OakAccess0000: Access denied

-

ERROR :-   OakAccess0000: Access denied

We often observe while doing the AEM development or in live running environment we get the error code  OakAccess0000 , while running a workflow or any asset upload. 

This impact the business as content author are unable to upload any content. 





Error stack trace :-

Javax.jcr.AccessDeniedException: OakAccess0000: Access denied

 at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:232) [org.apache.jackrabbit.oak-api:1.10.6]

 at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:213) [org.apache.jackrabbit.oak-api:1.10.6]

 at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.newRepositoryException(SessionDelegate.java:669) [org.apache.jackrabbit.oak-jcr:1.10.6]

 at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:495) [org.apache.jackrabbit.oak-jcr:1.10.6]

 at org.apache.jackrabbit.oak.jcr.session.SessionImpl$8.performVoid(SessionImpl.java:424) [org.apache.jackrabbit.oak-jcr:1.10.6]

 at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.performVoid(SessionDelegate.java:273) [org.apache.jackrabbit.oak-jcr:1.10.6]

 at org.apache.jackrabbit.oak.jcr.session.SessionImpl.save(SessionImpl.java:421) [org.apache.jackrabbit.oak-jcr:1.10.6]

 at com.adobe.granite.repository.impl.CRX3SessionImpl.save(CRX3SessionImpl.java:208) [com.adobe.granite.repository:1.6.28]

 --

 --

 --

 Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakAccess0000: Access denied

 at org.apache.jackrabbit.oak.security.authorization.permission.PermissionValidator.checkPermissions(PermissionValidator.java:239) [org.apache.jackrabbit.oak-core:1.10.6]

 at org.apache.jackrabbit.oak.security.authorization.permission.PermissionValidator.propertyAdded(PermissionValidator.java:108) [org.apache.jackrabbit.oak-core:1.10.6]


Solution :- 

This error is due to workflow service user which AEM uses to run the workflows. To get the issue resolved you need to take the following action - 

1. Search for the workflow-service user  form user  admin. 

2. Assign the admin privileges to workflow-service user. /etc, /content..etc

3. Upload the images and observe the log files. Your issue will be resolved. 

Comments

Post a Comment

Popular Posts

curl command AEM package filter addition creation

-
Image
How to create AEM package via CURL  Most of our dev ops and AEM developers face issue while automating the AEM package creation via Curl.  I will explain the command and process for it.  in AEM package creation is a 3 steps process.  1- AEM package creation  2 - Filter addition  3- Package build Let's see all these 3 steps in detail -  AEM package creation  it is simple step -  curl -u admin:admin -X POST http://localhost:4502/crx/packmgr/service/.json/etc/packages/my_packages/testpackage?cmd=create \ -d packageName=testpackage \ -d groupName=my_packages Filter Addition  This is a complex step where you need to be careful while adding the parameters.  General command , in this " /content/my-site" is my package filter. You can also define the rule like exclude in exclude section.  curl -u admin:admin -X POST http://localhost:4502/crx/packmgr/update.jsp \ -F path=/etc/packages/my_packages/testpackage.zip -F packageName=testpack...
Read more

How to configure s3 in AEM ?

-
Image
How to Configure S3 in AEM  Configuring s3 data stores in AEM 6 In Adobe Experience Manager (AEM), binary data can be stored independently from the content nodes. The binary data is stored in a data store, whereas content nodes are stored in a node store. Both data stores and node stores can be configured using OSGi configuration. Each OSGi configuration is referenced using a persistent identifier (PID). In this article we learn the detailed steps for configuration S3 data store in AEM.  You can get the architectural level understand of S3 with AEM from article -  https://www.aemrules.com/2021/06/how-does-s3-works-with-aem.html   Amazon S3 Data Store AEM can be configured to store data in Amazon’s Simple Storage Service (S3). It uses the org.apache.jackrabbit.oak.plugins.blob.datastore.S3DataStore.config PID for configuration.   In order to enable the S3 data store functionality, a feature pack containing the S3 Datastore Connector needs to be downloaded and in...
Read more

How Encrypt-Decrypt Data in AEM , Crypto Support ?

-
Image
How to Use Crypto Support in AEM to Encrypt/Decrypt Data? While working with AEM, The AEM dev-ops / developer team sometimes have a requirements to call third-party APIs/Services. Configurations related to these APIs/Services like username, passwords, client id/secrets, API keys are usually stored in a code repository in the form of OSGi configuration. This sensitive information should be stored encrypted rather than plain-text format. This is possible through the OOTB AEM Crypto Support bundle. This bundle provides services for encrypting and decrypting the confidential/secured data through system-wide keys (hmac and master files).   What are the Features of Crypto Support? Decryption happens at runtime. No one can decrypt the data through the UI. There’s no UI to decrypt the encrypted data. So, the information remains secure. What are hmac/master keys? Encryption/decryption happens through keys (hmac and master files). These keys get generated during the first startup of AEM inst...
Read more

Upgrading the AEM dispatcher module

-
Image
Upgrading the dispatcher module in AEM Often the AEM dev-ops team faces the challenge on Dispatcher upgradation. It is not clear anywhere how to do it and what precautions one should take while doing the same.  In this article we will cover these steps,  Upgrading the Dispatcher Module : Step 1 -  Download the required dispatcher module version from the  Adobe dispatcher download page  ,  Make sure you download the dispatcher version module as per the OS. https://experienceleague.adobe.com/docs/experience-manager-dispatcher/using/getting-started/release-notes.html?lang=en Step 2 -  Extract the dispatcher module at some location on server or local machine.                      tar -xvzf <dispatcher-xxxxxxxx.tar.gz> (linux)  Step 3 -  Copy the extracted dispatcher-xxxxxxxxxx.so file to the module folder of the server.       ...
Read more

How to prevent DOS attacks in AEM ?

