Who is this article for?

Please Review Users trying to access Please Review from inside an integration

Admin access will be required on both the Please Review and integration side to carry out all the steps

Whether a user can use Please Review inside an integration needs it all to be setup correctly. This article explains reasons why you might not be able to or that you get the message, "You are not licenced to use the Please Review feature. Please contact your administrator."

This article is split into the following sections:

1. Only just added user on external system
2. Sync failing
3. Configured to import only certain users
4. Users sharing email address on external system
5. Unsupported version
6. Sync not running
7. External system no longer matches PR

1. Only just added user on external system

The external sync is set to run on a regular basis, by default every 24 hours but some installations can be configured to sync more frequently. If you have only just added the user, you may need to wait for a sync of the locked workgroup to take place. You can trigger a full sync early in the AdminClient app on the server or you can trigger a sync of just the workgroup in Admin > workgroup management > Members page. For a locked workgroup, there will be a Sync button. Note that if there are a large number of members, this may not complete before the page session times out. The execution timeout can be increased if need be or the AdminClient method on the server to start an ExternalSync can be used instead.

2. Sync failing

If the regular external sync fails, it should email any SYSADMIN users on the system with the details and it may be that this could prevent users to be added correctly until the sync error is fixed. Possible reasons can vary but typical ones are that the user we login to the external system to sync with has had their password change so we can't sync anymore, or that a user has had their email address changed to one that matches another user already coming that external login source. We don't support users sharing the same email address on the external system so that will need to be resolved. Any sync errors should be resolved to ensure proper operation of the integration.

3. Configured to import only certain users

With certain authentication sources, it can be configured to only import certain users in the sync. For example, with the Veeva Vault, there is a MapUsersSecurityPolicy setting. The way this setting works is that 

• All imports all users in the group
• The SSO setting will only import users if they have an external login username for SAML2/etc configured in Veeva
• If Basic setting will only import users that don't have an external login username for SAML2/etc configured in Veeva

This was in place as when we started deploying this integration it was originally accessed in a PR-centric fashion, logging in to PR and then pulling the docs from VV and it wouldn't work if they used an external auth login in VV in that use case. We since developed the VV-centric way, where they login to VV and access PR from inside VV so this restriction is really not needed and users should set this to All to ensure all users are included in the import.

4. Users sharing email address on external system

We don't support users sharing the same email address on an external system. This can generate users in Please Review that are connected to multiple users on the external system and can cause problems. Users should be corrected if in this situation but note that if they have been able to send over a review to Please Review if they are then detached from the single user that has the review in Please Review, they will lose access to it, and this may leave that review stuck and needing to be closed manually.

5. Unsupported version

As versions develop of integrations and Please Review it may be that the combination in use there is incompatible. For example, some of the latest versions of the Veeva integration, using the versions of the Veeva API such as v19.3 will not work with Please Review versions before v7.1.1. This is known to cause a sync to be empty of any users at all to a locked workgroup and other errors to occur too.

6. Sync not running

If the TaraService process has crashed for some reason, the regular sync will not be running. The logs could be checked to work out why the TaraService stopped.

Also, if the regular sync fails, this generates an email to the SYADMIN user. For our hosted customers, this generates a Support ticket with us. This can be generating a ticket every day, or more frequently if your regular sync is set to sync more often. Support will reach out to the customer to try and get this rectified but if we are unable to get this fixed, we may have to set the frequency to every 99999 hours, to effectively disable the sync, to stop it generating masses of tickets with us. Ways to avoid this are to set the default SYSADMIN user to your own email address so that you get such emails or to work with us when contacted to get this fixed. Obviously, if this is the case, we can reinstate this sync at any time, but if it is still erroring, we may need to still work to stop this generating the sync error tickets.

7. External system no longer matches PR

If the external system has changed so is no longer exactly the same system that was setup with Please Review, such as with Veeva Vault if the vault has been refreshed, we need to refresh the PR side too as the user ids, document ids and the id for the group of users we sync with, under the hood in the database, may well no longer tally up, even if all the names and IDs in the application remain the same. It may mean reinstalling the Please Review instance and/or starting over with a new PR database. Configs may need to be updated too. If it is Veeva Vault that is involved, that is covered here: Veeva Vault Integrated Please Review Requirements for refreshing Vaults