BCS Set Permissions problem with PowerShell

Question

Hello, I am seeing an odd behavior, was wondering if anyone else encountered this problem before.
I have a large BDC Model with multiple Entities (ECTs) that was created with Visual Studio, as part of the process we have a Powershell script that iteritates all the entities and sets their permissions to the 'All Authenticated Users' group. 
$serviceContextURL="https://ACME.dsi-sp.com/"
$ECTNamespace="ACMEBusinessDataConnectivityModel.ACMEReportingPortal"
[String[]]$permissions=@("Execute","Edit","SelectableInClients","SetPermissions")
$bdc = Get-SPBusinessDataCatalogMetadataObject -BdcObjectType Catalog -ServiceContext $serviceContextURL
# Get the list of all LOB systems
$lobs = $bdc.GetLobSystems("ACMEReportingPortal")
Foreach($lob in $lobs){
    $lobEntities = $lob.Entities
    Write-Host $lob.DefaultDisplayName
    foreach($entity in $lob.Entities) {
        write-host "ECTName: " $entity.Name
        $ECTName = $entity.Name
        $ECT = Get-SPBusinessDataCatalogMetadataObject -BdcObjectType "Entity" -ServiceContext $serviceContextURL -Name $ECTName -Namespace  $ECTNamespace
        if($ECT-ne $null)
             $user = New-SPClaimsPrincipal -EncodedClaim "c:0(.s|true"
             Grant-SPBusinessDataCatalogMetadataObject -Identity $ECT -Principal $user -Right $permissions
             write-host "Permissions set for " $ECTName
        else
             write-host -f Yellow $ECTName external content type does not exists
The script works fine as expected, however when you try to access the External List that is based on one of these ECTs, you get access denied. I then go into BCS validate the permissions are set as expected i.e. 'All Authenticated Users' is selected with
the four permission, and it looks fine. try again access denied. I then go and remove the 'All Authenticated Users' group from Permissions, and manually re-add it back, try the External list again, now it works. !
Has one seen this before or can comment on why it is not working with powershell?  is there a service recycling needed perhaps or something like that?
Thanks in advance, mark
Mark A. Eckert SharePoint Consultant Pharmica Consulting, Inc.

