"State" and "Life Cycle Template" Attribute Visibility - Guest Role

[BF_13811900]

Version: Windchill 13.0

Use Case: I have set up a product in my Windchill Instance. Within the product, I have added a group to the "Guest" role. This is the only role the group is associated to. I have also created a sub-type of a WTPart. When a user in this group looks at the "Details" tab of the WTPart sub-type, they are provided with values of "Secured Information" for the "State" and "Life Cycle Template". However, when they go into an OOTB WTPart (Internal Name - wt.part.WTPart), stored in the same folder of the same product, they are given visibility of the values for "State" and "Life Cycle Template". I came across this article - https://www.ptc.com/en/support/article/CS280989?source=search . Having read this, I created a new policy at the organization level in the "/System" domain which was set to apply to types of "Life Cycle Template". The "State" value was set to "All" and the "Participant" specified was my group which was associated with the "Guest" role. This then allowed my user in the group to see which "State" and "Life Cycle Template" my WTPart sub-type had been assigned to when in the "Details" tab of the object. When I edit this policy so that the participant specified is the "Guest" role, the system reverts back to not showing the user the values for the "State" and "Life Cycle Template" attributes for the sub-type part.

Description:

I cannot understand why a user would be able see which state and life cycle template one part had been assigned to and not in another, albeit the second part being of a sub-type of the first one and being on a different life cycle template. It seems the visibility of the attributes is controlled by access policies. Yet, when I include a new policy at the organization level which specifies the "Guest" role as the "Participant", this still does not give the user access. But, changing the "Participant" value to the group which is only a member of the "Guest" role in my product does allow the user to see the "State" and "Life Cycle Template" attribute values.

Can anybody explain the logic of this situation?

[Fadel · Accepted solution]

Acls are based on type /domain/state . in this case the only thing that comes to my mind is where the template is created .

Maybe user has access to template created in in his org and not the ones from other org belonging to another administrative domain 

[BF_13811900]

Hello Fede. So the two parts I made reference to in my post were stored in the same folder of the same product under an organization. A significant difference is that the sub-type part makes use of a custom life cycle created in the organization context that the product sits below. The WTPart makes use of the "Basic" lifecycle which is an OOTB object and is assigned to the "Site" context. Are you suggesting that the visibility on the attributes on one part versus the inability to see the attribute values on the other part could be to do with the fact that the life cycle templates are assigned to different contexts and therefore may be subject to different ACLs?

If this is the case, I don't think this explains why I was able to apply a policy rule which granted access to the hidden attributes to a group which was only assigned to the "Guest" role but I was not able to replicate the same functionality when I replaced the group with the "Guest" role within the same policy. Have you got any thoughts on this?

[Fadel]

The permission is required for the LC template and these resides in the system domain of the organization , the user has access to the part it self in the default domain but other administrative objects Templates/teams are following system domain . 

Here is a good article explaining the WC domain philosophy https://www.ptc.com/en/support/article/CS212423 

[BF_13811900]

Thank you!