Configurations Metadata "Access Denied'

If you have a large set of metadata card rules, see this support article for a possible reason and workaround suggestions: Large-size metadata card configuration editing with TCP/IP protocol causes "Access is denied" error

Hi Joonas, I seem to be having a related, but possibly separate error (as my error has some additional detail). From the error message below it is showing this as an "unauthorized operation", however the user I am logged in as has all rights other than "full control" - I was previously able to edit metadata card configurations.

I can still make changes remotely if I log in as a different (full vault control rights) user. In both cases I am using gRPC so this doesn't seem to be linked to protocol or size of file. I have 31 metadata rules currently.

Has a change been made that impacts on the rights required to make these modifications or is the "unauthorized operation" also a timeout response?

Error: The vault settings operation "SaveConfiguration" could not be completed.
Access is denied. (Attempted to perform an unauthorized operation.)
   at MFilesErrorHelper.GetAsyncRejectionError (/lib/mfiles/MFilesErrorHelper.js:24:17)
   at Anonymous function (/lib/mfiles/helpers/VaultExtensionMethodCaller.js:88:21)
AsyncCaller.cpp, 362, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
CoVaultExtensionMethodOperations.cpp, 169, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
LatestRPC.generated.cpp, 47548, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
IRPCVaultExtensionMethods.generated.cpp, 71, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
gRPCClient.cpp, 496, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
gRPCClient.cpp, 465, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
gRPCClient.cpp, 98, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
gRPC.generated.cpp, 31985, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
RPCVaultExtensionMethods.cpp, 148, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
MCallInLoop.h, 521, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
RPCVaultExtensionMethods.cpp, 854, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
VaultSettingsConfigurationEvents.cpp, 148, The vault settings operation "SaveConfiguration" could not be completed. (0x8004014A)
VaultSettingsConfigurationEvents.cpp, 148, Access is denied. (Attempted to perform an unauthorized operation.) (0x80070005)
(M-Files 23.9.12966.6 2023-10-18T02:20:12.688Z)

I'm not aware of any changes in the required rights, although I would have assumed that modifying MDCC requires "Full control of vault" rights anyway. You may want to raise this with your reseller for further support or just give the user in question "Full control of vault" rights if they are anyway administering all aspects of the vault.

Hi Joonas, thanks for the response - seems like it is just an access thing. Potentially when I was last changing the configuration I was doing so in our full control user account and forgot that I was doing so!

Just a bit curious as to why the MDCC requires full control, but adding object types, deleting object types, etc which are much more invasive operations only require "change metadata structure"? As a matter of course I try to avoid giving any users "full control" in their default accounts just as a matter of good practice, but I would except that "change metadata structure" would also allow metadata configuration. Just a thought!

Hi Joonas, thanks for the response - seems like it is just an access thing. Potentially when I was last changing the configuration I was doing so in our full control user account and forgot that I was doing so!

Just a bit curious as to why the MDCC requires full control, but adding object types, deleting object types, etc which are much more invasive operations only require "change metadata structure"? As a matter of course I try to avoid giving any users "full control" in their default accounts just as a matter of good practice, but I would except that "change metadata structure" would also allow metadata configuration. Just a thought!

It was just my quick assumption that "Full control of vault" (aka vault admin rights) would be required since the configuration is done in the Configurations section in M-Files Admin which is mostly just for vault administrators. I don't know for certain what rights are required. I agree that "change metadata structure" would logically be enough but there might be some technical reasons why vault admin rights are required.