A hotfix is now available to let you add or remove rights for an operation in profiles to accommodate custom types that were added to the System Center Service Manager 2010 environment

Article translations Article translations
Article ID: 2525307 - View products that this article applies to.
Expand all | Collapse all

On This Page

Introduction

Authorization is required to manipulate objects such as queues and work items in Microsoft System Center Service Manager 2010. These authorizations are managed by using profiles. A profile is a collection of items that are used for authorization. For operations such as create, read, update, and delete, the following structure is used for the items of authorization:
ProfileName Operation Type Property Relationship RelationshipEndPoint
For authorization, a user role specifies operations that specific users can perform on specific objects by associating a profile, a scope, and users. Profiles are also used by the Service Manager console to filter objects such as tasks and templates.

The three stored procedures that are included in this hotfix have the following file names:
  • p_GetRestrictrictionsOnOperationsInProfile
  • p_AddRestrictrictionToOperationInProfile
  • p_RemoveRestrictrictionFromOperationInProfile
These SQL stored procedures let you add or remove rights for an operation in profiles to support custom types that were added to the Service Manager environment. The Service Manager console cannot add or remove these rights. For example, you can add the following authorization to the IncidentResolver profile if you customized the User type by adding a new New Relationship relationship:
ProfileName Operation Type Property Relationship RelationshipEndPoint
IncidentResolver Object_Set User New Relationship
These stored procedures also give you more details for accessing properties of specific types. The Service Manager console cannot provide these details. These SQL stored procedures cannot add new operations to a profile and can perform only the following tasks:
  • View the authorizations that are configured in an existing profile.
  • Add types to existing operations in existing profiles. You can add the type, property, and relationship restrictions to the following operations:
    • Object__Add
    • Object__Set
    • Object__Get
    • Object__Delete
  • Remove types from existing operations in existing profiles.

MORE INFORMATION

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a "Hotfix download available" section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:
http://support.microsoft.com/contactus/?ws=support
Note The "Hotfix download available" form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix, you must have Microsoft System Center Service Manager 2010 Service Pack 1 (SP1) installed.

Note This hotfix applies to the Service Manager Primary Management Server (SM Server) component in System Center Service Manager 2010.

How to install this hotfix

Important Before you install this hotfix, we recommend that you follow these steps:
  • Back up the ServiceManager databases.
  • Back up the encryption keys for SM Server.
Note This hotfix cannot be uninstalled after you install it.

To install this hotfix, follow these steps:
  1. Close all Service Manager-related applications such as the Service Manager console and the Self-Service Portal.
  2. In Windows Explorer, open the folder that contains this hotfix package.
  3. Right-click the following file, and then click Run as administrator:
      Scsm2010_amd64_sp1_kb2525307.exe
  4. Accept the license agreement in the System Center Service Manager SCSM2010_SP1_KB2525307 Setup Wizard on the License agreement page, and then click Install to complete the wizard.

How to determine whether this hotfix was applied correctly

Method 1
  1. In Control Panel, open Programs and Features.
  2. Click View installed updates.
  3. If the following item is listed, the hotfix was applied correctly:
    Hotfix for Microsoft System Center Service Manager SP1 (KB2525307)
    Note If the system is running SM Server, this item is listed under Microsoft System Center Service Manager SP1.
Method 2
View the following log files in the %temp% folder to determine whether any errors occurred during the installation of the hotfix:
  • Scsm2010_sp1_kb2525307.msp.0.log
  • Scsmpatchersetupwizard01.log

Registry information

To use the hotfix in this package, you do not have to make any changes to the registry.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix. For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:
824684 Description of the standard terminology that is used to describe Microsoft software updates

How to use the stored procedures together with custom relationships

If you add relationships to extend a type, and if you want to restrict the update rights for these relationships, you have to add the extended type to the desired operations that update the appropriate profiles.

