When you specify the following configuration property, SAS Enterprise GRC might enable a user with a lower security clearance to see an incident with a higher security classification:

However, the web application might return an HTTP 500 error when the user tries to edit an incident with a higher security classification.

Below is an example of how to replicate this problem:

1. In configdata.properties, set monitor.incidentComponentSecurity.ignored = true.
2. Set the security clearance for the user X, such as "Available only to Senior Managers in Business Units."
3. Log on as an administrator, and create an event that has higher security clearance, such as "Available only to Senior Managers in Head Quarters."
4. Log on as user X, and try to edit the event. You see an HTTP 500 error.

Click the Hot Fix tab in this note to access the hot fix for this issue.

When you specify monitor.incidentComponentSecurity.ignored = true, you can prevent a user with a lower security clearance from seeing incidents containing a higher security classification by specifying the following new configuration property:

Operating System and Release Information

A fix for this issue for SAS Enterprise GRC 6.1 is available at:

A fix for this issue for SAS Enterprise GRC 6.1 is available at: