I won’t be there, but you might consider attending Office Hours at 11am PST!
1 Like
i got a few questions, sorry if they've been answered (I don't think they have been):
-
Is the App you want External Users to be redirected to located in the
External Appsfolder (https://your_org.retool.com/folders/External%20apps) -
do you have anything listed in your 'Internal Domain List'?
-
Could you also try click the
View External Users Permission Groupat the bottom of the External Apps page and see if that user is listed there or not?
I also kinda wanna point out there are 2 places you can set the 'landing page':
- Settings -> External Apps -> Create A Landing Page
- Settings -> Permissions -> Click a Group -> Additional Tab -> Landing Page
In the 2nd place, you're able to set the landing page for groups other than just External Users. Which begs the question: If a user is in more than one group, and each group has a different landing page, then which landing page do you use.
So we may have a problem where the group that takes top precedence has 'no landing page' set, so even though one of the less important (lower in precedence) groups like External Users designates App1 as the landing page, it isn't used because there is a more important group.... if that makes sense
1 Like
Hi @Ashish_Agarwal,
Currently looking into this with out Governance eng team.
- Since the external users also belong to the "All Users" group, be sure that "All Users" do not have any permissions other than "Use" for apps. And be sure that's true for the "External Users" permission group as well for that matter.
- It looks like their External User group
ownsa page called “Template”. I think a group needs only view-only permissions to any apps for a it’s landing page to work. Applying the edit or own permissions to an app will make external users editors, which is likely why you saw that in the top right under the profile pic.
Once you remove the 'Own' permissions the page 'Template' for External Users, I believe this should resolve 
@Jack_T thanks for prompt digging. Removing the template ownership has solved this issue now. But I am not sure how this template got assigned at the first place? I have not made any changes as such. Also, this was working completely fine till 2 days back.
Nevertheless, really appreciate looking at this so quickly and solving it. You guys are the best!
1 Like
We found the cause of the issue!
Normally, 'External User's are fully restricted from 'Own' or 'Edit' permissions, which prevents issues like this from occurring.
We have now discovered that through the 'Group Direct Sharing' they can be incorrectly given 'own' permissions and this will be an easy patch to ensure that you can share direct to any group BESIDES the External Users group 
1 Like
Glad things are fixed now!
Super weird, as you or someone else on your org would likely have triggered sharing the template ownership, but if no one shared it then maybe we have a ghost in the system 
I can check and see if there are any possible logs that can give us some answers on what caused the template to be shared with the external user group, but I am not certain we have tracking that granular
Hey @Darren,
I was finally able to get some more info and dig into the issue. Firstly, this is not happening to all of my external users, just most of them. Secondly, the users who are impacted by this also are not able to use the intercom integration that I have setup. Lastly, I did see the same results as @Ashish_Agarwal with the users saying they are editors, when they clearly are not.
User with landing page assigned:
User no landing page (Notice the editor role)
Editor permissions:
Console log of user:
Thanks for the update, @Ignacio_Galdos. I'm guessing some users are being affected by the same thing that @Jack_T mentioned above - that they were accidentally granted Edit or Own permissions to one or more apps. Can you double check the specific app-level permissions associated with the relevant groups?
@Darren Here is the access for the user.
@Jack_T This fix did not work for me as I did not have any users with own or edit permissions. Any advice for me?
Are you able to attend Office Hours at 11am PST, @Ignacio_Galdos?