifying the same SQL query and security rule and saved it to the same directory as the previous one, and it worked.
Can anyone help me clearing it up?

Thanks in advance.
Danilo Zappa

slightly off. You may want to check\confirm  the security permissions have inherited. with the Security Role Manager on the imported object, since you are being denied 'read privilege' on it. Just to provide a checklist, you followed the steps listed in AKB47016, correct?

Hello Jim.
Yes, I have checked that the security permission was inherited. In this specific case, the only access rights enabled on the folder that contains the reports are "Read" and "Run Reports". I've checked that the permissions on the organizational view are correct, and I've seen that some other reports are working fine with the same permission configurations.

I have tried to create a new security group and add a test user as a member, set report permissions and tried to log on to the console. Some reports are ok, some other are not.
In attachment you will find details about the error message.
Thank you very much in advance.

Danilo Zappa

I am experiencing this exact same problem using the local admin account as well as a domain account with local admin membership.

Exception Details: Altiris.NS.Exceptions.AeXUnauthorizedAccessException: The current user does not have required permission 'read' to load item 'd0e33520-c160-11d2-8612-00104b74a9df'.

I am not sure if the OP has figured this out, but it appears that the permissions are not local problems, but rather remote ones.  Checking around the web and it appears that the permissions to the Symantec_CMDB needs dbo and dbcreator permissions.  I ended up just nuking the db and letting Altiris create it with a service account with permissions to create databases and our problems went away.

Most default setups allow the local admin group on the SQL server to have DBO or higher (sa equivalent) on the SQL databases. Even if you're locked down, you should allow the Altiris service account to be dbo to the Altiris databases, and any other account with 'extended' privileges (i.e. writing reports, or importing in this case), should have data reader and writer privs.

Even I am facing the similar problem when we limit a role to one particular report.

But it works fine if the security role is applied at the folder level.

Did anyone find some solution or reason for this problem?