none
Unusual "Access Denied" message for user on Timesheet Approvals page RRS feed

  • Question

  • I have one user that is receiving an "Access Denied" error when visiting the page to approve timesheets for his resources.  It's an usual permissions error, happening after the page tries to load and only showing a small red message in the middle of the window.  See below for screenshot.

    This manager is responsible for two resources and they have deleted all of their unapproved timesheets.  He has been able to use this page before to do approvals in the past without issue.  We've tried in multiple different browsers, and I have tried temporarily giving him Administrative permissions which did not affect anything.

    In the ULS logs I see the following messages that are not providing very much information.  I can't seem to find any further information on these error messages online.

    Error is: GeneralSecurityAccessDenied. Details: Statusing . Standard Information: PSI Entry Point:  Project User: i:0#.w|username Correlation Id: 6ae91b7e-8fac-e411-9418-005056a57bda PWA Site URL: https://sitename/ProjectServer SA Name: Project Server Service Application PSError: GeneralSecurityAccessDenied (20010), LogLevelManager Warning-ulsID:0x35666834 has no entities explicitly specified.

    And the next error I can't tell if this is because of the permissions issue or if it actually caused the permission issue.  Since it happens after the access denied message I believe it's a result of the permissions issue rather than cause.

    PWA:https://sitename/ProjectServer, ServiceApp:Project Server Service Application, User:i:0#.w|username, PSI: System.NullReferenceException: Object reference not set to an instance of an object.     at Microsoft.Office.Project.Server.BusinessLayer.Statusing.StatusApprovalsQueryInfo.AddAllTimesheets(DataTable& dt, Dictionary`2& timephased, List`1& actualDates)     at Microsoft.Office.Project.Server.BusinessLayer.Statusing.StatusApprovalsQueryInfo.TryLoad(LoadApprovalType method, DataTable& dt, Dictionary`2& timephased, List`1& actualDates), LogLevelManager Warning-ulsID:0x6333626E has no entities explicitly specified.

    Appreciate any advice you may have

    Brad

    Thursday, February 5, 2015 4:54 PM

Answers

All replies

  • Hi Brad,

    Since you have tried with different browsers and giving the manager admin rights, I'd say it might be due to the deleted timesheets. Before going into complex debugging, you could open a delegation session and see if you see the same error message.

    Then I guess you have some orphan timesheets in the DB (see this blog). I'm not IT skilled enough but I would try to query the DB to see if the deleted timesheets are still living somewhere.

    See also those references which might help you:


    Hope this helps,


    Guillaume Rouyre, MBA, MVP, P-Seller |


    Friday, February 6, 2015 10:46 AM
    Moderator
  • Hi Guillaume,

    Thank you for your reply.  Unfortunately your first link is unrelated, but we did have that problem until updating to SP1.  Currently our Project Server is updated to the September 2014 CU.  The other two links were things I had seen previously when searching online but didn't assist in my case.

    I do believe this is related to corrupted data rather than server permissions.  I should clarify that the employees didn't delete their unsubmitted timesheets until after this problem started happening and when we were trying to resolve the issue.  But I have looked through many SQL tables, comparing to other timesheet managers, but I don't see any red flags and I don't have a clear direction on what I should be looking for.

    Thank you for the tip on delegation.  I do receive the same error as him when I act as his delegate.  This will be very helpful for debugging as it will be easier for me to check than to have him keep checking.  I've opened a support case with MS since this seems to be particular to our situation.

    Thanks!

    Tuesday, February 10, 2015 9:02 PM
  • Two possible causes,

    1. When you open the Approval center, the view might tried to access the deleted timesheet.

    2. Approval center view which is stored in the user properties

    To isolate the issue,

    a. Open those two resources in Manage users, move this manager from those resource's Timesheet manager.

    b. Remove this manager from 'Timehsheet managers' under Server Settings.

    Did you find any Timesheer ID in the ULS log when you reproduce the issue?

    Another Scenario:

    Assume that you can access a given Team Builder view by clicking Build Team button in the Projects tab in PWA. Then, your access permission to this Team Builder view is removed. However, you still have access permission to other Team Builder views. When you try to visit other Team Builder views by clicking Build Team, you receive the following error message:

    Access Denied.

    To clear this,

    Login into PWA as another user, approval center, Change the Filter and Group by and set the dummy date range

    Then login as the problematic user and check the status.


    Cheers. Happy troubleshooting !!! Sriram E - MSFT Enterprise Project Management


    Tuesday, February 10, 2015 10:39 PM
    Moderator
  • Guillaume, it turns out your first reference link contained the answer at the end of the thread.  It was related to 'Archived' projects. 

    We found that even though the user was granted the 'Administrator' role, they were still within the 'All Non-Admin Users' group which is denied access to Archived projects.  This caused the access denied issue when trying to load timesheets with time entered against archived tasks.  So it didn't turn out to be a case of corrupted data, but demonstrated Project Server's poor permissions structuring and diagnostics.

    Thank you for your assistance.

    Tuesday, February 17, 2015 5:34 PM
  • You're more than welcome Brad and thanks for the feedback!


    Hope this helps,


    Guillaume Rouyre, MBA, MVP, P-Seller |

    Tuesday, February 17, 2015 9:32 PM
    Moderator