IV32949: ACCESS DENIED ERROR WHEN TRYING TO ACCESS IMS CONFIG TOOL

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as documentation error.

Error description

  • Problem(Abstract)Accessing the IMS Configuration Utility tool
    with a websphere administrator , a message about access denied
    is shown though this is the administrator used to installed the
    application with.
    
    SymptomA message about access denied in shown in the web browser
    and the systemout.log shows an error like the following:
    
    [30/10/12 21:46:39:452 GMT] 00000031 WebCollaborat A SECJ0129E:
    Authorization failed for user wasadmin:defaultWIMFileBasedRealm
    while invoking GET on admin_host:webconf/faces/app/main.xhtml,
    Authorization failed, Not granted any of the required roles: Web
    Configurator Admin
    [30/10/12 21:46:39:452 GMT] 00000031 FfdcProvider W
    com.ibm.ws.ffdc.impl.FfdcProvider logIncident FFDC1003I: FFDC
    Incident emitted on
    C:\IBM\WebSphere\AppServer\profiles\Dmgr01\logs\ffdc\dmgr_31c631
    c6_12.10.30_21.46.39.452427718121467630381.txt
    com.ibm.ws.security.web.WebCollaborator.authorize 1288
    
    CauseThis can be due to the following:
    
    
    - The 'WebConfAdmins' group does not exists. It controls access
    to the IMS Configuration Utility when application security is
    enabled. This can happened during installation, when deploying
    the ISAM ESSO IMS Ears manually. Though the install guide has a
    step about switching on application security in the manual
    deployment section, it does not mention any steps about adding
    this group or adding the WebSphere administrator to this group
    for the IMS Config utility.
    
    - The WAS Administrator you are using is not a member of the
    'WebConfAdmins' group.
    
    
    EnvironmentISAM ESSO IMS 8.2
    
    
    Resolving the problemThe security of the IMS Configuration
    Utility is controlled by this role 'Web Configurator Admin'.
    Which is linked to the group 'WebConfAdmins'.
    
    This role is mentioned in the ISAM ESSO 8.2 Deployment Guide
    under the 'Application server security' -> 'Enable application
    security'
    
    
    Check whether the 'WebConfAdmins' group exists:
    
    1. Log on to the IBM Integrated Solutions Console.
    2. On the Integrated Solutions Console navigation pane, select
    Users and Groups > Manage Groups.
    3. Click on ' Search' to show all the groups.
    4. Navigate to the last page to check if the ' WebConfAdmins'
    group is present.
    Create the Group if it does not exist. 1. Click on the
    'Create..' button
    2. Enter WebConfAdmins as the group name.
    Add your WAS user to the group. 1. Click on the ' Members' tab,
    then the ' Add Users...' button.
    2. Click on ' Search' button to list your WAS users
    3. Select the user who should be able to use the IMS
    Configuration Utility.
    4. Click the ' Add' button.
    5. Click the ' Close' button.
    6. Click the ' General' button and the ' OK' button to save the
    new group.
    Stand Alone Installation: 1. Restart the Application Server
    Cluster Installation:
    1. Log on to the IBM Integrated Solutions Console.
    2. On the Integrated Solutions Console navigation pane, select
    System
    administration > Nodes.
    3. Select the check box for the node where the IMS Server is
    installed.
    4. Click Full Resynchronize.
    5. Stop all the nodes n the Cluster.
    6. Stop and restart the Deployment Manager.
    7. Restart the nodes in the Cluster.
    

Local fix

  • N/A
    

Problem summary

  • Technote has been published
    

Problem conclusion

  • This will be included in all future documentation
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV32949

  • Reported component name

    TAM ESSO IM SVR

  • Reported component ID

    5724V6700

  • Reported release

    810

  • Status

    CLOSED DOC

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2012-12-04

  • Closed date

    2012-12-04

  • Last modified date

    2012-12-04

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels



Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

IBM Security Access Manager for Enterprise Single Sign-On
Base

Software version:

810

Reference #:

IV32949

Modified date:

2012-12-04

Translate my page

Machine Translation

Content navigation