Test case export fails with permission denied error despite admin role

ALM Micro Focus ALM / Quality Center
, , , , , , , ,
1

We’re encountering a persistent permission denied error when attempting to export test cases through the REST API, even though our service account has admin privileges. The export utility fails immediately with a 403 error.

Our setup involves SSO authentication through Okta with LDAP group synchronization. The service account is mapped to the “QA_Admin” LDAP group which should have full test case export permissions. However, the API call returns:


HTTP 403 Forbidden
Error: Permission denied for test case export
User: svc_qa_export lacks required privilege: EXPORT_TEST_CASES

We’ve verified the account appears in the admin console with proper roles assigned. This is blocking our automated reporting pipeline that exports test execution results for stakeholder dashboards. Has anyone experienced issues with granular RBAC permissions not syncing correctly for SSO-authenticated service accounts?

2

We encountered this exact scenario last quarter. The root cause was that our LDAP group synchronization was updating user roles correctly, but the export permission matrix wasn’t being refreshed for service accounts. Service accounts need their permissions explicitly set in the security configuration, separate from LDAP-derived roles. Even though they inherit group memberships, certain API-level operations require direct permission assignment.

3

That’s a key clue - if UI works but API doesn’t, you likely have a token scope mismatch. The web UI uses session-based auth while REST API requires bearer tokens with explicit scopes. Check your OAuth client configuration in Okta. The client used for API calls needs the “alm.test.export” scope explicitly granted. Also verify the token lifetime isn’t causing mid-export failures for large datasets.

4

The solution requires addressing multiple layers of the permission stack:

1. LDAP Group Synchronization Configuration Verify your LDAP sync is configured to propagate not just role membership but also granular permissions. In Site Administration → Authentication → LDAP Settings, ensure “Sync Granular Permissions” is enabled. Service accounts often need manual permission refresh after group changes.

2. Granular RBAC Configuration Navigate to Site Administration → Security → Role Permissions. For your QA_Admin role, explicitly enable:

  • TEST_CASE_READ
  • TEST_CASE_EXPORT
  • API_ACCESS

Then go to Project Administration → Project Users and verify the service account shows these permissions at the project level, not just inherited from global roles.

3. Test Case Export Permission Scoping The export operation requires specific entity-level permissions. Run this query in the database to verify:

SELECT user_name, permission_name, project_id
FROM auth_permissions
WHERE user_name='svc_qa_export'

If EXPORT_TEST_CASES isn’t listed for your target projects, manually add it through the security matrix.

4. SSO Token Validation for Export Operations For REST API calls, your OAuth client configuration in Okta must include:

  • Custom scope: “alm.test.export”
  • Token claim: “export_permissions” with value “test_cases”

In ALM, update the SSO configuration (Site Administration → Authentication → SSO Settings) to map this claim to the internal EXPORT_TEST_CASES privilege.

5. Force Permission Cache Refresh After making changes, clear the permission cache:

alm-admin refresh-permissions --user svc_qa_export
alm-admin validate-sso-claims --user svc_qa_export

The key issue is that service accounts with SSO authentication need both LDAP-derived roles AND explicit API permission grants. The permission denied error occurs because the REST API validator checks direct permissions first, before falling back to role-based permissions. This is a security design to prevent privilege escalation through group membership alone.

After implementing these changes, test with a simple export API call and verify the token includes the required claims in the authorization header.

5

I’ve seen this before. The issue is often that LDAP group mappings sync user roles, but test case export permissions require explicit scoping at the project level. Check if your service account has the “Test Case Export” permission enabled specifically for the projects you’re trying to export from, not just the global admin role.