Description
In SaaS Ultra Environments, when a User with a custom System Role tries to access a Course that they are not Enrolled in, an error message is displayed: "Sorry! Your name is not on the list."
Symptoms
2017-12-14 05:18:57 -0500 - - blackboard.platform.restspring.exception.RestException: User is not permitted to access the requested course.
at blackboard.plugin.calendar.spring.rest.CourseScheduleRestService.getCourseSchedule(CourseScheduleRestService.java:104)
at sun.reflect.GeneratedMethodAccessor1885.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221)
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136)
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:817)
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:731)
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:959)
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:968)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:859)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:635)
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:844)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at sun.reflect.GeneratedMethodAccessor913.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:224)
at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:46)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:148)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:144)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:728)
at org.apache.catalina.core.ApplicationDispatcher.processRequest(ApplicationDispatcher.java:467)
at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:392)
at org.apache.catalina.core.ApplicationDispatcher.access$000(ApplicationDispatcher.java:63)
at org.apache.catalina.core.ApplicationDispatcher$PrivilegedForward.run(ApplicationDispatcher.java:95)
at org.apache.catalina.core.ApplicationDispatcher$PrivilegedForward.run(ApplicationDispatcher.java:83)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:303)
at blackboard.plugin.rest.web.ApiController.dispatchRequest(ApiController.java:744)
at blackboard.plugin.rest.web.ApiController.service(ApiController.java:534)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
at sun.reflect.GeneratedMethodAccessor913.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:170)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:224)
at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:46)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:148)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:144)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
at blackboard.platform.servlet.DevNonceFilter.doFilter(DevNonceFilter.java:68)
at sun.reflect.GeneratedMethodAccessor378.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:190)
...
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:190)
at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:46)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:148)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:144)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
at blackboard.platform.servlet.RequestClassParamFilter.doFilter(RequestClassParamFilter.java:42)
at sun.reflect.GeneratedMethodAccessor378.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:282)
at org.apache.catalina.security.SecurityUtil$1.run(SecurityUtil.java:279)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.Subject.doAsPrivileged(Subject.java:549)
at org.apache.catalina.security.SecurityUtil.execute(SecurityUtil.java:314)
at org.apache.catalina.security.SecurityUtil.doAsPrivilege(SecurityUtil.java:253)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:190)
at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:46)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:148)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:144)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:143)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:80)
at org.apache.catalina.valves.StuckThreadDetectionValve.invoke(StuckThreadDetectionValve.java:206)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)
at org.apache.catalina.valves.RemoteIpValve.invoke(RemoteIpValve.java:677)
at blackboard.tomcat.valves.LoggingRemoteIpValve.invoke(LoggingRemoteIpValve.java:44)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:799)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1455)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
Steps to Replicate
In a SaaS Ultra Environment:
Log into Blackboard Learn as a System Administrator
Create a custom System Role at System Admin > [Users] System Roles > Create Role
Give the Role a Name and ID > Submit
Give the Role the following Privileges
Administrator Panel
Administrator Panel (Building Blocks) > Building Blocks > Installed Tools
Administrator Panel (Building Blocks) > Logs > Authentication Logs > View Authentication Logs
Administrator Panel (Building Blocks) > Logs > Student Information System Integration Logs > View Data Integration Logs
Administrator Panel (Courses) > Courses
Administrator Panel (Courses) > Courses > Edit
Administrator Panel (Courses) > Courses > Edit > Categorize Course
Administrator Panel (Courses) > Courses > Edit > Enrollments
Administrator Panel (Courses) > Courses > Edit > Enrollments > Add Enrollment
Administrator Panel (Courses) > Courses > Edit > Enrollments > Delete Enrollments
Administrator Panel (Courses) > Courses > Edit > Enrollments > Edit Enrollment
Administrator Panel (Courses) > Course Settings > Default Course Size Limits
Administrator Panel (Courses) > Courses > Export Course
Administrator Panel (Courses) > Courses > Import Package
Administrator Panel (Courses) > Create/Modify Term
Administrator Panel (Courses) > Terms
Administrator Panel (Help) > Behind the Blackboard™