For example, you add the System.CallingUser relationship between the System.WorkItem.Incident and System.Domain.User endpoints. If you want the IncidentResolver profile to be able to enable the ability to update the relationship, you have to add the relationship to the Object__Set (update) right of the System.Domain.User endpoint. In this example, you do not have to add the relationship to the Object__Set (update) right of the System.WorkItem.Incident endpoint. The relationship does not have to be added because the following entry indicates that the System.WorkItem.Incident endpoint already has the Object__Set (update) rights for all properties and relationship endpoints:
ProfileName Operation Type Property Relationship RelationshipEndPoint
IncidentResolver Object__Set System.WorkItem.Incident NUL NULL N/A
You can call the following stored procedure to add the Object__Set (update) right to the System.Domain.User endpoint for the System.CallingUser relationship in the IncidentResolver profile:
exec p_RemoveRestrictrictionFromOperationInProfile 'IncidentResolver', 'Object__Set', 'System.Domain.User', NULL, 'System.CallingUser', NULL

Syntax

The following section describes the syntax of the stored procedures that are included in this hotfix.

The p_GetRestrictrictionsOnOperationsInProfile stored procedure
Parameter
@ProfileName nvarchar(max) = NULL
This stored procedure displays a list of operations from the specified profile. For each operation, this stored procedure also displays the types, the properties, and the relationships that are defined in the type and that can be used by the operation.