Answer 1

Thanks for responding. 
its too repetitive to keep adding permissions via CA, there are a lot of entities and we are in a constant state of developing the BDC solution so we are deploying it a lot.
In ULS, it looks like impersonation is breaking down with ReadList and NT AUTHORITY\IUSR
02/05/2013 13:45:55.52  w3wp.exe (0x0E7C)                        0x0834 Business Connectivity Services Business Data                
 g0jq High     Access Denied for User '0#.w|dsi-sp\meckert', which may be an impersonation by 'NT AUTHORITY\IUSR'. Securable MethodInstance with Name 'ReadList' has ACL that contains:   8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53  w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Monitoring                     b4ly High     Leaving Monitored Scope (EnsureListItemsData). Execution Time=636.737909427036 8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53  w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Web Parts                      89a1 High     Error while executing web part: Microsoft.SharePoint.SPException: Access denied
by Business Data Connectivity. ---> Access Denied for User '0#.w|dsi-sp\meckert', which may be an impersonation by 'NT AUTHORITY\IUSR'. Securable MethodInstance with Name 'ReadList' denied access. Stack Trace:    at Microsoft.SharePoint.BusinessData.Runtime.DataClassRuntime.ExecuteInternal(IDataClass
thisDataClass, ILobSystemInstance lobSystemInstance, ILobSystem lobSystem, IMethodInstance methodInstanceToExecute, IMethod methodToExecute, IParameterCollection nonReturnParameters, Object[]& overrideArgs)     at Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.ExecuteInternal(IDataClass
thisDataClass, ILobSystemInstance lobSystemInstance, ILobSystem lobSystem, IMethodInstance methodInstanceToExecute, IMeth... 8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53* w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Web Parts                      89a1 High     ...od methodToExecute, IParameterCollection nonReturnParameters, Object[]&
overrideArgs, IFilterCollection filters)     at Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.ExecuteFiltered(IEntity this, IFilterCollection filterCollection, IMethodInstance methodInstanceToExecute, ILobSystemInstance lobSystemInstance)    
at Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.<FindFiltered>b__3(IEntity e, IMethodInstance mi, IFilterCollection fc, ILobSystemInstance lsi)     at Microsoft.SharePoint.BusinessData.Runtime.EntityInstanceEnumeratorFactory.CreateEntityInstanceEnumerator(IEntity
entity, IMethodInstance methodInstance, IFilterCollection filters, ILobSystemInstance lobSystemInstance, ExecutionCallBack executionCallBack)     at Microsoft.SharePoint.BusinessData.MetadataModel.Sta... 8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53* w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Web Parts                      89a1 High     ...tic.Entity.FindFiltered(IFilterCollection filterCollection, String finderName,
ILobSystemInstance lobSystemInstance)     at Microsoft.SharePoint.SPListDataSource.GetEntityInstanceEnumerator(XmlNode xnMethodAndFilters)      --- End of inner exception stack trace ---    
at Microsoft.SharePoint.SPListDataSource.GetEntityInstanceEnumerator(XmlNode xnMethodAndFilters)     at Microsoft.SharePoint.SPListDataSource.GetFilteredEntityInstancesInternal(XmlDocument xdQueryView, Boolean fFormatDates, Boolean fUTCToLocal,
String firstRowId, Boolean fBackwardsPaging, String& bdcidFirstRow, String& bdcidNextPageRow, List`1& lstColumnNames, Dictionary`2& dictColumnsUsed, List`1& mapRowOrdering, List`1& lstEntityData)     at Microsoft.SharePoint.SPListDataSource.GetFilteredEntityInstances(XmlDocument
xdQue... 8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53* w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Web Parts                      89a1 High     ...ryView, Boolean fFormatDates, Boolean fUTCToLocal, String firstRowId, Boolean
fBackwardsPaging, String& bdcidFirstRow, String& bdcidNextPageRow, List`1& lstColumnNames, Dictionary`2& dictColumnsUsed, List`1& mapRowOrdering, List`1& lstEntityData)     at Microsoft.SharePoint.SPListItemCollection.EnsureEntityDataViewAndOrdering(String&
bdcidFirstRow, String& bdcidNextPageFirstRow)     at Microsoft.SharePoint.SPListItemCollection.EnsureListItemsData()     at Microsoft.SharePoint.SPListItemCollection.get_Count()     at Microsoft.SharePoint.WebControls.SPDataSourceView.ExecuteSelect(DataSourceSelectArguments
selectArguments, String aggregateString, Boolean wantReturn, BaseXsltListWebPart webpart, SPListItem& listItem, SPListItemCollection& listItems, String[]& fieldList)     at Microsoft.ShareP... 8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53* w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Web Parts                      89a1 High     ...oint.WebControls.SingleDataSource.GetXPathNavigatorInternal()    
at Microsoft.SharePoint.WebControls.SingleDataSource.GetXPathNavigator()     at Microsoft.SharePoint.WebPartPages.DataFormWebPart.PrepareAndPerformTransform(Boolean bDeferExecuteTransform) 8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53  w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Web Parts                      89a2 High     InnerException 1: Access Denied for User '0#.w|dsi-sp\meckert', which may be
an impersonation by 'NT AUTHORITY\IUSR'. Securable MethodInstance with Name 'ReadList' denied access. Stack Trace:    at Microsoft.SharePoint.BusinessData.Runtime.DataClassRuntime.ExecuteInternal(IDataClass thisDataClass, ILobSystemInstance
lobSystemInstance, ILobSystem lobSystem, IMethodInstance methodInstanceToExecute, IMethod methodToExecute, IParameterCollection nonReturnParameters, Object[]& overrideArgs)     at Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.ExecuteInternal(IDataClass
thisDataClass, ILobSystemInstance lobSystemInstance, ILobSystem lobSystem, IMethodInstance methodInstanceToExecute, IMethod methodToExecute, IParameterCollection nonReturnParameters, Object[]& overrideArgs, IFilterColle... 8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53* w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Web Parts                      89a2 High     ...ction filters)     at Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.ExecuteFiltered(IEntity
this, IFilterCollection filterCollection, IMethodInstance methodInstanceToExecute, ILobSystemInstance lobSystemInstance)     at Microsoft.SharePoint.BusinessData.Runtime.EntityRuntime.<FindFiltered>b__3(IEntity e, IMethodInstance
mi, IFilterCollection fc, ILobSystemInstance lsi)     at Microsoft.SharePoint.BusinessData.Runtime.EntityInstanceEnumeratorFactory.CreateEntityInstanceEnumerator(IEntity entity, IMethodInstance methodInstance, IFilterCollection filters,
ILobSystemInstance lobSystemInstance, ExecutionCallBack executionCallBack)     at Microsoft.SharePoint.BusinessData.MetadataModel.Static.Entity.FindFiltered(IFilterCollection filterCollection, String finderName, ILobSystemInstance ... 8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53* w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Web Parts                      89a2 High     ...lobSystemInstance)     at Microsoft.SharePoint.SPListDataSource.GetEntityInstanceEnumerator(XmlNode
xnMethodAndFilters)  8b44f992-350b-4560-bf52-e0308d4b6382
02/05/2013 13:45:55.53  w3wp.exe (0x0E7C)                        0x0834 SharePoint Foundation        
 Monitoring                     b4ly High     Leaving Monitored Scope (DataBinding DataFormWebPart (Submission Milestone)). Execution
Time=684.852125060587 8b44f992-350b-4560-bf52-e0308d4b6382
Mark A. Eckert SharePoint Consultant Pharmica Consulting, Inc.