Unable to hide Menu Items in LPL Script

Jeff Johnson

Trying to hide most menu options under Contract Manager and make the Contract Manager form fields read-only which works with the code below.  Custom role and custom security class have been created.  Adding to the LPL in the security class below.

Still shows  ManageSuppliersAndSubcontractors MenuItem and ContractInterface MenuItem under Contract Manager even though labeled "not accessible".

What could be wrong with the script below?  Thanks in advance for your help.

Jeff

CMContractManagerMenu_GCSH is a SecurityClass

    description is "Access Contract Manager Role and Menus"

 

    Access Rights

   

        po Module

            is accessible

                for all actions

                unconditionally

 

        ContractManager WebApp

            is accessible

                for all inquiries

                unconditionally

 

        ManageContracts MenuItem for ContractManagerHome Menu

            is accessible

                for all actions

                unconditionally

               

        ManageSuppliersAndSubcontractors MenuItem for ContractManagerHome Menu

            is not accessible

                for all actions

                unconditionally

        ContractInterface MenuItem for ContractManagerHome Menu

            is not accessible

                for all actions

                unconditionally

cleverly

There are a handful of out of the box _ST security classes that are associated with _ST roles that explicitly grant access to these two menus. 

If your test user has one of those roles assigned, plus a role associated with your CMContractManagerMenu_GCSH security class, then you've got the _ST classes saying access is explicitly granted, and the _GCSH classes saying access is explicitly denied, and in that case Landmark resolves the conflict by granting access.  Under Administration Console, there are some security reports that you can run for these two single securable objects for a specific user and it will tell you what is granting them access.

The way I understand menu item security is that the default is to grant access.  If the user has a role with a security class that denies access then they won't see it unless they happen to have another role with a different security class that explicitly grants access.