The Human Services Professionals

These permissions problems are coming from the maths behind the access masks. The way it is engineered, roster admin requires roster supervisor to be in the accessmask in order for them to gain access. But the roster admin value already includes the roster supervisor permission so you don’t have to add it. I will use the first accessmask you have talked about as an example.

The values of these three permissions are Roster_View 8, Roster_Supervisor 16, Roster_Admin 144. But Roster_Admin is a combination of 128 and 16, this means that roster supervisor will already get access to this menu item. The problem you are getting is coming from the second Roster_Supervisor being added, this means that you have 128, 16 and 16. The two 16’s in the list will be giving access to the 32 bit mask because they are added together.

When you’re doing these access masks it might be easier to treat Roster_Admin as having a value of 128, but they can only be in an access mask with roster supervisor, otherwise they will be denied access. So the access mask for the above example would actually be 152.

Sorry if this is hard to understand, it’s a hard topic to explain on paper without going into the mechanics of bit maths.