gaclarks Absent Member.
Absent Member.
5798 views

Rights Required to access PsmStatus

I have a OES2 Linux server running iPrint. I've set up some of my Technicians with the ability to manage, add, and delete printers through iManger 2.7. On each printer there is a link "Printer Health Monitor" which should take them to https://xxx.xxx.xxx.xxx/PsmStatus/PAStatus/Printer_Name. I does not. Instead of asking them to authenticate as it does me it just says access denied. I have root access to the tree they do not and I'd like to just set the minimum permissions necessary to access PsmStatus on the server. Thanks for any help.
Labels (2)
0 Likes
14 Replies
Brunold Rainer Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

gaclarks,

have you assigned them the iprint role and they still cannot access that page ?

Rainer
0 Likes
gaclarks Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

Actually I have assigned them a subset of the iPrint role in iManager. I created a new role and added delete print object, create printer, and manager printer. According the iPrint documentation for some one to access PsmStatus they must be added to the mamager role of the print manager. I have done that as well.
0 Likes
Brunold Rainer Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

gaclarks,

I tried the same configurations as you wrote and have the same problem. I added several other roles but no one could fix that problem.

At least assigning the user suprtvisor rights to the edirectory object of the iprint manager object solved it.

I think this could just be a workaround for it because there must be a role that can do it.

Can you verify if this works on your environment as well ?

Rainer
0 Likes
gaclarks Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

Maybe I'm looking at it the wrong way but it looks like when I put that user in the "Manager Role" of that print manager that gave her supervisor rights to the object. I used iManager to look at the trustee assignments to the print manager and she is listed as having supervisor just as my account is.
0 Likes
Brunold Rainer Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

gaclarks,

just as a test please remove the role and assign the edir user object supervisor rights to the print manager. The rights assigned via the role are a limited subset of what the user get's when he gets supervisor rights directly. I can see on the role assignment that the user just got a bunch of iprint attributes but not all. When he gets the supervisor on that object he has all. So as it works on my environment when I assign supervisor it seems the role is missing one or more attributes to assign. But we will see as a test if that would work for you as well.

Rainer
0 Likes
Highlighted
gaclarks Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

I tried that and it still didn't work.
0 Likes
Brunold Rainer Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

gaclarks,

I'm wondering about that but please give me some time, I will see if I can find some debug information on where we have to look on what's going wrong.

Rainer
0 Likes
Brunold Rainer Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

gaclarks,

so here is the next try ...

I worked through the apache configuration to find the configuration for that PsmStatus page, but I wasn't successful on that. The only thing I found was the ldap authentication which shows that login box when you access that page.

So I created once again a user that has no special rights and tried to access that page. The result was the same error you got.

You have insufficient rights to access this page. You must be logged in as a manager of this iPrint Manager object.

So I opened consoleone and opened the trustees of the print manager object and added that new user with supervisor rights to the entry rights and the all attribute rights. I waited a few seconds, refreshed the web page and got the print manager health page. Then I removed that trustee, waited another few seconds and refreshed and the error was back.

So this must definitively work. The next thing I noticed was that when I add that user with supervisor rights to the print manager object, this user is also listed in the imanager / iprint / manage print manager and there in the tab access control in the list of the managers. I removed the user from the print manager and it was gone from that manager list. Nice, the manager role is assigned in this list and not via role based service definition.

So you can try to add one of your users to that manager list in the access control tab and see if that works for you.

Rainer
0 Likes
gaclarks Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

Ok, I tried that again and still no success. I did try something else and it is working. If the user in question is asigned the manager role for both the printer object and the iPrint manager object it works. I can't figure out a way to set the two techs as manager of all the printers at once though. Maybe assigning them to the default iPrint Management role instead of a custom role is best. I've not tested that yet.
0 Likes
gaclarks Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

Ok, maybe I need more coffee, but here is what I just tested. I took a test account and assigned it to the role of manager for the iPrint manager per the documentation. I associated the account with the iPrint Role in iManager for the scope that contains the printers. I believe that is what documentation says is required. When logging into iManager as that account, I was able to go to PsmStatus from the link on the iPrint Manager page but not from the link on the iPrint Printer page. Once I set that account as a manager of the printer the link on the printer page works just fine.
0 Likes
Brunold Rainer Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

Ok, maybe I need more coffee, but here is what I just tested. I took a test account and assigned it to the role of manager for the iPrint manager per the documentation. I associated the account with the iPrint Role in iManager for the scope that contains the printers. I believe that is what documentation says is required. When logging into iManager as that account, I was able to go to PsmStatus from the link on the iPrint Manager page but not from the link on the iPrint Printer page. Once I set that account as a manager of the printer the link on the printer page works just fine.



So this is what you are looking for ?

Rainer
0 Likes
gaclarks Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

Yes, that appears to be the answer. Manager of the print manager and the print object. I had one of my techs create a printer today and they were automatically set as the manager of the print object. As such she has access to the PsmStatus and the drivers. Which she does not have with the objects she is not a manager of. Maybe I should have mentioned that most the printer objects were migrated via SCMT. The others were created with my account that has Root Access. I guess now I'm wondering how to set my two techs as managers of all the printers with out having to do it one printer at a time. Other than giving them supervisor access to the OU with the printers in them. As I have the printers by themselves in their own OU maybe that wouldn't be so bad. Thanks for your help.
0 Likes
Brunold Rainer Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

I also created a new user USER1 in my test tree and used the admin to create a new printer. Then I added USER1 as a manager to the print manager and was able to access the PsmStatus page. Once logged in as user USER1 on that page I can do all I want, even shutdown the printer, start it up and so on.

Do you want your other techs also assign drivers for that printer ? If so I think you should just add them as a manager to the driver store (there is also a access control tab) and then see if they can administrate drivers on the printers without being there a a manager.

Right now I wonder what the role based services have to do with iprint because we have to configure all of them via the access manager role.

Rainer
0 Likes
RoyceRacer Absent Member.
Absent Member.

Re: Rights Required to access PsmStatus

Check to be sure that the Print manager is actually running on the server.

RLR:-)
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.