Web-only User/Role Security

Devan Bessinger

Has anyone else been moved to web-only user/role security in FE? It happened to us last week, and we are having a hard time. It is SIGNIFICANTLY different than DB view security. They changed our security groups, they weren't all 100% in line with what our users' security was previously, it doesn't translate 1-for-1 into the web view, there is a hidden security group area, duplicate users were created for many of our staff members, there's essentially no documentation or KB articles about any of it, and the folks in Blackbaud support were not prepared to provide support for this change (they honestly had no idea what I was talking about). I've already opened multiple tickets, and I'm having difficulty getting someone from support to understand WHAT was change, and what parts of it are not working & why. I'm wondering if any of you have had any luck with it so far and if so, if you have any advice.

JP Provencal

@Devan Caton
It showed up in our new test environment while I was trying to configure it.
As far as I can tell, the creation of a role in NXT is module-based and will result in an FE7 security group that matches. So instead of having a single “VP Finance” security group that provides users access to all the modules (GL, AP, Fixed Assets, etc) - I had to create a unique VP Finance roles by module which resulted in multiple FE7 security groups prefixed by module (e.g. GL-VP Finance, FA-VP Finance, SC-VP Finance, etc).

I had everything configured two weeks ago and it appeared to be working up until yesterday morning.

Lauren Henderson

@Devan Caton we apparently got moved about two months ago, and we're finding things that need additional checkboxes/configuration since the move. I understand your frustration! Luckily support was able to help with the most critical functionality that seems to have been changed/updated with the move.

Geoffrey Goodfellow

@Devan Caton I had this same experience last week. I follow Blackbaud announcements, blogs, What's New, and Community very closely, but this security change caught me by surprise, so I suspect I must have missed an announcement somewhere along the line. All of my database security roles were duplicated and parsed out in a very different way in webview. It took several days to recreate the roles in a logical way with the new webview paradigm. I was also frustrated that I couldn't find good documentation that told me what each security setting enable or disabled. The database security seemed more granular, where the webview seems like more security settings are batched. In recreating all the roles, I did have lots of users contact me to say that they lost access to various things, so it took a while to tweak things back to the way they were. I'm happy now that everything is cleaned up, but it was a mess.

Monica Lopez

@Devan Caton have you had any luck on setting correctly the role security? I'm on the same boat and haven't been able to find successfully help on the matter.

Devan Bessinger

@Monica Lopez We've made a tiny bit of progress, but it's definitely unresolved at the moment. I ended up with multiple support tickets about various different things that were amiss. I had a ton of trouble because the first level support staff didn't know what was going on with the change at all, and there's no documentation online about any of it. I finally contacted our Customer Success Manager and got all of my tickets escalated & reassigned to one higher-level support person. We've had a couple meetings so far. This support person even admitted that everything that was going on with our users and security groups/roles was VERY bizarre. She had to take a ton of notes & screenshots, then take it all back to developers. I'm really hoping to hear back from them soon!

Eva Varelas

@Devan Caton
Yes, I am trying to establish viewer-only rights for two users. It was easily done in database. cannot easily find this feature in web view. There are not FENXT articles to be found.

Devan Bessinger

@Eva Varelas I haven't checked the knowledgebase recently, but at the time I originally thought posted this, the KB had nothing in it that referenced the new format for managing security in the web view. I would definitely recommend contacting support for assistance if you can't find what you need in the KB. And if the person you initially get cannot help, press them to escalate the ticket. Involved your Customer Success Manager if you have to. In my experience, the tier 1 support staff do not really know much of anything about these changes, but if you can get the ticket escalated, there are people who can help (you just have to get to those right people). Good luck!!

Matt Duke

@Devan Caton
I set up a new AD in database view four weeks ago. Then a week and a half later, I tried to set up the rest of our new hires, but they moved my cheese!

Our experience has been in line with yours. We have people now that have access to things they shouldn't, and some can't access things they should. I have no idea how to get my new users set up properly and I worry we look like fools due to something completely out of our control. Support sends links to articles that are too generic to be helpful, and that ends up wasting more time. I've about had it with Blackbaud. Two more years, and we'll be looking for an entirely new accounting system.

Devan Bessinger

@Matt Duke I completely hear you. This opened a massive can of worms for us, but thankfully, I went above the heads of the support staff I was interacting with & was able to get my ticket escalated to someone who actually knew what she was talking about and was able to get things resolved for us (her name was Teagan - if you able to ask for the ticket to be escalated to her, she can definitely help). Definitely reach out to your Customer Success Manager at bare minimum. It's no fun being “that” customer, but sometimes you just have to raise a stink. I promise they can get you settled in though. I will say that, even after getting everything fixed, I still don't like HOW the new security works. A user isn't simply in a single security group anymore (which was nice and succinct for an auditor). Now a user has 492 different “roles." And the Security Profile reports no longer exist either. I have no idea what we are going to provide to auditors when the time comes. That's a problem for future me to figure out. ?