SA-5943

Summary

User have a scenario like, Administrator create 2 work Items: Parent (P-) and child (C-). Work object P- will be assigned to workbasket of the Administrator and work object C- will be assigned to non-admin operator who does not have access to Administrator’s workbasket where the work object (P-) is present. Scenario is, as per the user's configuration, whenever non-admin operator submits the C-, P- will get resume its flow. This will be carried out by ResumeFlow activity, which will be triggered by an agent (Standard). 

ERROR MESSAGES

‘you are not authorized to open instance ASSIGN-WORKBASKET-' in the PegaRULES log file.


STEPS TO REPRODUCE
a) Create a flow such that two work objects will get created (Parent and child) 
b) Assign the parent work object to workbasket and assign the child work object to on-admin operator. 
c) In the child work object's processing activity, call queue-for-agent method and pass the parent work object's pzInsKey keeping the step page as parent work object's page. 
d) Submit the child work object, and wait till the agent run. We could see the below error in the log file. 
    ‘you are not authorized to open instance ASSIGN-WORKBASKET-'.

ROOT CAUSE

The 'pyAccessGroup' property set during the agent processing was the AccessGroup of the non-admin operator which has triggered the Agent of type Standard 

RESOLUTION

A local change been provided to set the pyAccessGroup and pyUseApplications as a part of java step with step page as parent work object's page instead of calling 'Queue-For-Agent' method, like below:
 
try {
                       ClipboardPage queuePage = tools.createPage("System-Queue-DefaultEntry", "");
                       queuePage.putString("pyPageNames(1)", myStepPage.getTopLevelPage().getName());
                        queuePage.putString("pyInsHandles(1)", tools.getDatabase().getHandle(myStepPage));
                        if (queuePage.getString("pyItemStatus").length() == 0)
                            queuePage.putString("pyItemStatus", "Scheduled");
                            queuePage.putString(".pyAccessGroup","SR95880App:Administrators");  // add the AccessGroup who have the access to the workbasket
                            queuePage.putString(".pyUseApplications","true");
                                                                                                               
                        if ("ParentChild".length() > 0)
                            queuePage.putString("pyAgentName", "SR95880" + ":" + "ParentChild");
                            tools.getThread().getQueueManager().enqueue(queuePage);
       } catch (DatabaseException ex) {
                        throw new PRRuntimeException(ex.getMessage(), ex);
         }

With this local-change (Java code), user was able to achieve the desired functionality.