Restricted profile users see all programs due to cumulative role assignments
A user assigned to a restricted profile in Adobe Experience Manager Cloud Manager can view and access all programs due to cumulative role assignments. To fix the issue, review and adjust the user’s role assignments so that only the intended restricted profiles are applied.
Description description
Environment
Adobe Experience Manager Cloud Manager (all versions)
Issue/Symptoms
A user assigned to a restricted profile intended to limit access to specific programs is able to view and access all programs in Cloud Manager. The expected restriction is not enforced. The user is assigned to multiple Cloud Manager roles in addition to the custom restricted profile. No error messages are displayed; access is broader than intended.
Steps to reproduce
- Assign a user to both a custom restricted profile and one or more standard Cloud Manager roles (such as Business Owner, Program Manager, Deployment Manager, Developer, or Integrations).
- Log in as the user and observe that access is not limited to the intended programs.
Cause
Cloud Manager permissions are cumulative; a user’s effective access is the sum of all assigned roles and profiles. Assigning both restricted and broader roles results in unrestricted access.
Resolution resolution
To fix the issue where users assigned to restricted profiles can see all programs, follow these steps:
- In Cloud Manager, check the affected user’s assigned roles and profiles.
- Confirm whether the user is assigned to any standard Cloud Manager roles in addition to the custom restricted profile.
- Remove the user from any standard Cloud Manager roles that grant broader access than desired.
- Retain only the custom restricted profile(s) that scope access to the intended programs.
- Allow some time for permissions to propagate within Cloud Manager.
- Log in as the user and verify that access is now restricted to the intended programs.