Cannot create or delete activities for a project

Question

I am attempting to set permissions for developers under different project workspace folders. I am the DTR administrator and have done all initial configurations at the root and system level as per the SAP help documentation after creating a "New DTR Client". I have a workspace folder /ws/XYZ. I gave user USER1 full privileges to /ws/XYZ so that he can do development on that specific project.
But USER1 is unable to create an activity during the process of a new DC creation. Here is the error I get
17:33:13.319  FAILED: Creating activity failed: act_w_JDITEST1_intel_JDI_TEST_dev_inactive_u_bvedamur_t_2006_03_07_01_33_13_GMT_97971c06-3fbb-47b4-b1b1-a693fcc0ceb9 - Forbidden [(pre||post)-condition failed: DAV:access-denied]
USER1 has "NWDI Developer" access and has been assigned all privileges under /ws/XYZ. What am I missing here.
Appreciate any help.
Thx
Bhaskar

Answer 1

Hi Bhaskar,
Follow these rules when assiigning the previliges:
Authorizations for the DTR Client
With these settings, you can use the client to display the content of a DTR.
/ - read
/vh - read
/ws - read
/wsh - read
In order to make changes (create files, check in activities, upload files, and so on), you need these extra permissions:
/act - read, write, checkin
/wr - read, write
/vh - write
/wr - read, write
In addition, every user needs the privileges read, write, and checkin for the resources to be changed, and the checkin privilege for the respective workspace.
BTW: It's not a good idea to give full rights to every developer, the access to the different tracks should be given by the power user/manager or NWDI administrator regarding the SC/Track lifecicle.
Also you need to follow the ACL rules:
Rule 1 – final Before All Children
Rule 2 – ignore inheritance
Rule 3 – Child Before Parent
Rule 4 – user before group
Rule 5 – deny before grant
And be careful with the deny rule as it's very powerful and overwrites all other rules.
No developer should have access to /ws/system
If you use "deny All users" to some resource, be sure that you give explicit access to Admin user to this resource as rule "user before group" is before "deny before grant". 
(help.sap.com)
Regards, Angel
Message was edited by: Angel Dichev