Note To define relationships correctly, they must be defined as properties on both endpoints of the relationship.
How to use the stored procedure and interpret the output
  • If ProfileName is null, all profiles are displayed.
  • An operation, a property, and a type that are listed in the same row indicate that the operation is restricted to the property from the type.
  • An operation, a type, and a relationship endpoint that are listed in the same row indicate that the operation is restricted to the relationship endpoint from the type.
  • If the type, the property, and the relationship endpoint are all null values, the associated operation is enabled on all types, all properties, and all relationships endpoints.
The following are valid profile names:
  • ActivityImplementer
  • Administrator
  • AdvancedOperator
  • Author
  • ChangeInitiator
  • IncidentResolver
  • ProblemAnalyst
  • ReadOnlyOperator
  • Workflow
  • ChangeManager
  • EndUser
  • ImpliedConfigItemCustodian
  • ImpliedIncidentAffectedUser
  • ImpliedPrimaryComputerUser
  • ImpliedReviewer
  • ImpliedUserPreference
The p_AddRestrictrictionToOperationInProfile stored procedure
Parameters
@ProfileName AS NVARCHAR(MAX) = null
@OperationName AS NVARCHAR(MAX) = null
@TypeName AS NVARCHAR(MAX) = null
@PropertyName AS NVARCHAR(MAX) = null
@RelationshipTypeName AS NVARCHAR(MAX) = null
@RelationshipEndpoint AS NVARCHAR(MAX) = null
Note This stored procedure adds the specified restrictions to the specified profile.
The p_RemoveRestrictrictionFromOperationInProfile stored procedure
Parameters
@ProfileName AS NVARCHAR(MAX) = null
@OperationName AS NVARCHAR(MAX) = null
@TypeName AS NVARCHAR(MAX) = null
@PropertyName AS NVARCHAR(MAX) = null
@RelationshipTypeName AS NVARCHAR(MAX) = null
@RelationshipEndpoint AS NVARCHAR(MAX) = null
Note This stored procedure removes the specified restrictions from the specified profile.
Example 1
The following example shows the output of the p_GetRestrictrictionsOnOperationsInProfile stored procedure. The results indicate that the Object__Get (Read) operation for the IncidentResolver profile is unrestricted.
ProfileName Operation Type Property Relationship RelationshipEndPoint
IncidentResolverObject__GetNULLNULL NULL NULL
Example 2
The following example shows the output of the p_GetRestrictrictionsOnOperationsInProfile stored procedure. The results indicate that the Object__Set operation for the IncidentResolver profile is restricted to the following types:
  • System.WorkItem.Incident and all its properties including relationship endpoints
  • System.FileAttachment and all its properties including relationship endpoints
  • System.WorkItem.Log and all its properties including relationship endpoints 
  • System.WorkItem.Activity.ManualActivity and its properties including relationship endpoints
  • System.Config item and relationship endpoint System.WorkItemAboutConfigItem
  • System.Config item and relationship endpoint System.WorkItemRelatesConfigItem
  • System.Domain.User and relationship endpoint System.WorkItem.TroubleTicketClosedByUser
  • System.Domain.User and relationship endpoint System.WorkItemAssignedToUser
  • System.Domain.User and relationship endpoint System.WorkItemCreatedByUser
ProfileName Operation Type Property Relationship RelationshipEndPoint
IncidentResolver Object__Set System.WorkItem.Incident NULL NULL N/A
IncidentResolver Object__Set System.FileAttachment NULL NULL N/A
IncidentResolver Object__Set System.WorkItem.Log NULL NULL N/A
IncidentResolver Object__Set System.WorkItem.Activity.ManualActivity NULL NULL N/A
IncidentResolver Object__Set System.ConfigItem NULL System.WorkItemAboutConfigItem N/A
IncidentResolver Object__Set System.ConfigItem NULL System.WorkItemRelatesToConfigIte N/A
IncidentResolver Object__Set System.Domain.User NULL System.WorkItem.TroubleTicketClosedByUser N/A
IncidentResolver Object__Set System.Domain.User NULL System.WorkItemAssignedToUser N/A
IncidentResolver Object__Set System.Domain.User NULL System.WorkItemCreatedByUser N/A
Important The last five operation items let you relate configuration items to an incident and assign users to incidents.
Example 3
The following example of the p_GetRestrictrictionsOnOperationsInProfile stored procedure indicates that the Object__Set operation for the ImpliedReviewer profile is restricted to the following types:
  • System.Reviewer and only properties Comments, DecisionDate, and Decision 
  • System.Reviewer and only relationship endpoint System.ReviewerVotedByUser 
  • System.Domain.User and only relationship endpoint System.ReviewerVotedByUser
Notes
  • This example output is only a sample of the output and not the complete output.
  • The System.ReviewerVotedByUserObject__Set (Update) rights were granted to both the System.Reviewer endpoint and the System.Domain.User endpoint. If you do not grant relationship rights to both endpoints, you cannot update reviewer objects by using the following relationship:
    ProfileName Operation Type Property Relationship RelationshipEndPoint
    ImpliedReviewer Object__Set System.Reviewer Comments NULL N/A
    ImpliedReviewer Object__Set System.Reviewer DecisionDate NULL N/A
    ImpliedReviewer Object__Set System.Reviewer Decision NULL N/A
    ImpliedReviewer Object__Set System.Reviewer NULL System.ReviewerVotedByUser N/A
    ImpliedReviewer Object__Set System.Domain.User NULL System.ReviewerVotedByUser N/A
Example 4
The following example shows how to use the p_AddRestrictrictionToOperationInProfile stored procedure to update the Notes property:
exec p_AddRestrictrictionToOperationInProfile 'ImpliedReviewer', 'Object__Set', 'System.Reviewer', 'Notes', NULL, NULL
Example 5
The following example shows how to use the p_AddRestrictrictionToOperationInProfile stored procedure to update the System.WorkItemRelatesToWorkItem relationship:
exec p_AddRestrictrictionToOperationInProfile 'ImpliedReviewer', 'Object__Set', 'System.Reviewer', NULL, 'System.WorkItemRelatesToWorkItem', 'N/A'
Example 6
The following example shows how to use the p_AddRestrictrictionToOperationInProfile stored procedure to update the Incident class, all properties, and all relationships:
exec p_AddRestrictrictionToOperationInProfile 'ImpliedReviewer', 'Object__Set', 'System.WorkItem.Incident', NULL, NULL, 'N/A'

Properties

Article ID: 2525307 - Last Review: May 19, 2011 - Revision: 1.0
APPLIES TO
  • Microsoft System Center Service Manager 2010
Keywords: 
kbautohotfix kbqfe kbhotfixserver kbfix kbsurveynew kbexpertiseadvanced KB2525307

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com