javax.jcr.AccessDeniedException: Access denied. (500)

Avatar

Avatar

nickt39971962

Avatar

nickt39971962

nickt39971962

22-08-2019

All of our deploys have started failing with the following error. Even trying to deploy packages that have previously been installed results in the same error. Could anyone tell me how I can start investigating a problem like this? I don't see anything useful in the logs.

This problem is happening on our stage publishers and all of our production instances but our stage author is working fine. I know that is a clue but I'm not sure where to look.

[ERROR] Request failed: javax.jcr.AccessDeniedException: Access denied. (500)

[INFO] Looks like the package was not installed, checking the list...

[INFO] package not installed, re-uploading it...

[ERROR] Request failed: javax.jcr.AccessDeniedException: Access denied. (500)

Accepted Solutions (1)

Accepted Solutions (1)

Avatar

Avatar

Vish_dhaliwal

Employee

Avatar

Vish_dhaliwal

Employee

Vish_dhaliwal
Employee

22-08-2019

Hello,

What is the procedure of the package deployment? Since there is an Access Denied Exception, check if it works with admin user.

Check if the same user can install packages through the package manager.

Regards,

Vishu

Answers (10)

Answers (10)

Avatar

Avatar

Gaurav-Behl

MVP

Avatar

Gaurav-Behl

MVP

Gaurav-Behl
MVP

23-08-2019

Couple of questions:

1) Does the issue happens with  '-Pauto-install-bundle' or '-Pauto-install-package' or both profiles? -- based on your statement 'We are deploying use maven content plugin with bundle auto install.'?

2) If the issue happens with 'auto-install-bundle'  - can you verify that the '/apps/.../install' folders (http://localhost:4502/apps/mycompany/parent/install​) exists when you use that profile? Assuming there are no permission issues on /apps/.../install since you use admin credentials.

Adding Filter tag to content-package-maven-plugin fails probably because it expects either <includes> or <embeddeds>

check Managing Packages Using Maven

On a side note, <usePut>true</usePut> is deprecated

 

Avatar

Avatar

Jörg_Hoh

Employee

Total Posts

3.0K

Likes

957

Correct Reply

1.0K

Avatar

Jörg_Hoh

Employee

Total Posts

3.0K

Likes

957

Correct Reply

1.0K
Jörg_Hoh
Employee

23-08-2019

Can you build a minimal content-package which shows this behavior, and then share it? And btw an internal server error can be thrown if your content package is malformed in a way, that the XML import fails. Can you try to install the content-package manually via /crx/packmgr/index.jsp? It's definitely more verbose than maven.

Jörg

Avatar

Avatar

nickt39971962

Avatar

nickt39971962

nickt39971962

23-08-2019

Apologies: Can't seem to edit posts on here, the actions drop down just spins around indefinitely.

We actually see the problem even just adding the filters element at all. Here's our full parent pom which is shared by 3 content packages

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <!-- ====================================================================== -->

    <!-- P R O J E C T   D E S C R I P T I O N -->

    <!-- ====================================================================== -->

    <groupId>mycompany</groupId>

    <artifactId>parent-pom</artifactId>

    <version>1.5.1</version>

    <packaging>pom</packaging>

    <name>mycompany AEM Parent</name>

    <!-- ====================================================================== -->

    <!-- P R O P E R T I E S -->

    <!-- ====================================================================== -->

    <properties>

        <customer.name>mycompany</customer.name>

        <cq.project.name>parent</cq.project.name>

        <cq.url>http://localhost:4502</cq.url>

        <app.folder>/${cq.project.name}</app.folder>

        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

        <bundle.install.directory>/apps/${customer.name}${app.folder}/install</bundle.install.directory>

        <cq.user>admin</cq.user>

        <cq.password>admin</cq.password>

        <cxf.version>3.0.4</cxf.version>

    </properties>

    <!-- ====================================================================== -->

    <!-- P R O F I L E S -->

    <!-- ====================================================================== -->

    <profiles>

        <profile>

            <id>auto-install-bundle</id>

            <build>

                <plugins>

                    <plugin>

                        <groupId>org.apache.sling</groupId>

                        <artifactId>maven-sling-plugin</artifactId>

                        <version>2.1.0</version>

                        <executions>

                            <execution>

                                <id>install-bundle</id>

                                <goals>

                                    <goal>install</goal>

                                </goals>

                            </execution>

                        </executions>

                        <configuration>

                            <slingUrl>${cq.url}${bundle.install.directory}</slingUrl>

                            <usePut>true</usePut>

                        </configuration>

                    </plugin>

                </plugins>

            </build>

        </profile>

        <profile>

            <id>auto-install-package</id>

            <build>

                <pluginManagement>

                    <plugins>

                        <plugin>

                            <groupId>com.day.jcr.vault</groupId>

                            <artifactId>content-package-maven-plugin</artifactId>

                            <executions>

                                <execution>

                                    <id>install-package</id>

                                    <goals>

                                        <goal>install</goal>

                                    </goals>

                                    <configuration>

                                        <groupId>${project.groupId}</groupId>

                                        <artifactId>${project.artifactId}</artifactId>

                                        <targetURL>${cq.url}/crx/packmgr/service.jsp</targetURL>

                                        <userId>${cq.user}</userId>

                                        <password>${cq.password}</password>

                                    </configuration>

                                </execution>

                            </executions>

                        </plugin>

                    </plugins>

                </pluginManagement>

            </build>

        </profile>

        <!-- <profile>

            <id>analysis</id>

            <properties>

                <sonar.jdbc.url>jdbc:mysql://xxx.net/sonar?useUnicode=true&amp;characterEncoding=utf8</sonar.jdbc.url>

                <sonar.jdbc.username>sonar</sonar.jdbc.username>

                <sonar.jdbc.password>sonar</sonar.jdbc.password>

                <sonar.host.url>http://xxx.net/sonar/</sonar.host.url>

                <sonar.analysis.mode>preview</sonar.analysis.mode>

                <sonar.issuesReport.html.enable>true</sonar.issuesReport.html.enable>

            </properties>

        </profile>

        <profile>

            <id>analysis-full</id>

            <properties>

                <sonar.analysis.mode>analysis</sonar.analysis.mode>

                <sonar.issuesReport.html.enable>false</sonar.issuesReport.html.enable>

            </properties>

        </profile> -->

        <profile>

            <id>local-publish</id>

            <properties>

                <cq.url>http://localhost:4503</cq.url>

            </properties>

        </profile>

    </profiles>

    <!-- ====================================================================== -->

    <!-- B U I L D -->

    <!-- ====================================================================== -->

    <build>

        <pluginManagement>

            <plugins>

                <plugin>

                    <groupId>org.apache.maven.plugins</groupId>

                    <artifactId>maven-compiler-plugin</artifactId>

                    <version>3.2</version>

                    <configuration>

                        <encoding>UTF-8</encoding>

                        <source>1.8</source>

                        <target>1.8</target>

                    </configuration>

                </plugin>

                <plugin>

                    <groupId>org.apache.felix</groupId>

                    <artifactId>maven-scr-plugin</artifactId>

                    <version>1.20.0</version>

                    <executions>

                        <execution>

                            <id>generate-scr-descriptor</id>

                            <goals>

                                <goal>scr</goal>

                            </goals>

                        </execution>

                    </executions>

                </plugin>

                <plugin>

                    <groupId>org.apache.felix</groupId>

                    <artifactId>maven-bundle-plugin</artifactId>

                    <version>3.3.0</version>

                    <extensions>true</extensions>

                    <configuration>

                        <instructions>

                            <Bundle-Category>${customer.name}</Bundle-Category>

                            <Include-Resource>{maven-resources}</Include-Resource>

                        </instructions>

                    </configuration>

                </plugin>

                <plugin>

                    <groupId>com.day.jcr.vault</groupId>

                    <artifactId>content-package-maven-plugin</artifactId>

                    <version>0.5.24</version>

                    <extensions>true</extensions>

                    <configuration>

                        <packaging>zip</packaging>

                        <packageType>mixed</packageType>

                        <properties>

                            <acHandling>overwrite</acHandling>

                            <granite.suppressSnapshots>true</granite.suppressSnapshots>

                        </properties>

                        <failOnError>true</failOnError>

                        <install>true</install>

                        <verbose>true</verbose>

                        <useProxy>false</useProxy>

                        <filters>

                            <filter>

                                <root>/apps</root>

                                <mode>merge</mode>

                            </filter>

                        </filters>

                    </configuration>

                </plugin>

                <plugin>

                    <groupId>org.apache.sling</groupId>

                    <artifactId>maven-sling-plugin</artifactId>

                    <version>2.1.0</version>

                </plugin>

                <plugin>

                    <artifactId>maven-resources-plugin</artifactId>

                    <version>2.7</version>

                    <executions>

                        <execution>

                            <id>copy-resources</id>

                            <phase>generate-sources</phase>

                            <goals>

                                <goal>copy-resources</goal>

                            </goals>

                            <configuration>

                                <outputDirectory>${project.build.directory}/jsps-to-compile</outputDirectory>

                                <resources>

                                    <resource>

                                        <directory>${basedir}/jcr_root</directory>

                                    </resource>

                                    <resource>

                                        <directory>${basedir}/apps</directory>

                                    </resource>

                                </resources>

                            </configuration>

                        </execution>

                    </executions>

                </plugin>

                <plugin>

                    <artifactId>maven-clean-plugin</artifactId>

                    <version>2.5</version>

                    <executions>

                        <execution>

                            <id>remove-compiled-jsps</id>

                            <goals>

                                <goal>clean</goal>

                            </goals>

                            <phase>process-classes</phase>

                            <configuration>

                                <excludeDefaultDirectories>true</excludeDefaultDirectories>

                                <filesets>

                                    <fileset>

                                        <directory>${project.build.directory}/jsps-to-compile</directory>

                                        <directory>${project.build.directory}/ignoredjspc</directory>

                                    </fileset>

                                </filesets>

                            </configuration>

                        </execution>

                    </executions>

                </plugin>

                <plugin>

                    <groupId>org.apache.maven.plugins</groupId>

                    <artifactId>maven-surefire-plugin</artifactId>

                    <version>2.18.1</version>

                </plugin>

                <!--This plugin's configuration is used to store Eclipse m2e settings

                    only. It has no influence on the Maven build itself. -->

                <plugin>

                    <groupId>org.eclipse.m2e</groupId>

                    <artifactId>lifecycle-mapping</artifactId>

                    <version>1.0.0</version>

                    <configuration>

                        <lifecycleMappingMetadata>

                            <pluginExecutions>

                                <pluginExecution>

                                    <pluginExecutionFilter>

                                        <groupId>org.apache.sling</groupId>

                                        <artifactId>maven-jspc-plugin</artifactId>

                                        <versionRange>[2.0.6,)</versionRange>

                                        <goals>

                                            <goal>jspc</goal>

                                        </goals>

                                    </pluginExecutionFilter>

                                    <action>

                                        <ignore />

                                    </action>

                                </pluginExecution>

                                <pluginExecution>

                                    <pluginExecutionFilter>

                                        <groupId>org.apache.maven.plugins</groupId>

                                        <artifactId>maven-clean-plugin</artifactId>

                                        <versionRange>[2.6.1,)</versionRange>

                                        <goals>

                                            <goal>clean</goal>

                                            <goal>test-compile</goal>

                                            <goal>compile</goal>

                                        </goals>

                                    </pluginExecutionFilter>

                                    <action>

                                        <ignore />

                                    </action>

                                </pluginExecution>

                            </pluginExecutions>

                        </lifecycleMappingMetadata>

                    </configuration>

                </plugin>

                <plugin>

                    <groupId>org.apache.sling</groupId>

                    <artifactId>htl-maven-plugin</artifactId>

                    <version>1.0.8</version>

                    <configuration>

                        <!-- put your configurations here -->

                    </configuration>

                    <executions>

                        <execution>

                            <goals>

                                <goal>validate</goal>

                            </goals>

                        </execution>

                    </executions>

                </plugin>

            </plugins>

        </pluginManagement>

        <resources>

            <resource>

                <directory>${basedir}/META-INF</directory>

                <targetPath>../vault-work/META-INF</targetPath>

            </resource>

            <resource>

                <directory>${basedir}/jcr_root</directory>

                <filtering>false</filtering>

                <excludes>

                    <exclude>**/.vlt</exclude>

                    <exclude>**/.vltignore</exclude>

                    <exclude>**/*.iml</exclude>

                    <exclude>**/.classpath</exclude>

                    <exclude>**/.project</exclude>

                    <exclude>**/.DS_Store</exclude>

                    <exclude>**/target/**</exclude>

                    <exclude>libs/**</exclude>

                </excludes>

            </resource>

        </resources>

        <plugins>

            <plugin>

                <groupId>external.atlassian.jgitflow</groupId>

                <artifactId>jgitflow-maven-plugin</artifactId>

                <version>1.0-m5.1</version>

                <configuration>

                    <flowInitContext>

                        <masterBranchName>master</masterBranchName>

                        <developBranchName>develop</developBranchName>

                        <featureBranchPrefix>feature-</featureBranchPrefix>

                        <releaseBranchPrefix>release-</releaseBranchPrefix>

                        <hotfixBranchPrefix>hotfix-</hotfixBranchPrefix>

                        <versionTagPrefix />

                    </flowInitContext>

                    <autoVersionSubmodules>true</autoVersionSubmodules>

                    <pushFeatures>true</pushFeatures>

                    <pushReleases>true</pushReleases>

                    <pushHotfixes>true</pushHotfixes>

                    <noDeploy>true</noDeploy>

                    <allowSnapshots>true</allowSnapshots>

                </configuration>

            </plugin>

        </plugins>

    </build>

    <!-- ====================================================================== -->

    <!-- D E P E N D E N C I E S   M A N A G E M E N T -->

    <!-- ====================================================================== -->

    <dependencyManagement>

        <dependencies>

            <dependency>

                <groupId>org.apache.felix</groupId>

                <artifactId>org.apache.felix.scr</artifactId>

                <version>1.6.0</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.felix</groupId>

                <artifactId>org.apache.felix.scr.annotations</artifactId>

                <version>1.9.6</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <artifactId>oak-commons</artifactId>

                <version>1.8.2</version>

                <groupId>org.apache.jackrabbit</groupId>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.osgi</groupId>

                <artifactId>org.osgi.core</artifactId>

                <version>4.2.0</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.osgi</groupId>

                <artifactId>org.osgi.compendium</artifactId>

                <version>4.2.0</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.slf4j</groupId>

                <artifactId>slf4j-api</artifactId>

                <version>1.7.6</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>javax.servlet</groupId>

                <artifactId>servlet-api</artifactId>

                <version>2.5</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>javax.jcr</groupId>

                <artifactId>jcr</artifactId>

                <version>2.0</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>javax.inject</groupId>

                <artifactId>javax.inject</artifactId>

                <version>1</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.commons</groupId>

                <artifactId>commons-lang3</artifactId>

                <version>3.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.httpcomponents</groupId>

                <artifactId>httpclient-osgi</artifactId>

                <version>4.3.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>commons-io</groupId>

                <artifactId>commons-io</artifactId>

                <version>2.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>commons-codec</groupId>

                <artifactId>commons-codec</artifactId>

                <version>1.10</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>com.google.code.gson</groupId>

                <artifactId>gson</artifactId>

                <version>2.3</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.sling</groupId>

                <artifactId>org.apache.sling.models.api</artifactId>

                <version>1.2.2</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.sling</groupId>

                <artifactId>org.apache.sling.scripting.jsp.taglib</artifactId>

                <version>2.2.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>com.day.commons.osgi.wrapper</groupId>

                <artifactId>com.day.commons.osgi.wrapper.commons-httpclient</artifactId>

                <version>3.1.0.018</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>com.day.commons.osgi.wrapper</groupId>

                <artifactId>com.day.commons.osgi.wrapper.commons-lang2</artifactId>

                <version>2.5-0001</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>com.day.cq.wcm</groupId>

                <artifactId>cq-wcm-taglib</artifactId>

                <version>5.7.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>biz.aQute</groupId>

                <artifactId>bndlib</artifactId>

                <version>1.50.0</version>

                <scope>provided</scope>

            </dependency>

            <!-- jackson -->

            <dependency>

                <groupId>com.fasterxml.jackson.core</groupId>

                <artifactId>jackson-databind</artifactId>

                <version>2.5.3</version>

            </dependency>

            <dependency>

                <groupId>com.fasterxml.jackson.core</groupId>

                <artifactId>jackson-annotations</artifactId>

                <version>2.5.0</version>

            </dependency>

            <dependency>

                <groupId>com.fasterxml.jackson.core</groupId>

                <artifactId>jackson-core</artifactId>

                <version>2.5.3</version>

            </dependency>

            <!-- Apache CXF Dependencies -->

            <dependency>

                <groupId>org.apache.cxf</groupId>

                <artifactId>cxf-rt-frontend-jaxws</artifactId>

                <version>${cxf.version}</version>

                <scope>compile</scope>

                <exclusions>

                    <exclusion>

                        <groupId>commons-logging</groupId>

                        <artifactId>commons-logging</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>commons-lang</groupId>

                        <artifactId>commons-lang</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.apache.geronimo.specs</groupId>

                        <artifactId>geronimo-javamail_1.4_spec</artifactId>

                    </exclusion>

                    <!-- exclude spring dependencies -->

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-aop</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-asm</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-beans</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-context</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-core</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-expression</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-web</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>com.sun.xml.bind</groupId>

                        <artifactId>jaxb-impl</artifactId>

                    </exclusion>

                </exclusions>

            </dependency>

            <dependency>

                <groupId>org.apache.cxf</groupId>

                <artifactId>cxf-rt-transports-http</artifactId>

                <version>${cxf.version}</version>

                <scope>compile</scope>

                <exclusions>

                    <exclusion>

                        <groupId>commons-logging</groupId>

                        <artifactId>commons-logging</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>commons-lang</groupId>

                        <artifactId>commons-lang</artifactId>

                    </exclusion>

                    <!-- exclude spring dependencies -->

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-aop</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-asm</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-beans</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-context</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-core</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-expression</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-web</artifactId>

                    </exclusion>

                </exclusions>

            </dependency>

            <!-- AEM APIs JAR -->

            <dependency>

                <groupId>com.adobe.aem</groupId>

                <artifactId>uber-jar</artifactId>

                <classifier>apis</classifier>

                <version>6.4.1</version>

                <scope>provided</scope>

            </dependency>

        </dependencies>

    </dependencyManagement>

</project>

Avatar

Avatar

nickt39971962

Avatar

nickt39971962

nickt39971962

23-08-2019

To be more specific, as soon as we add the mode "update" AEM becomes very unhappy and we just see internal server output with nothing in the error.log

Avatar

Avatar

nickt39971962

Avatar

nickt39971962

nickt39971962

23-08-2019

The error occurs when I try to add a filter that allows existing values to be updated:

<plugin>

                    <groupId>com.day.jcr.vault</groupId>

                    <artifactId>content-package-maven-plugin</artifactId>

                    <version>0.5.24</version>

                    <extensions>true</extensions>

                    <configuration>

                        <packaging>zip</packaging>

                        <packageType>mixed</packageType>

                        <properties>

                            <acHandling>overwrite</acHandling>

                            <granite.suppressSnapshots>true</granite.suppressSnapshots>

                        </properties>

                        <failOnError>true</failOnError>

                        <install>true</install>

                        <verbose>true</verbose>

                        <useProxy>false</useProxy>

                        <filters>

                            <filter>

                                <root>/apps/</root>

                                <mode>update</mode>

                            </filter>

                        </filters>

                    </configuration>

Avatar

Avatar

nickt39971962

Avatar

nickt39971962

nickt39971962

23-08-2019

Sorry, now the error has changed:

[ERROR] Request to http://...:4503/crx/packmgr/service.jsp failed, response=Internal Server Error

Avatar

Avatar

nickt39971962

Avatar

nickt39971962

nickt39971962

23-08-2019

No this wasn't the issue it is a red herring. I still get the same 500 error when deploying to publish 2 now even as admin.

Avatar

Avatar

Jörg_Hoh

Employee

Total Posts

3.0K

Likes

957

Correct Reply

1.0K

Avatar

Jörg_Hoh

Employee

Total Posts

3.0K

Likes

957

Correct Reply

1.0K
Jörg_Hoh
Employee

22-08-2019

There is no reason why it would change. I assume that some custom process has overwritten the permissions?

Avatar

Avatar

nickt39971962

Avatar

nickt39971962

nickt39971962

22-08-2019

I can now deploy by deploying as our admin user. Why would the permissions suddenly have changed on our other user?

Avatar

Avatar

nickt39971962

Avatar

nickt39971962

nickt39971962

22-08-2019

Hi Vishu,

Thank you for your help.

We are deploying use maven content plugin with bundle auto install. This has been working for a while.

On the publish instances, CRX does not allow me to log in with the user who is deploying it says unknown username and password.

When I log in as admin and upload the packages in CRX package manager UI it installs fine.

Thank you