{"id":22107,"date":"2026-08-04T11:07:28","date_gmt":"2026-08-04T11:07:28","guid":{"rendered":"https:\/\/tenthplanet.in\/idempiere\/?p=22107"},"modified":"2026-08-13T04:50:12","modified_gmt":"2026-08-13T04:50:12","slug":"how-to-configure-role-access-update-in-idempiere","status":"publish","type":"post","link":"https:\/\/tenthplanet.in\/idempiere\/how-to-configure-role-access-update-in-idempiere\/","title":{"rendered":"How to Configure Role Access Update in iDempiere"},"content":{"rendered":"\n

The Role Access Update window in iDempiere rebuilds access records that control which windows, forms, processes and reports a role can open. Running it correctly prevents staff from seeing broken menus or missing functions during store operations.<\/p>\n\n\n\n

Process Flow<\/strong><\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Business Rules<\/strong><\/h2>\n\n\n\n
    \n
  • Roles marked as Manual access are skipped entirely; the process makes no changes for them.<\/li>\n\n\n\n
  • Selecting a specific Role updates access records for that role only.<\/li>\n\n\n\n
  • Leaving Role blank updates every active role in the current tenant.<\/li>\n\n\n\n
  • Running from the System tenant with no Role selected updates all tenants.<\/li>\n\n\n\n
  • Reset Existing Access deletes and rebuilds all access records before inserting new ones.<\/li>\n\n\n\n
  • Leaving Reset Existing Access unchecked only inserts access records that are missing.<\/li>\n\n\n\n
  • Run as Job queues the update as a background process instead of running inline.<\/li>\n\n\n\n
  • Only active windows, processes, forms, workflows and info windows are eligible for access.<\/li>\n\n\n\n
  • The Role’s User Level (System, Client, Client+Organization or Organization) decides which access levels are granted.<\/li>\n\n\n\n
  • Organization-level roles never receive windows whose name contains “(all)”.<\/li>\n\n\n\n
  • Document Action access is rebuilt for every active document type regardless of the Role’s User Level.<\/li>\n<\/ul>\n\n\n\n
    Note:<\/strong> The process rebuilds six access tables in a single run – AD_Window_Access, AD_Process_Access, AD_Form_Access, AD_WorkFlow_Access, AD_Document_Action_Access and AD_InfoWindow_Access<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Prerequisites<\/strong><\/h2>\n\n\n\n
      \n
    • Role window configured with the required window, process, form and report flags.<\/li>\n\n\n\n
    • Role’s User Level (System, Client, Client+Organization or Organization) set correctly.<\/li>\n\n\n\n
    • Users assigned to the Role that needs updated access.<\/li>\n\n\n\n
    • New windows, processes or reports already added to the application dictionary.<\/li>\n\n\n\n
    • Manual access flag on the Role reviewed if custom, hand-maintained access is required.<\/li>\n<\/ul>\n\n\n\n

      Navigation<\/strong><\/h2>\n\n\n\n

      Menu \u2192 General Rules \u2192 Security \u2192 Role Access Update<\/p>\n\n\n\n

      Configuration Steps<\/strong><\/h2>\n\n\n\n

      Step 1: Select the Role to Update<\/strong><\/h3>\n\n\n\n

      Open the Role field and pick the target role, for example POTS User. Leave it blank only when every active role in the tenant must be refreshed.<\/p>\n\n\n\n

      \"\"<\/figure>\n\n\n\n
      Field<\/strong><\/td>Sample Value<\/strong><\/td>Description<\/strong><\/td><\/tr><\/thead>
      Role<\/td>POTS User<\/td>Role whose access records will be rebuilt<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Step 2: Decide Between Reset and Incremental Update<\/strong><\/h3>\n\n\n\n

      Check Reset Existing Access to delete and recreate every access record for the role. Leave it unchecked to only add missing records and keep current permissions intact.<\/p>\n\n\n\n

      Field<\/strong><\/td>Sample Value<\/strong><\/td>Description<\/strong><\/td><\/tr><\/thead>
      Reset Existing Access<\/td>Unchecked<\/td>Adds missing access without removing current permissions<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Step 3: Choose Immediate or Scheduled Execution<\/strong><\/h3>\n\n\n\n

      Check Run as Job to execute the process in the background, or leave it unchecked for a small, single-role update that finishes immediately.<\/p>\n\n\n\n

