Automated revenue recognition script fails on scheduled job with permission denied error

ERP Infor CloudSuite
, , , , , , , ,
1

I’ve developed a custom Groovy script in Infor OS for automated revenue recognition that runs perfectly when executed manually but fails with “permission denied” when triggered by the scheduled job. The script processes deferred revenue and posts recognition entries based on contract milestones.

The error occurs during the revenue close process:


Error: Access denied for user 'SCHEDULER_SVC'
at RevenueRecognitionService.postEntry(line 47)
Permission required: REVENUE_POST

The job scheduler seems to run under a different user context than my manual execution. I’ve verified the script has proper role-based access control configured, but the scheduled job context doesn’t inherit these permissions. Our revenue close is now delayed by two days because we can’t automate this critical process. Has anyone successfully configured job scheduler permissions for revenue recognition workflows in ICS 2022?

system 2

Here’s a comprehensive solution addressing all three critical areas:

Job Scheduler User Context: The core issue is that Infor OS Scheduler jobs run under the SCHEDULER_SVC system account by default, which has minimal permissions for security reasons. You have two approaches to fix this:

Approach 1 - Create a dedicated service account:

  1. In Infor OS Portal, create a new user account (e.g., REVENUE_AUTOMATION_SVC)
  2. Assign this account the necessary revenue management roles
  3. In your scheduled job definition, set the “Run As User” field to this service account
  4. The job will now execute with the service account’s full permission set

Approach 2 - Use context impersonation in your script:

// Pseudocode - Key implementation steps:
1. Obtain SecurityContext from Infor OS API
2. Create impersonation token for privileged user
3. Wrap revenue posting operations in impersonated context
4. Execute postEntry() with elevated permissions
5. Release impersonation context after operation completes
// See documentation: Infor OS Security API Guide

I recommend Approach 1 for better auditability and separation of concerns.

Role-Based Access Control: Verify your service account has these specific roles assigned:

  • Revenue-Manager - Base role for revenue recognition operations
  • Revenue-Poster - Allows posting recognition entries
  • Financial-Period-Writer - Permits posting to current/prior periods
  • Contract-Reader - Needed to read milestone data

In ICS 2022, these roles are hierarchical. Simply having REVENUE_POST permission isn’t sufficient - the account needs the complete role that includes this permission plus related data access rights.

To assign roles:

  1. Navigate to Infor OS Portal > Security > Users
  2. Find your service account
  3. Go to “Role Assignments” tab
  4. Add the roles listed above
  5. Ensure “Effective Date” is set to current or earlier
  6. Save and wait 5-10 minutes for role cache refresh

Audit Log Review: To diagnose the exact permission failure, enable detailed audit logging:

  1. Go to Infor OS > Administration > Audit Configuration
  2. Enable “Security Events” and “Permission Checks” for the Revenue Management module
  3. Run your scheduled job again (let it fail)
  4. Navigate to Security > Audit Trail
  5. Filter by:
    • User: SCHEDULER_SVC (or your service account)
    • Event Type: Permission Denied
    • Time Range: Last hour
    • Module: Revenue Management

The audit log will show entries like:


Event: PERMISSION_DENIED
User: SCHEDULER_SVC
Operation: RevenueRecognitionService.postEntry
Required Permission: REVENUE_POST
Required Role: Revenue-Poster
User Roles: [Scheduler-Base]
Reason: Missing required role assignment

This tells you exactly which role is missing. Add the missing roles to your service account.

Additional Troubleshooting: If issues persist after role assignment:

  • Verify the service account isn’t locked (check User Status in OS Portal)
  • Confirm the account hasn’t exceeded concurrent session limits
  • Check if your CloudSuite tenant has custom security policies that restrict service account operations
  • Review the job’s execution history logs for any timeout or connection issues

Best Practice: Create a dedicated “Revenue Automation” security role that bundles all necessary permissions, then assign this single role to your service account. This makes permission management cleaner and easier to audit. Document the role’s purpose and the specific permissions it includes for compliance reviews.

After implementing these changes, your scheduled revenue recognition job should execute successfully with proper permissions while maintaining audit trail compliance.

This draft is based on general Infor CloudSuite knowledge. It has not been verified against your specific version and environment. Practitioners: verify the steps and share your experience below.

3

The scheduler service account typically runs with minimal permissions by default. You need to explicitly grant the REVENUE_POST permission to the SCHEDULER_SVC user or configure your job to run under a service account that has the necessary revenue management roles. Check the job definition settings - there should be an “Execute As” option where you can specify a user context with appropriate permissions.

4

I’ve dealt with similar issues. The problem is that scheduled jobs in Infor OS don’t automatically inherit the permissions of the user who created them. You have two options: either create a dedicated service account with revenue management roles and configure the job to execute as that account, or modify your script to use impersonation to run critical operations under a privileged user context. The second approach requires careful implementation to avoid security issues.

nikhildata 5

Confirmed this resolves the permission denied error — creating a dedicated REVENUE_AUTOMATION_SVC account and setting ‘Run As User’ in the Infor OS Scheduler job definition fixed our nightly revenue recognition runs immediately.

6

Thanks for the suggestions. I tried setting the “Execute As” field to my user account, but the job still fails. It seems like there’s a deeper issue with how the scheduler context is established. Is there a way to review the audit logs to see exactly what permissions the scheduler is attempting to use?

7

Yes, check the Infor OS audit logs under Security > Audit Trail. Filter by the SCHEDULER_SVC user and the timestamp of your failed job execution. The logs will show you exactly which permission checks failed and what roles were evaluated. This will help you identify whether it’s a missing role assignment or a more complex permission inheritance issue. Also verify that the service account hasn’t been locked or had its roles revoked recently.

8

Another thing to check: some revenue recognition operations require not just the REVENUE_POST permission but also additional financial period permissions. If your script posts to a closed or restricted period, you’ll get permission denied even if the base revenue permissions are correct. Make sure your service account has FIN_PERIOD_OVERRIDE or similar elevated permissions if you’re posting to prior periods during the close process.

9

From a compliance perspective, be very careful about granting broad permissions to service accounts. Document everything thoroughly for audit purposes.