javax.jcr.AccessDeniedException: Access denied. (500)

nickt39971962

22-08-2019

All of our deploys have started failing with the following error. Even trying to deploy packages that have previously been installed results in the same error. Could anyone tell me how I can start investigating a problem like this? I don't see anything useful in the logs.

This problem is happening on our stage publishers and all of our production instances but our stage author is working fine. I know that is a clue but I'm not sure where to look.

[ERROR] Request failed: javax.jcr.AccessDeniedException: Access denied. (500)

[INFO] Looks like the package was not installed, checking the list...

[INFO] package not installed, re-uploading it...

[ERROR] Request failed: javax.jcr.AccessDeniedException: Access denied. (500)

Accepted Solutions (1)

Accepted Solutions (1)

Vish_dhaliwal

Employee

22-08-2019

Hello,

What is the procedure of the package deployment? Since there is an Access Denied Exception, check if it works with admin user.

Check if the same user can install packages through the package manager.

Regards,

Vishu

Answers (10)

Answers (10)

Gaurav-Behl

MVP

23-08-2019

Couple of questions:

1) Does the issue happens with  '-Pauto-install-bundle' or '-Pauto-install-package' or both profiles? -- based on your statement 'We are deploying use maven content plugin with bundle auto install.'?

2) If the issue happens with 'auto-install-bundle'  - can you verify that the '/apps/.../install' folders (http://localhost:4502/apps/mycompany/parent/install​) exists when you use that profile? Assuming there are no permission issues on /apps/.../install since you use admin credentials.

Adding Filter tag to content-package-maven-plugin fails probably because it expects either <includes> or <embeddeds>

check Managing Packages Using Maven

On a side note, <usePut>true</usePut> is deprecated

 

Jörg_Hoh

Employee

23-08-2019

Can you build a minimal content-package which shows this behavior, and then share it? And btw an internal server error can be thrown if your content package is malformed in a way, that the XML import fails. Can you try to install the content-package manually via /crx/packmgr/index.jsp? It's definitely more verbose than maven.

Jörg

nickt39971962

23-08-2019

Apologies: Can't seem to edit posts on here, the actions drop down just spins around indefinitely.

We actually see the problem even just adding the filters element at all. Here's our full parent pom which is shared by 3 content packages

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <!-- ====================================================================== -->

    <!-- P R O J E C T   D E S C R I P T I O N -->

    <!-- ====================================================================== -->

    <groupId>mycompany</groupId>

    <artifactId>parent-pom</artifactId>

    <version>1.5.1</version>

    <packaging>pom</packaging>

    <name>mycompany AEM Parent</name>

    <!-- ====================================================================== -->

    <!-- P R O P E R T I E S -->

    <!-- ====================================================================== -->

    <properties>

        <customer.name>mycompany</customer.name>

        <cq.project.name>parent</cq.project.name>

        <cq.url>http://localhost:4502</cq.url>

        <app.folder>/${cq.project.name}</app.folder>

        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

        <bundle.install.directory>/apps/${customer.name}${app.folder}/install</bundle.install.directory>

        <cq.user>admin</cq.user>

        <cq.password>admin</cq.password>

        <cxf.version>3.0.4</cxf.version>

    </properties>

    <!-- ====================================================================== -->

    <!-- P R O F I L E S -->

    <!-- ====================================================================== -->

    <profiles>

        <profile>

            <id>auto-install-bundle</id>

            <build>

                <plugins>

                    <plugin>

                        <groupId>org.apache.sling</groupId>

                        <artifactId>maven-sling-plugin</artifactId>

                        <version>2.1.0</version>

                        <executions>

                            <execution>

                                <id>install-bundle</id>

                                <goals>

                                    <goal>install</goal>

                                </goals>

                            </execution>

                        </executions>

                        <configuration>

                            <slingUrl>${cq.url}${bundle.install.directory}</slingUrl>

                            <usePut>true</usePut>

                        </configuration>

                    </plugin>

                </plugins>

            </build>

        </profile>

        <profile>

            <id>auto-install-package</id>

            <build>

                <pluginManagement>

                    <plugins>

                        <plugin>

                            <groupId>com.day.jcr.vault</groupId>

                            <artifactId>content-package-maven-plugin</artifactId>

                            <executions>

                                <execution>

                                    <id>install-package</id>

                                    <goals>

                                        <goal>install</goal>

                                    </goals>

                                    <configuration>

                                        <groupId>${project.groupId}</groupId>

                                        <artifactId>${project.artifactId}</artifactId>

                                        <targetURL>${cq.url}/crx/packmgr/service.jsp</targetURL>

                                        <userId>${cq.user}</userId>

                                        <password>${cq.password}</password>

                                    </configuration>

                                </execution>

                            </executions>

                        </plugin>

                    </plugins>

                </pluginManagement>

            </build>

        </profile>

        <!-- <profile>

            <id>analysis</id>

            <properties>

                <sonar.jdbc.url>jdbc:mysql://xxx.net/sonar?useUnicode=true&amp;characterEncoding=utf8</sonar.jdbc.url>

                <sonar.jdbc.username>sonar</sonar.jdbc.username>

                <sonar.jdbc.password>sonar</sonar.jdbc.password>

                <sonar.host.url>http://xxx.net/sonar/</sonar.host.url>

                <sonar.analysis.mode>preview</sonar.analysis.mode>

                <sonar.issuesReport.html.enable>true</sonar.issuesReport.html.enable>

            </properties>

        </profile>

        <profile>

            <id>analysis-full</id>

            <properties>

                <sonar.analysis.mode>analysis</sonar.analysis.mode>

                <sonar.issuesReport.html.enable>false</sonar.issuesReport.html.enable>

            </properties>

        </profile> -->

        <profile>

            <id>local-publish</id>

            <properties>

                <cq.url>http://localhost:4503</cq.url>

            </properties>

        </profile>

    </profiles>

    <!-- ====================================================================== -->

    <!-- B U I L D -->

    <!-- ====================================================================== -->

    <build>

        <pluginManagement>

            <plugins>

                <plugin>

                    <groupId>org.apache.maven.plugins</groupId>

                    <artifactId>maven-compiler-plugin</artifactId>

                    <version>3.2</version>

                    <configuration>

                        <encoding>UTF-8</encoding>

                        <source>1.8</source>

                        <target>1.8</target>

                    </configuration>

                </plugin>

                <plugin>

                    <groupId>org.apache.felix</groupId>

                    <artifactId>maven-scr-plugin</artifactId>

                    <version>1.20.0</version>

                    <executions>

                        <execution>

                            <id>generate-scr-descriptor</id>

                            <goals>

                                <goal>scr</goal>

                            </goals>

                        </execution>

                    </executions>

                </plugin>

                <plugin>

                    <groupId>org.apache.felix</groupId>

                    <artifactId>maven-bundle-plugin</artifactId>

                    <version>3.3.0</version>

                    <extensions>true</extensions>

                    <configuration>

                        <instructions>

                            <Bundle-Category>${customer.name}</Bundle-Category>

                            <Include-Resource>{maven-resources}</Include-Resource>

                        </instructions>

                    </configuration>

                </plugin>

                <plugin>

                    <groupId>com.day.jcr.vault</groupId>

                    <artifactId>content-package-maven-plugin</artifactId>

                    <version>0.5.24</version>

                    <extensions>true</extensions>

                    <configuration>

                        <packaging>zip</packaging>

                        <packageType>mixed</packageType>

                        <properties>

                            <acHandling>overwrite</acHandling>

                            <granite.suppressSnapshots>true</granite.suppressSnapshots>

                        </properties>

                        <failOnError>true</failOnError>

                        <install>true</install>

                        <verbose>true</verbose>

                        <useProxy>false</useProxy>

                        <filters>

                            <filter>

                                <root>/apps</root>

                                <mode>merge</mode>

                            </filter>

                        </filters>

                    </configuration>

                </plugin>

                <plugin>

                    <groupId>org.apache.sling</groupId>

                    <artifactId>maven-sling-plugin</artifactId>

                    <version>2.1.0</version>

                </plugin>

                <plugin>

                    <artifactId>maven-resources-plugin</artifactId>

                    <version>2.7</version>

                    <executions>

                        <execution>

                            <id>copy-resources</id>

                            <phase>generate-sources</phase>

                            <goals>

                                <goal>copy-resources</goal>

                            </goals>

                            <configuration>

                                <outputDirectory>${project.build.directory}/jsps-to-compile</outputDirectory>

                                <resources>

                                    <resource>

                                        <directory>${basedir}/jcr_root</directory>

                                    </resource>

                                    <resource>

                                        <directory>${basedir}/apps</directory>

                                    </resource>

                                </resources>

                            </configuration>

                        </execution>

                    </executions>

                </plugin>

                <plugin>

                    <artifactId>maven-clean-plugin</artifactId>

                    <version>2.5</version>

                    <executions>

                        <execution>

                            <id>remove-compiled-jsps</id>

                            <goals>

                                <goal>clean</goal>

                            </goals>

                            <phase>process-classes</phase>

                            <configuration>

                                <excludeDefaultDirectories>true</excludeDefaultDirectories>

                                <filesets>

                                    <fileset>

                                        <directory>${project.build.directory}/jsps-to-compile</directory>

                                        <directory>${project.build.directory}/ignoredjspc</directory>

                                    </fileset>

                                </filesets>

                            </configuration>

                        </execution>

                    </executions>

                </plugin>

                <plugin>

                    <groupId>org.apache.maven.plugins</groupId>

                    <artifactId>maven-surefire-plugin</artifactId>

                    <version>2.18.1</version>

                </plugin>

                <!--This plugin's configuration is used to store Eclipse m2e settings

                    only. It has no influence on the Maven build itself. -->

                <plugin>

                    <groupId>org.eclipse.m2e</groupId>

                    <artifactId>lifecycle-mapping</artifactId>

                    <version>1.0.0</version>

                    <configuration>

                        <lifecycleMappingMetadata>

                            <pluginExecutions>

                                <pluginExecution>

                                    <pluginExecutionFilter>

                                        <groupId>org.apache.sling</groupId>

                                        <artifactId>maven-jspc-plugin</artifactId>

                                        <versionRange>[2.0.6,)</versionRange>

                                        <goals>

                                            <goal>jspc</goal>

                                        </goals>

                                    </pluginExecutionFilter>

                                    <action>

                                        <ignore />

                                    </action>

                                </pluginExecution>

                                <pluginExecution>

                                    <pluginExecutionFilter>

                                        <groupId>org.apache.maven.plugins</groupId>

                                        <artifactId>maven-clean-plugin</artifactId>

                                        <versionRange>[2.6.1,)</versionRange>

                                        <goals>

                                            <goal>clean</goal>

                                            <goal>test-compile</goal>

                                            <goal>compile</goal>

                                        </goals>

                                    </pluginExecutionFilter>

                                    <action>

                                        <ignore />

                                    </action>

                                </pluginExecution>

                            </pluginExecutions>

                        </lifecycleMappingMetadata>

                    </configuration>

                </plugin>

                <plugin>

                    <groupId>org.apache.sling</groupId>

                    <artifactId>htl-maven-plugin</artifactId>

                    <version>1.0.8</version>

                    <configuration>

                        <!-- put your configurations here -->

                    </configuration>

                    <executions>

                        <execution>

                            <goals>

                                <goal>validate</goal>

                            </goals>

                        </execution>

                    </executions>

                </plugin>

            </plugins>

        </pluginManagement>

        <resources>

            <resource>

                <directory>${basedir}/META-INF</directory>

                <targetPath>../vault-work/META-INF</targetPath>

            </resource>

            <resource>

                <directory>${basedir}/jcr_root</directory>

                <filtering>false</filtering>

                <excludes>

                    <exclude>**/.vlt</exclude>

                    <exclude>**/.vltignore</exclude>

                    <exclude>**/*.iml</exclude>

                    <exclude>**/.classpath</exclude>

                    <exclude>**/.project</exclude>

                    <exclude>**/.DS_Store</exclude>

                    <exclude>**/target/**</exclude>

                    <exclude>libs/**</exclude>

                </excludes>

            </resource>

        </resources>

        <plugins>

            <plugin>

                <groupId>external.atlassian.jgitflow</groupId>

                <artifactId>jgitflow-maven-plugin</artifactId>

                <version>1.0-m5.1</version>

                <configuration>

                    <flowInitContext>

                        <masterBranchName>master</masterBranchName>

                        <developBranchName>develop</developBranchName>

                        <featureBranchPrefix>feature-</featureBranchPrefix>

                        <releaseBranchPrefix>release-</releaseBranchPrefix>

                        <hotfixBranchPrefix>hotfix-</hotfixBranchPrefix>

                        <versionTagPrefix />

                    </flowInitContext>

                    <autoVersionSubmodules>true</autoVersionSubmodules>

                    <pushFeatures>true</pushFeatures>

                    <pushReleases>true</pushReleases>

                    <pushHotfixes>true</pushHotfixes>

                    <noDeploy>true</noDeploy>

                    <allowSnapshots>true</allowSnapshots>

                </configuration>

            </plugin>

        </plugins>

    </build>

    <!-- ====================================================================== -->

    <!-- D E P E N D E N C I E S   M A N A G E M E N T -->

    <!-- ====================================================================== -->

    <dependencyManagement>

        <dependencies>

            <dependency>

                <groupId>org.apache.felix</groupId>

                <artifactId>org.apache.felix.scr</artifactId>

                <version>1.6.0</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.felix</groupId>

                <artifactId>org.apache.felix.scr.annotations</artifactId>

                <version>1.9.6</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <artifactId>oak-commons</artifactId>

                <version>1.8.2</version>

                <groupId>org.apache.jackrabbit</groupId>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.osgi</groupId>

                <artifactId>org.osgi.core</artifactId>

                <version>4.2.0</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.osgi</groupId>

                <artifactId>org.osgi.compendium</artifactId>

                <version>4.2.0</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.slf4j</groupId>

                <artifactId>slf4j-api</artifactId>

                <version>1.7.6</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>javax.servlet</groupId>

                <artifactId>servlet-api</artifactId>

                <version>2.5</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>javax.jcr</groupId>

                <artifactId>jcr</artifactId>

                <version>2.0</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>javax.inject</groupId>

                <artifactId>javax.inject</artifactId>

                <version>1</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.commons</groupId>

                <artifactId>commons-lang3</artifactId>

                <version>3.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.httpcomponents</groupId>

                <artifactId>httpclient-osgi</artifactId>

                <version>4.3.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>commons-io</groupId>

                <artifactId>commons-io</artifactId>

                <version>2.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>commons-codec</groupId>

                <artifactId>commons-codec</artifactId>

                <version>1.10</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>com.google.code.gson</groupId>

                <artifactId>gson</artifactId>

                <version>2.3</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.sling</groupId>

                <artifactId>org.apache.sling.models.api</artifactId>

                <version>1.2.2</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>org.apache.sling</groupId>

                <artifactId>org.apache.sling.scripting.jsp.taglib</artifactId>

                <version>2.2.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>com.day.commons.osgi.wrapper</groupId>

                <artifactId>com.day.commons.osgi.wrapper.commons-httpclient</artifactId>

                <version>3.1.0.018</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>com.day.commons.osgi.wrapper</groupId>

                <artifactId>com.day.commons.osgi.wrapper.commons-lang2</artifactId>

                <version>2.5-0001</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>com.day.cq.wcm</groupId>

                <artifactId>cq-wcm-taglib</artifactId>

                <version>5.7.4</version>

                <scope>provided</scope>

            </dependency>

            <dependency>

                <groupId>biz.aQute</groupId>

                <artifactId>bndlib</artifactId>

                <version>1.50.0</version>

                <scope>provided</scope>

            </dependency>

            <!-- jackson -->

            <dependency>

                <groupId>com.fasterxml.jackson.core</groupId>

                <artifactId>jackson-databind</artifactId>

                <version>2.5.3</version>

            </dependency>

            <dependency>

                <groupId>com.fasterxml.jackson.core</groupId>

                <artifactId>jackson-annotations</artifactId>

                <version>2.5.0</version>

            </dependency>

            <dependency>

                <groupId>com.fasterxml.jackson.core</groupId>

                <artifactId>jackson-core</artifactId>

                <version>2.5.3</version>

            </dependency>

            <!-- Apache CXF Dependencies -->

            <dependency>

                <groupId>org.apache.cxf</groupId>

                <artifactId>cxf-rt-frontend-jaxws</artifactId>

                <version>${cxf.version}</version>

                <scope>compile</scope>

                <exclusions>

                    <exclusion>

                        <groupId>commons-logging</groupId>

                        <artifactId>commons-logging</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>commons-lang</groupId>

                        <artifactId>commons-lang</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.apache.geronimo.specs</groupId>

                        <artifactId>geronimo-javamail_1.4_spec</artifactId>

                    </exclusion>

                    <!-- exclude spring dependencies -->

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-aop</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-asm</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-beans</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-context</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-core</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-expression</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-web</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>com.sun.xml.bind</groupId>

                        <artifactId>jaxb-impl</artifactId>

                    </exclusion>

                </exclusions>

            </dependency>

            <dependency>

                <groupId>org.apache.cxf</groupId>

                <artifactId>cxf-rt-transports-http</artifactId>

                <version>${cxf.version}</version>

                <scope>compile</scope>

                <exclusions>

                    <exclusion>

                        <groupId>commons-logging</groupId>

                        <artifactId>commons-logging</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>commons-lang</groupId>

                        <artifactId>commons-lang</artifactId>

                    </exclusion>

                    <!-- exclude spring dependencies -->

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-aop</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-asm</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-beans</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-context</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-core</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-expression</artifactId>

                    </exclusion>

                    <exclusion>

                        <groupId>org.springframework</groupId>

                        <artifactId>spring-web</artifactId>

                    </exclusion>

                </exclusions>

            </dependency>

            <!-- AEM APIs JAR -->

            <dependency>

                <groupId>com.adobe.aem</groupId>

                <artifactId>uber-jar</artifactId>

                <classifier>apis</classifier>

                <version>6.4.1</version>

                <scope>provided</scope>

            </dependency>

        </dependencies>

    </dependencyManagement>

</project>

nickt39971962

23-08-2019

To be more specific, as soon as we add the mode "update" AEM becomes very unhappy and we just see internal server output with nothing in the error.log

nickt39971962

23-08-2019

The error occurs when I try to add a filter that allows existing values to be updated:

<plugin>

                    <groupId>com.day.jcr.vault</groupId>

                    <artifactId>content-package-maven-plugin</artifactId>

                    <version>0.5.24</version>

                    <extensions>true</extensions>

                    <configuration>

                        <packaging>zip</packaging>

                        <packageType>mixed</packageType>

                        <properties>

                            <acHandling>overwrite</acHandling>

                            <granite.suppressSnapshots>true</granite.suppressSnapshots>

                        </properties>

                        <failOnError>true</failOnError>

                        <install>true</install>

                        <verbose>true</verbose>

                        <useProxy>false</useProxy>

                        <filters>

                            <filter>

                                <root>/apps/</root>

                                <mode>update</mode>

                            </filter>

                        </filters>

                    </configuration>

nickt39971962

22-08-2019

Hi Vishu,

Thank you for your help.

We are deploying use maven content plugin with bundle auto install. This has been working for a while.

On the publish instances, CRX does not allow me to log in with the user who is deploying it says unknown username and password.

When I log in as admin and upload the packages in CRX package manager UI it installs fine.

Thank you