      Field<\/strong><\/td>Sample Value<\/strong><\/td>Description<\/strong><\/td><\/tr><\/thead>
      Run as Job<\/td>Unchecked<\/td>Executes the process in the background as a scheduled job<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Step 4: Run the Process and Review the Log<\/strong><\/h3>\n\n\n\n

      Click Start to execute. Review the process log for the count of windows, forms and reports added per role before closing the window.<\/p>\n\n\n\n

      Reference: Access Tables Rebuilt by This Process<\/strong><\/h3>\n\n\n\n

      Each run inserts only the access records that are missing for the Role, based on the access level derived from its User Level.<\/p>\n\n\n\n

      Access Table<\/strong><\/td>Controls<\/strong><\/td>Access Level Rule Applied<\/strong><\/td><\/tr><\/thead>
      AD_Window_Access<\/td>Windows available to the role<\/td>Matches role’s access level; excludes “(all)” windows for Organization level<\/td><\/tr>
      AD_Process_Access<\/td>Processes and reports the role can run<\/td>Matches role’s access level<\/td><\/tr>
      AD_Form_Access<\/td>Custom forms the role can open<\/td>Matches role’s access level<\/td><\/tr>
      AD_WorkFlow_Access<\/td>Workflows the role can start<\/td>Matches role’s access level<\/td><\/tr>
      AD_Document_Action_Access<\/td>Document actions per document type<\/td>Applied to every active document type, independent of access level<\/td><\/tr>
      AD_InfoWindow_Access<\/td>Info windows the role can query<\/td>Matches role’s access level<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
      \"\"<\/figure>\n\n\n\n

      the records inserted is determined by the access level of the user<\/p>\n\n\n\n

      User Level<\/th>Allowed Access Levels<\/th>Typical Purpose<\/th><\/tr><\/thead>
      System<\/strong><\/td>4<\/code>, 6<\/code>, 7<\/code><\/td>Application dictionary and global system administration<\/td><\/tr>
      Client<\/strong><\/td>2<\/code>, 3<\/code>, 6<\/code>, 7<\/code><\/td>Tenant-wide administration and business configuration<\/td><\/tr>
      Client + Organization<\/strong><\/td>1<\/code>, 2<\/code>, 3<\/code>, 6<\/code>, 7<\/code><\/td>Most business users and client administrators<\/td><\/tr>
      Organization<\/strong><\/td>1<\/code>, 3<\/code>, 7<\/code><\/td>Day-to-day operational users within one organization<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Common Issues and Resolutions<\/strong><\/h2>\n\n\n\n
      Issue<\/strong><\/td>Cause<\/strong><\/td>Resolution<\/strong><\/td><\/tr><\/thead>
      Process updates roles across every tenant<\/td>Role left blank while logged in as System Administrator<\/td>Select a specific Role or switch to the retail tenant first<\/td><\/tr>
      Role permissions do not change after running<\/td>Role is marked as Manual access<\/td>Uncheck Manual on the Role or update access by hand<\/td><\/tr>
      Duplicate or stale access records appear<\/td>Process run repeatedly without resetting<\/td>Run once with Reset Existing Access checked to clean up<\/td><\/tr>
      Only the System role gets updated<\/td>Known behavior when run as System Administrator with no Role set<\/td>Expected result; select the correct tenant and role explicitly<\/td><\/tr>
      Selected role gets no updates at all<\/td>Role is marked as Manual access, so the process exits immediately<\/td>Uncheck Manual on the Role if automatic access is required<\/td><\/tr>
      Organization-level role is missing store-wide windows<\/td>Windows named with “(all)” are excluded for Organization-level roles by design<\/td>Use a Client or Client+Organization level role for store-wide windows<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

      Next Steps<\/strong><\/h2>\n\n\n\n
        \n
      • Configure the Role window with the required window, process and report access.<\/li>\n\n\n\n
      • Assign updated Roles to Users in the User window.<\/li>\n\n\n\n
      • Review Organization Access and Login Preferences for affected users.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

        The Role Access Update window in iDempiere rebuilds access records that control which windows, forms, processes and reports a role […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10,91],"tags":[],"class_list":["post-22107","post","type-post","status-publish","format-standard","hentry","category-idempiere-product","category-idempiere-general-rules"],"_links":{"self":[{"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/posts\/22107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/comments?post=22107"}],"version-history":[{"count":6,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/posts\/22107\/revisions"}],"predecessor-version":[{"id":22591,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/posts\/22107\/revisions\/22591"}],"wp:attachment":[{"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/media?parent=22107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/categories?post=22107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tenthplanet.in\/idempiere\/wp-json\/wp\/v2\/tags?post=22107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}