I get the message "You are not allowed to grant a right that you do not have yourself". What now?

Since the security update in version 5.47, an administrator can only grant rights they hold themselves. If you try to grant a right that you do not have, you get the message "You are not allowed to grant a right that you do not have yourself". Below the message you see which rights cause the problem.

This is not an error. The license holder can solve it.

Why does this rule exist?

Without this rule, anyone who may edit groups can give themselves or a colleague every right. For example, an employee who normally only manages bookings and gives themselves access to invoices, settings or the API. With the rule, nobody can grant more rights than they have.

Where do you see the message?

Wherever you give rights to someone:

• Assigning rights to a user group (the gear icon behind a group). Message: You are not allowed to grant a right that you do not have yourself. From version 5.50, rights you may not grant are already greyed out in the 'Unassigned' tab.
• Copying a user group that has rights you do not have. The same message.
• Adding a user to a group (the icon with the two people), or ticking a group on a user. Message: You are not allowed to assign a group that has more rights than your own. The rights you are missing are listed after the message.

Who can do it?

The license holder: the user in whose name the license is registered. This user may always grant every right. Do you not know who that is? Ask within your organisation, or contact support.

Solution

There are two ways. Choose what suits your organisation best.

Way 1: the license holder does it. Useful for a single change.

1. The license holder logs in with their own account.
2. Go to Configuration > System > User groups.
3. Click the gear icon behind the group and assign the rights from the message. Or add the user to the group.

Way 2: the license holder gives you the rights. Useful if you, as administrator, grant rights more often.

1. The license holder logs in with their own account.
2. Go to Configuration > System > User groups.
3. Find the group you, as administrator, belong to. Assign the rights from the message to it.
4. Then log in again. You now hold the rights yourself and can also give them to others.

Example

An administrator wants to build a link with an external system and wants to give API rights to an API user for it. The administrator has no API rights themselves. They get the message, with the names of the API rights after it. The license holder logs in and assigns the API rights to the group of the API user (way 1). Done.

Required rights

To manage groups you need the rights menu_config_groups and entity_group_update. That is not enough to grant every right: you can only grant the rights you hold yourself.