-
Image
Prevent Denial of Service (DoS) Attacks : AEM  A denial of service (DoS) attack is an attempt to make a computer resource unavailable to its intended users. At the dispatcher level, there are two methods of configuring to prevent DoS attacks: Use the mod_rewrite module (for example,  Apache 2.4 ) to perform URL validations (if the URL pattern rules are not too complex). Prevent the dispatcher from caching URLs with spurious extensions by using  filters .  For example, change the caching rules to limit caching to the expected mime types, such as .html .jpeg .gif .swf .js .doc .pdf .ppt .... as per your project requirement. An example configuration file is given below,  for  this includes restrictions for mime types.      When configuring Dispatcher you should restrict external access as much as possible. The      following example provides example for the minimal access for external visitors, you can refer the default file....
Read more

Dispatcher flush from AEM UI

-
Image
How to Delete Dispatcher cache without logging into the Dispatcher servers? Our Authoring team faces day to day challenges while deleting/flush the dispatcher cache. when the changes are not visible on server. They have to be depended on the IT operations/Dev ops teams to do the same. Which some time get very much time consuming for a small work.  In this article we will see it can be configure and used by Author UI itself.  This will allow  AEM authors (or “super authors”) to flush parts of the dispatcher cache manually without the involvement of IT Operations. How to Use 1. Log in to AEM Author 2. Download the ACS commons tool from  ACS Commons Official page 3. Install the downloaded package via aem package manager.   4. Make sure you create the dispatcher flush agents on Author for all Dispatchers. from http://<<host:port>>/miscadmin#/etc/replication/agents.author, check the NOTE's part at the end of page. 5. Navigate to Tools 6. Under the ac...
Read more

How to Increase Apache Request Per Second ?

-
Image
How to Increase Apache Request Per Second ? By default, Apache web server is configured to support 160 requests per second. As your website traffic increases, Apache will start dropping additional requests and this will spoil customer experience.  Here’s how to increase Apache requests per second. 1. Install MPM module We need to install MPM Apache module to be able to increase Apache requests per second. You can use mpm_worker or mpm_event module for this, instead of mpm_prefork module which consumes a lot of memory. You can easily install MPM module in Apache with following command For CentOS7/RHEL7 : Adjust /etc/httpd/conf.modules.d/00-mpm.conf Comment the line LoadModule mpm_prefork_module modules/mod_mpm_prefork.so by adding # in front of it. Uncomment the line LoadModule mpm_worker_module modules/mod_mpm_worker.so by removing # in front of it. For Ubuntu/Debian :  Use a2dismod / a2enmod to disable mpm_prefork and enable mpm_worker 2. Increase Max Connections in Apach...
Read more

Pre warming AWS Load balancer

-
Image
AWS: Pre-Warming the Load Balancer How to Resolve Load balancer request over flow for a sudden traffic spike ?  Load balancer is giving 504 error ? Load balancer is giving target connection  error ? If you are facing such issues ,  please read this article to get the solution.  Do you expect a spike in traffic? Let’s say your stakeholders expect a ramp of 20000 users in the first minutes of your website. How do you handle a scenario where you expect tens of thousands of users in the first minutes since the launch of your website? This is a great example of handling fault tolerance in AWS. If one wants to achieve fault tolerance in AWS, there a few options to do that: Use a Load Balancer – no matter how much the traffic increases, if you place your instances behind a Load Balancer it is always a great idea because the traffic is balanced across all the healthy instances. Use an Auto Scaling Group – Load balancer can scale up/down with as many instances as you want, ...
Read more

Managing AEM Repository Size Growth ?

-
Image
 Managing AEM Repository Size Growth Managing your AEM repository size growth can be challenging for numerous reasons. What’s more, it may suddenly start to grow unexpectedly and fill up space in the assigned drive of your AEM application. In this post, I want to share a few AEM utilities & methods which can help you to not only manage the AEM repository size but also help to improve the AEM application performance. 1: Tar Compaction (also known as Revision Cleanup) By running the regular tar compaction, you can not only control the AEM repository size growth, but it will also help improve the AEM application performance. Tar compaction reclaims the disk space by removing the obsolete/redundant data from your AEM application. You can use both online and offline compaction. You can schedule online Tar compaction during weekdays after business hours & offline compaction on weekends (Non-business hours or during your designated Maintenance Window). 2: Garbage Collection By run...
Read more

How to Integrate LDAP with AEM ?

-
Image
  AEM - LDAP Integration LDAP (the   L ightweight   D irectory   A ccess   P rotocol) is used for accessing centralised directory services.  You can achieve below vital things with LDAP integration The User accounts can be synchronised between LDAP server and the AEM repository.  The AEM uses LDAP authentication  to authenticate users, with credentials being passed to the LDAP server for validation.  To improve performance, successfully validated credentials can be cached by repository, with an expire timeout. This helps reduce the effort required to manage user accounts as they can be accessed by the multiple applications.  When a user/account is removed from LDAP server validation is no longer granted & access to the AEM is denied.  The following are the AEM steps for integrating the LDAP and using it as your Single Sign On (SSO) source of truth for authenticating AEM Users. In order to have LDAP working with AEM, you need to ...
Read more