AEM Author private collections creation issue

[ajay_bollam]

I am trying to create a collection using admin account, but it works fine for public collection where as it is failing to create private collection. Getting below error.

*ERROR* POST /content/dam/collections.collection.html] com.day.cq.dam.core.impl.team.TeamManagerImpl Error while creating team group.

javax.jcr.security.AccessControlException: No such privilege

.....

*ERROR* POST /content/dam/collections.collection.html] com.day.cq.dam.core.impl.collection.DamCollectionManager unable to create the team

javax.jcr.security.AccessControlException: No such privilege

[Nitin_laad]

@ajay_bollam I am successfully able to create smart collection (private/public), in AEMaaCS  and in AEM 6.5.4 environment. 

Were you able to create collection using add to collection feature?

Can you share AEM version details. 

Additionally just revalidate admin user whether it is assigned to dam-users group and dam-users group having read permission at home/users path. 

[ajay_bollam]

@Nitin_laad Thanks for prompt response. We are on AEM 6.5.9 version. Admin account is not a member of dam-users group but it is having ream permissions at /home/users path and also having all permissions enabled. Same thing works fine in staging but not in prod. Wondering if any specific parameter is missed.

1. When we create a collection in prod, it prompts the message "Failed to create collection" but creating public collection

2. When we create a public collection, it's not giving any error message. Creating public collection successfully

[Nitin_laad]

@ajay_bollam Are you able to reproduce the same issue in your local env?

Can you share me steps I need to follow in my local env to reproduce the issue?

Will it be possible for you to share debug level logs and exception/error stack trace to further investigate the issue?

[ajay_bollam]

@Nitin_laad - I am unable to reproduce the issue in dev environment. Tried replicating privileges back from Prod to dev but no luck. I have no option to share logs outside. What we have noticed is, whenever we create a collection, there are groups getting created automatically as mac-default-<collectionname> in dev env for Private collection and is assigned to the user who is creating the collection. However group creation is failing in Prod. Validated and Sync'ed privileges of /libs, /home/groups, /home and few other folders from Prod to dev but still the group creation works fine in dev but failing in Prod. Any clue to succeed in creating a group please?

[Nitin_laad]

At high level I could say issue is relevant to permissions, may be you can clone the AEM production setup in local and try to reproduce the issue, will get some clue in the logs about the issue. 

@Jörg_Hoh any clue?

[Jörg_Hoh]

Can you please share the complete stacktrace? Because just from this message it's not possible to say where what privilege is missing.

[Rakshi19]

If you are not able to create a private collections, give full access to all the folders to that user/group under /content/dam/colletions. It should work