Reviewer in workflow with Read privileges gets "Unable to build check-in form. User '<user>' does not have sufficient privileges." after checking in content. (Doc ID 2596781.1)

Unable to build check-in form. User '<user>' does not have sufficient privileges.

Workflow steps grant a level of access that can override the permissions defined by security roles. For example, a user assigned to a Review/Edit Revisions or Review/New Revision step has the ability to check out and check in items through My Workflow Assignments even if that user has a read-only role to the security group to which those items belong.

References:

12.2.1.0: Managing Workflows

12.2.1.4: Managing Workflows

A. Setup Workflow

1. Create user testuser_r with role readonly where that role has R to Public

2. Create user testuser_rw with role contributor where that role has RW to Public

3. Create Framework Folder TestFolder

4. Create basic criteria workflow called TestWorkflow using Security Group "Public" and Document Type "Application".  Then, click Add in Criteria.  Enter the following:

• Name: Review1
• Select "Users can review and edit (replace) the current revision"
• Users tab -> click Add User
• Select testuser_r and then OK.
• Click Enable

 

B. Replicate issue

1. Login as weblogic and checkin content item using following metadata so the content item will enter into workflow.

• Type: Application
• Security Group: Public
• Folder: /TestFolder

2. Logout and login as testuser_r.  Navigate to My Content Server -> My Workflow Assignments. 

3. Click on Actions -> Check Out

4. In the Check-Out Confirmation page, click Checkin

5. In the Content Check-In Form, keep the "Revision Finished Editing" checkbox checked and select a primary file.  Then click Check In button.

6. Issue is replicated with the Content Server Request Failed page displaying "Unable to build check-in form. User 'testuser_r' does not have sufficient privileges."

7. Searched for content item and found it.  Clicked on content info and it contained the metadata and file changes.  Content was released.

 

C. Observe behavior when content item isn't in folder

1. Login as weblogic and checkin another content item (without specifying a folder) using following metadata so the content item will enter into workflow.

• Type: Application
• Security Group: Public
• Folder:

2. Logout and login as testuser_r.  Performed same steps as above and issue didn't occur.  Page was redirected to the "Workflow In Queue for testuser_r" page.

 

D. Observe behavior when user has Read Write privileges

1. Removed testuser_r as reviewer in the workflow. Added testuser_rw as reviewer.  

2. Checked in another content item using following metadata so the content item will enter into workflow.

• Type: Application
• Security Group: Public
• Folder: /TestFolder

3. Logout and login as testuser_rw.  Navigate to My Content Server -> My Workflow Assignments. 

4. Performed same steps and issue didn't occur.  Page was redirected to the "Check-In Confirmation" page though instead of the "Workflow In Queue for testuser_rw" page.

5. Logged in as weblogic and checked in another content item but didn't specify a folder.  Logged in as testuser_rw and performed same steps.  Issue didn't occur.  Page was redirected to the "Workflow In Queue for testuser_rw"
page.



In summary, page redirection is different when content item is in folder.  

When the content was not checked into a folder, the page is redirected to "Workflow In Queue for<user>" page.

When the content was checked into a folder, the page is redirected to the "Check-In Confirmation" page.  Expecting page to be redirected to "Workflow In Queue for <user>" page. When the user only has read privileges though, the error occurs.