Multitenancy add-on

Hello.
I need to create the following access hierarchy:

image

I created tenants for “a1” and “a2”. Everything works fine. Now I need to differentiate access rights to entity, for “a1_1” and “a1_2”. I mean the following: entity created by the tenant “a1_1” available for tenant “a1”, and tenant “a1_2” cannot see the created entity. And accordingly to be performed exactly the opposite for “a1_2”.

I created “a1” and “a2” tenants. Next I want to create “a1_1” and “a1_2” tenants. But the following error occurs when creating:

java.lang.IllegalStateException: Cannot get unfetched attribute [sysTenantId] from detached object com.haulmont.addon.sdbmt.entity.TenantGroup-0fa2b1a5-1d68-4d69-9fbd-dff348347f93 [detached]. at org.eclipse.persistence.internal.queries.EntityFetchGroup.onUnfetchedAttribute(EntityFetchGroup.java:100) at com.haulmont.cuba.core.sys.persistence.CubaEntityFetchGroup.onUnfetchedAttribute(CubaEntityFetchGroup.java:74) at org.eclipse.persistence.internal.jpa.EntityManagerImpl.processUnfetchedAttribute(EntityManagerImpl.java:2998) at com.haulmont.chile.core.model.impl.AbstractInstance._persistence_checkFetched(AbstractInstance.java) at com.haulmont.cuba.security.entity.Group._persistence_get_sysTenantId(Group.java) at com.haulmont.cuba.security.entity.Group.getSysTenantId(Group.java:122) at com.haulmont.addon.sdbmt.web.tenant.validators.TenantRootAccessGroupValidator.getTenantGroup(TenantRootAccessGroupValidator.java:87) at com.haulmont.addon.sdbmt.web.tenant.validators.TenantRootAccessGroupValidator.subgroupOfOtherTenantGroup(TenantRootAccessGroupValidator.java:75) at com.haulmont.addon.sdbmt.web.tenant.validators.TenantRootAccessGroupValidator.accept(TenantRootAccessGroupValidator.java:56) at com.haulmont.addon.sdbmt.web.tenant.validators.TenantRootAccessGroupValidator.accept(TenantRootAccessGroupValidator.java:32) at com.haulmont.cuba.web.gui.components.WebV8AbstractField.triggerValidators(WebV8AbstractField.java:224) at com.haulmont.cuba.web.gui.components.WebV8AbstractField.validate(WebV8AbstractField.java:217) at com.haulmont.cuba.gui.screen.ScreenValidation.validate(ScreenValidation.java:100) at com.haulmont.cuba.gui.screen.ScreenValidation.lambda$validateUiComponents$0(ScreenValidation.java:93) at com.haulmont.cuba.gui.ComponentsHelper.lambda$traverseValidatable$1(ComponentsHelper.java:96) at com.haulmont.cuba.gui.ComponentsHelper.lambda$traverseComponents$0(ComponentsHelper.java:79) at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1384) at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:580) at com.haulmont.cuba.gui.ComponentsHelper.traverseComponents(ComponentsHelper.java:78) at com.haulmont.cuba.gui.ComponentsHelper.lambda$traverseComponents$0(ComponentsHelper.java:82) at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1384) at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:580) at com.haulmont.cuba.gui.ComponentsHelper.traverseComponents(ComponentsHelper.java:78) at com.haulmont.cuba.gui.ComponentsHelper.lambda$traverseComponents$0(ComponentsHelper.java:82) at java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1384) at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:580) at com.haulmont.cuba.gui.ComponentsHelper.traverseComponents(ComponentsHelper.java:78) at com.haulmont.cuba.gui.ComponentsHelper.traverseValidatable(ComponentsHelper.java:94) at com.haulmont.cuba.gui.screen.ScreenValidation.validateUiComponents(ScreenValidation.java:92) at com.haulmont.cuba.gui.components.AbstractWindow.validateAll(AbstractWindow.java:885) at com.haulmont.cuba.gui.components.AbstractEditor.closeWithCommit(AbstractEditor.java:429) at com.haulmont.cuba.gui.components.AbstractEditor.commitAndClose(AbstractEditor.java:446) at com.haulmont.cuba.gui.components.AbstractEditor.lambda$initCommitActions$1(AbstractEditor.java:104) at com.haulmont.bali.events.EventHub.publish(EventHub.java:170) at com.haulmont.cuba.gui.components.actions.BaseAction.actionPerform(BaseAction.java:222) at com.haulmont.cuba.web.gui.components.WebButton.buttonClicked(WebButton.java:67) at com.haulmont.cuba.web.widgets.CubaButton.fireClick(CubaButton.java:76) at com.vaadin.ui.Button$1.click(Button.java:57) at sun.reflect.GeneratedMethodAccessor276.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.vaadin.server.ServerRpcManager.applyInvocation(ServerRpcManager.java:153) at com.vaadin.server.ServerRpcManager.applyInvocation(ServerRpcManager.java:115) at com.vaadin.server.communication.ServerRpcHandler.handleInvocation(ServerRpcHandler.java:431) at com.vaadin.server.communication.ServerRpcHandler.handleInvocations(ServerRpcHandler.java:396) at com.vaadin.server.communication.ServerRpcHandler.handleRpc(ServerRpcHandler.java:260) at com.vaadin.server.communication.UidlRequestHandler.synchronizedHandleRequest(UidlRequestHandler.java:82) at com.vaadin.server.SynchronizedRequestHandler.handleRequest(SynchronizedRequestHandler.java:40) at com.vaadin.server.VaadinService.handleRequest(VaadinService.java:1578) at com.vaadin.server.VaadinServlet.service(VaadinServlet.java:425) at com.haulmont.cuba.web.sys.CubaApplicationServlet.serviceAppRequest(CubaApplicationServlet.java:329) at com.haulmont.cuba.web.sys.CubaApplicationServlet.service(CubaApplicationServlet.java:215) at javax.servlet.http.HttpServlet.service(HttpServlet.java:741) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.springframework.web.filter.CompositeFilter$VirtualFilterChain.doFilter(CompositeFilter.java:108) at org.springframework.web.filter.CompositeFilter.doFilter(CompositeFilter.java:74) at com.haulmont.cuba.web.sys.CubaHttpFilter.doFilter(CubaHttpFilter.java:93) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526) at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:678) at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861) at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1579) at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) at java.lang.Thread.run(Thread.java:748)

Tell me please, what could be wrong?)

CUBA Platform version: 7.2.8
Multitenancy add-on: 2.0.2
Java version: 1.8

Hi,
Tenent hierarchy is not supported. But you may create hierarchy for access groups, create constraints for each group (see Constraints - CUBA Platform. Developer’s Manual) and assign these groups for tenents. Constraint may be created for every entity and return only entities created by user with related access group

BR, Yulia Maistrenko

1 Like