AddMembersTeamRequest in Plugin - Privilege Delay

Question

This is Dynamics CRM 2011 Rollup 11 On-Premises with SQL 2008 R2

Have the following scenario that we're trying to debug:

In a Synchronous PostCreate plugin we add users to a Team that owns a specific record and has read permission on that record via a security role. That should mean that when the Create process is completed the users added to the Team have access to the record. When such a user then goes to open the record they get a SecurityException ReadAccess error. The record does show in grids, which should not happen if they do not have Read permission on the record.

As a further test we execute the SDK call RetrievePrincipalAccessRequest for the user and record, from a console application, and see that the user does not have Read permission.

We can look a the Team Member list in the UI and user is a member of the Team. If we wait long enough (and create another record the issue will eventually resolve itself - several minutes later.)

We can add a user to the team, using the same code we executed in our Plugin (but running in a console app), and the user has Read permissions and can access the record immediately after the call completes.

There is clearly something going on in our Plugin that is causing an issue but we cannot figure out what or why - since the Create call completes without error and we can see the user listed in the UI. We are not doing anything funky - i.e., direct SQL, external service, etc.

We call a standard CRM 2011 SDK message and it completes without throwing an error. We can validate that the user was added in the user interface. The user have permission to Read the entity but they do not.

Any thoughts/ideas?? We've been tracking like crazy but haven't found our smoking gun!

UPDATE

We can reduce the incidence if you we put a pause in our plug-in code. This error only occurs when the add is done during a plug-in, not when it is done outside the plug-in. I'm starting to wonder if there is a SQL procedure/statement (there are three stored procs that fire when a user is added to a team) that gets cut short or fails to complete, for one reason or another, since the add is successful when not done in plug-in code.

I'm wondering if some part of the user's credentials are cached on the CRM Webserver. Are you logged in with the user when attempting to access the record? I'd try to give the rights, then log in and see if it works and is some how related to aggressive caching on the Crm WebServer. — Daryl

Nicknow Nicknow · Accepted Answer · 2014-09-25T11:00:34

Finally found the answer in the list of items resolved by Rollup 18 (http://support.microsoft.com/kb/2958724)

If You are assigning Team Membership via plugin, the user Cache does not get invalidated, causing an error when trying to retrieve a record. The issue occurs if the Team is has a security role and Access Rights are controlled via Team ownership.

We had opened a ticket about 2 months ago with Microsoft which had involved a lot of back-and-forth but not a definitive fix.

So if you experience the same issue on CRM 2011 you need to update to Rollup 18.

AddMembersTeamRequest in Plugin - Privilege Delay

1 Answers