LI82841: The link in approval notification emails does not work for userswho have approval permission in a space but not in the catalog.

APAR status

• Closed as program error.

Error description

• Use case:
  When customer requests subscription to a product then the
  application owner gets an email with a link to subscription
  approval tasks list.
  
  Issue:  When API Manager member with subscription approval
  permissions limited to only one space receives a subscription
  request email, the link provided in the email does not take user
  to the list of subscriptions in their space.  Instead it opens
  API Manager on catalog level where the user
  has no permission to approve or decline.
  
  Solution:  Change link to lead to correct space instead of whole
  catalog level.
  
  Please see attached files.
  roles.png - here is a list of permissions which we are add for
  specific kind of user. In descriptor exercise we used IT
  Operations user access model. In next screenshots you can see
  what specific permissions each access contains on catalog and
  space level
  
  For testing, I had to invite a new user to the space who has
  been assigned four roles with permissions for each as :
     1. Draft Viewer:
       Org : View permission
     2. Viewer:
       View for Api-Analytics, App-Approval, App, Child,
  Consumer-Org, Product-Approval, Product, Susbscription-Approval,
  Subscription, Member and Org
       Create for Child
     3. Subscription approver:
       Org: Vew
       Subscription-Approval: Manage and View
     4. Dashboards :
       Org: View
       Api-analytics: Manage and View
  Note: Org: View is a permission added by default without
  selecting any permission when creating a role.
  

Local fix

Problem summary

• The link in approval notification emails does not work for users
  who have approval permission in a space but not in the catalog.
  All approvals for products, subscriptions, apps, consumer
  onboarding.
  
  When a user requests an API Connect operation that requires
  approval, an email is sent to the API Connect users who have
  permission to approve or deny the request.  The email contains a
  link to the API Connect UI screen with the approval request.
  This link always goes to the tasks list for the catalog but that
  page does not show any tasks if the user does not have
  catalog-wide permission to approve requests.
  
  The fix will put a link to the tasks in that space in the
  approval request email sent to users who only have approval
  permission in a space.
  
  Meanwhile the workaround is to navigate to the space and the
  tasks under the space.
  

Problem conclusion

• The fix is targeted for inclusion in IBM API Connect v10.0.1.11
  and v10.0.5.3
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels