Symptoms

Users who are part of AD Groups that have been granted permissions on a process do not seem to maintain process rights. Users are unable to start processes when they are part of a group that has start permissions.

 

Diagnoses

This is a known issue with assigning group rights in a clustered setup with multiple K2 servers. When you make a change using Workspace (or another similar front end), it connects to one server in the cluster and updates the rights. (Process Rights are loaded into K2 Server memory at startup). Now at this point one server has the updated process rights in memory, this server must then notify the second server about the change (Cluster Message) to update its own memory. This is where the bug is in the cluster messaging.
 

Resolution

Restarting the K2 service on all machines will force all rights to be loaded into memory at startup. This only affects Group rights, not individual users.