Administrator Panel (Help) > On Demand
Administrator Panel (Help) > Online Administrator Guide
Administrator Panel (Organizations) > Organizations
Administrator Panel (Organizations) > Organizations > Available/Unavailable
Administrator Panel (Organizations) > Organizations > Batch Enroll Users
Administrator Panel (Organizations) > Organizations > Create Organization
Administrator Panel (Organizations) > Organizations > Edit
Administrator Panel (Organizations) > Organizations > Edit > Categorize Organization
Administrator Panel (Organizations) > Organizations > Edit > Enrollments
Administrator Panel (Organizations) > Organizations > Edit > Enrollments > Add Enrollment
Administrator Panel (Organizations) > Organizations > Edit > Enrollments > Delete Enrollments
Administrator Panel (Organizations) > Organizations > Edit > Enrollments > Edit Enrollment
Administrator Panel (Organizations) > Organization Settings > Default Organization Size Limits
Administrator Panel (Organizations) > Organizations > Export Organization
Administrator Panel (Organizations) > Organizations > Import Package
Administrator Panel (Tools and Utilities) > Building Block Links
Administrator Panel (Tools and Utilities) > Goals
Administrator Panel (Tools and Utilities) > Logs
Administrator Panel (Tools and Utilities) > Logs > Course Cartridge Import Status
Administrator Panel (Tools and Utilities) > System Reporting
Administrator Panel (Tools and Utilities) > System Reporting > Statistics
Administrator Panel (Tools and Utilities) > System Reporting > Statistics Reports
Administrator Panel (Tools and Utilities) > System Reporting > Statistics Reports > Run
Administrator Panel (Users) > Users
Administrator Panel (Users) > Users > Available/Unavailable
Administrator Panel (Users) > Users > Edit > User Properties
Administrator Panel (Users) > Users > Edit > View Course Enrollments
Administrator Panel (Users) > Users > Edit > View Organization Enrollments
Administrator Panel (Users) > Users > Search, Not Blank
Administrator Panel (Users) > Users > Set User's Institution Roles
Course/Organization > Access unavailable course
Course/Organization (Content Areas) > Deploy Tests and Surveys
Course/Organization (Content Areas) > Edit Materials
Course/Organization (Content Areas) > Statistics Tracking/Reporting
Course/Organization Control Panel
Course/Organization Control Panel (Customization) > Tool Availability
Course/Organization Control Panel (Evaluation) > Performance Dashboard
Course/Organization Control Panel (Evaluation) > Retention Center
Course/Organization Control Panel (Evaluation) > SCORM Reports, View
Course/Organization Control Panel > Quick Enroll
Course/Organization Control Panel (Tools) > Announcements
Course/Organization Control Panel (Tools) > Discussion Board
Course/Organization Control Panel (Tools) > Tests, Surveys, and Pools > Pools
Course/Organization Control Panel (Tools) > Tests, Surveys, and Pools > Tests
Course/Organization Control Panel (Tools) > Tests, Surveys, and Pools > Tests > Build Test
Course/Organization Control Panel (Tools) > Tests, Surveys, and Pools > Tests > Delete Test
Course/Organization Control Panel (Users and Groups) > Users
Course/Organization Control Panel (Users and Groups) > Users > Change User's availability in Course/Organization
Course/Organization Control Panel (Users and Groups) > Users > Edit User Properties
Course/Organization Control Panel (Users and Groups) > Users > Enroll User
Course/Organization Control Panel (Users and Groups) > Users > Remove Users from Course/Organization
Course/Organization > Student Preview > Access Preview Account
My Settings > Settings > Personal Information
My Settings > Settings > Personal Information > Change Password
My Settings > Settings > Personal Information > Change Personal Settings
My Settings > Settings > Personal Information > Change Personal Settings, Set CD-ROM Drive
My Settings > Settings > Personal Information > Change Personal Settings, Set Language Pack
My Settings > Settings > Personal Information > Change Personal Settings, Set Text Editor Options
My Settings > Settings > Personal Information > Edit Personal Information
My Settings > Settings > Personal Information > Set Privacy Options
Student Performance Dashboard
System Admin > System Reporting > Report Definitions
System Admin > System Reporting > Report Definitions > Availability
System Admin > System Reporting > Report Definitions > Import Definitions
Create a test User and give it the custom System Role
Create a new Course and give it Ultra Course View
Do NOT Enroll the User in the Course
Log in with the test User
Locate and access the test Course
Expected Behavior:
The Course is accessible
Observed Behavior:
Sorry! Your name is not on the list.
Please check with your Administrator if you need to access this page.
Resolution / Workaround
Add the following Privileges to the custom Role:
Course/Organization (Content Areas) > Edit Materials
Course/Organization (Content Areas) > Deploy Tests and Surveys
Course/Organization Control Panel
Course/Organization Control Panel (Customization) > Tool Availability
Course/Organization Control Panel (Tools) > Tests, Surveys, and Pools > Pools
Course/Organization Control Panel (Tools) > Tests, Surveys, and Pools > Tests
Course/Organization Control Panel (Tools) > Tests, Surveys, and Pools > Tests > Build Test
Course/Organization Control Panel (Tools) > Tests, Surveys, and Pools > Tests > Delete Test
Administrator Panel (Tools and Utilities) > Calendar
Course/Organization Control Panel (Tools) > Calendar
Course/Organization Control Panel (Tools) > Calendar > Create Event
Course/Organization Control Panel (Tools) > Calendar > Edit/Delete Event
Target Release
Will Not Fix