Permission denied error #781
Comments
|
I'm encountering the same issue today. I would greatly appreciate it if anyone could share a solution. |
|
Also me I'm facing the same error in the cloud, in local is working fine (SDK: 2025.1.19149.20250116T154450Z-241100 and netcentric.actool version: 3.3.0) |
|
Can anybody export detailed logs of the issue? |
|
By cloud logs, I see that the bundle is unregistered and never re-registered: 31.01.2025 10:47:44.638 [cm-p******-e******-aem-author-******-sqcwb] INFO [FelixLogListener] Events.Service.org.apache.sling.serviceusermapper Service [org.apache.sling.serviceusermapping.impl.ServiceUserMapperImpl.amended~ncActoolSystemUser,808, [org.apache.sling.serviceusermapping.impl.MappingConfigAmendment]] ServiceEvent UNREGISTERING I don't know if could be usefull this log, but is the only one I found, no error are printed in the errorlog |
|
I collected more logs from my last deployment, it seems that AC Tool is registered and after a minute is unregistered and finally stopped. The logs are shown below, I hope they help Registering 31.01.2025 10:45:37.666 [cm-p******-e******-aem-author-6cb57654df-nw57q] INFO [ResourceResolverFactory registration] biz.netcentric.cq.tools.actool.impl.AcInstallationServiceImpl Activated AC Tool at start level 30 default config path: [] Unregistering |
|
The log shows two different kubernetes pods ( Compare with https://github.com/Netcentric/accesscontroltool/blob/develop/docs/ApplyConfig.md#touch-ui
|
|
thanks for your reply @kwin Until a fortnight ago I was able to invoke the tool without any problem. Could you please be more precise? Console Error: thanks in advance |
|
Please adjust the log level to DEBUG to see the underlying issue. There are quite some DEBUG logs in |
|
Seems the default OSGi configuration for PID It looks like this in 2025.1.19149 This was like this since quite some time but due to this change https://experienceleague.adobe.com/en/docs/experience-manager-cloud-service/content/security/changes-in-user-group-and-product-profile-synchronization?lang=en e.g. the Cloud Manager groups are no longer visible (i.e. completely irrelevant in this config). Before all users having access to CloudManager implicitly had access to ACTool as well... |
|
Probably leveraging our own config to manage the access (similar to what Groovyconsole does, orbinson/aem-groovy-console#55) is reasonable. That way it should be more stable. |
|
Ok, thanks @kwin, do you need the logs in debug level? thanks |
No longer leverage PID SlingWebConsoleSecurityProvider as defaults no longer reasonably set in AEMaaCS This closes #781
No longer leverage PID SlingWebConsoleSecurityProvider as defaults no longer reasonably set in AEMaaCS. Disable action buttons depending on permissions. Clean up HistoryUtils to leverage JcrUtils This closes #781
No longer leverage PID SlingWebConsoleSecurityProvider as defaults no longer reasonably set in AEMaaCS. Disable action buttons depending on permissions. Clean up HistoryUtils to leverage JcrUtils This closes #781
No longer leverage PID SlingWebConsoleSecurityProvider as defaults no longer reasonably set in AEMaaCS. Disable action buttons depending on permissions. Clean up HistoryUtils to leverage JcrUtils This closes #781
No longer leverage PID SlingWebConsoleSecurityProvider as defaults no longer reasonably set in AEMaaCS. Disable action buttons depending on permissions. Clean up HistoryUtils to leverage JcrUtils This closes #781
|
Hello @kwin,
Are you sure that the project you checked it on doesn't have configuration overridden? AEM Release
|
|
I checked directly with the developer console on Cloud instances. @mkaczorowski: How did you check? Could also be thaz the environment variable |
|
I checked exactly like you did (developer console on the author cloud environment with version I mentioned above).
That’s my assumption as well, though I haven’t been able to confirm it yet. |
|
@mkaczorowski You are right, I just confirmed on a plain AEMaaCS cloud author instance, and indeed there the config is |
|
@GianSerr Please check the OSGi config for PID org.apache.sling.extensions.webconsolesecurityprovider.internal.SlingWebConsoleSecurityProvider and the group memberships of the affected user. |
No longer leverage PID SlingWebConsoleSecurityProvider as defaults no longer reasonably set in AEMaaCS. Disable action buttons depending on permissions. Clean up HistoryUtils to leverage JcrUtils This closes #781
|
Hi @kwin @mkaczorowski , I have administrative rights through adminconsole and facing the issue. From your last comment to check the config for PID, I see below config for
I couldn't catch much of the conversation on what could be the reason for the permission denied. Could you care to elaborate and provide next steps on what needs to be done to get it resolved ? Is it something that requires fix in tool ? |
|
@RichuKakkar1 Please check and share the group memberships of your user inside AEM! The reason for this behavior is not clear yet. |
|
pls ignore the custom groups, I have admin rights for the particular env- [cbdt_mod_my_rdo_editor, cbdt_mod_my_rdo_approver, cbdt_lub_hk_id_admin, cbdt_mod_tr_rdo_approver, cbdt_lub_ae_dir_approver, cbdt_mod_my_rdo_admin, cbdt_mob_global_lim_approver, Adobe_Other Experience Cloud products, cbdt_lub_be_id_editor, cbdt_avi_dir_fue_approver, cbdt_avi_global_lub_approver, cbdt_cof_hk_dir_approver, cbdt_mod_tr_rdo_editor, cbdt_mod_hk_rba_editor, cbdt_lub_us_id_approver, cbdt_lub_hk_dir_approver, cbdt_lub_th_dir_editor, cbdt_avi_jv_fue_approver, cbdt_lub_jp_dir_approver, cbdt_lub_gb_dir_editor, AEM Administrators - author - Program 101803 - Environment 960714, cbdt_lub_gb_dir_admin, cbdt_cof_th_id_approver, cbdt_lub_gb_id_editor, cbdt_lub_at_dir_editor, cbdt_mod_hk_rba_admin, sch_superuser, cbdt_lub_hk_id_approver, cbdt_mod_de_mfa_editor, cbdt_lub_mo_id_approver, cbdt_cof_th_dir_approver, AEM Users-8e47719835873ea89eb33ae6ca20d943, cbdt_mod_ca_editor, cbdt_mod_tr_rdo_admin, cbdt_mod_hk_rba_approver, AEM Administrators - Service, AEM Users - Service, cbdt_lub_kg_md_editor, cbdt_lub_at_dir_approver, cbdt_cof_ae_id_approver, cbdt_lub_ua_md_approver, cbdt_lub_th_id_approver, cbdt_lub_jp_id_approver, cbdt_lub_in_id_approver, cbdt_avi_global_fue_approver] |
|
I could reproduce now with a default OSGi configuration for |
|
Hi @kwin , I checked my OSGi config org.apache.sling.extensions.webconsolesecurityprovider.internal.SlingWebConsoleSecurityProvider
I added on my user Administrators group and seems I'm able to invoke the service |
we are using netcentric yaml scripts to apply permssions in AEMaacs. Everything was working fine few weeks back when we ran last updated scripts in AEM cloud - QA . Now when we tried running the same scripts for QA and UAT again, it says permission denied error. There has been no change in the scripts and we can't see anything in error logs. Although there have been AEM updates in cloud with 2025.1.19149.20250116T154450Z.
Upon checking request and aem request logs-
https://author-p101803-e981799.adobeaemcloud.com/mnt/overlay/netcentric/actool/content/overview/content/items/actoolpanel
Request Method:
POST
Status Code:
403 Forbidden
Could anyone help on what could be the issue ?
The text was updated successfully, but these errors were encountered: