SUMMARY:
This tech note describes an expected behavior that can be observed when performing object migrations between Strategy environments. Specifically, the tech note addresses ACL or Access Control List entries that are removed by Strategy during certain object migrations in Strategy Object Manager.
SYMPTOM:
When performing Object Manager migrations between environments using Strategy Object Manager, it can be observed in certain cases that ACL entries defined in the source environment are not carried through to the destination environment of the migration. This may occur in some but not all migrations between the same source and destination environment.
CAUSE:
ACL entries defined on Strategy metadata objects such as attributes, reports, or folders consist of an Access Entity and a defined Permission. The Access Entity is either a Strategy User or User Group object that exists in the metadata. Whenever an ACL entry is defined on an object, for example, adding the Everyone group with the View permission set, it is the Object ID of the Access Entity that is associated with the ACL definition, not the name of the Access Entity.
Therefore, if a behavior similar to the above is observed, it is likely that the User or User Group object defined in the ACL list has a different object ID in the source and destination environments. This occurs when the User or User Group was defined separately in each environment instead of migrated across from source to destination using a Configuration Package.
Since the Object ID of the User or User Group defined in the ACL list does not exist in the destination environment, that ACL entry will simply be dropped from the list. This behavior is expected.
ACTION:
There are two actions that can be taken to correct this behavior.
1) If very few objects were affected, simply re-adding the ACL entries in the destination environment will restore correct accessibility to objects.
2) In order to prevent this behavior from occurring, User and User Group objects need to by synced in terms of Object ID between the source and destination environments. This can be done using a Configuration Package in Object Manager to migrate User and User Groups from the source to destination environment, before performing the standard object migrations. For more information regarding Configuration Packages, consult the Object Manager chapter of the System Administration Guide product manual.
