Publish - Access denied - Unable to commit changes to session

[sean12341]

Hi,

I am using AEM Cloud, and trying to commit a created resource in the `createResource` method below.

    @Model(
            adaptables = {Resource.class, SlingHttpServletRequest.class},
            adapters = {ArticleModel.class, ComponentExporter.class},
            resourceType = ArticleModel.RESOURCE_TYPE,
            defaultInjectionStrategy = DefaultInjectionStrategy.OPTIONAL)
    public class ArticleModel extends AbstractComponentImpl {

        @inject public SlingHttpServletRequest request;

        @SlingObject private ResourceResolver resourceResolver;

        @PostConstruct
        private void init() throws Exception {
            createResource();
        }

        public void createResource() throws Exception {

            String path = request.getResource().getPath();
            String newResourceName = "embed2";
            Resource parentResource = resourceResolver.getResource(path);

            Map<String, Object> properties = new HashMap<>();
            properties.put("jcr:primaryType", "nt:unstructured");
            properties.put("sling:resourceType", "mysite/components/embed");
            properties.put("type", "embeddable");
            properties.put(
                    "embeddableResourceType", "core/wcm/components/embed/v1/embed/embeddable/youtube");

            try {
                Resource newResource =
                        resourceResolver.create(parentResource, newResourceName, properties);
                resourceResolver.commit();
            } catch (PersistenceException e) {
                throw new Exception("Error while creating new resource: " + e.getMessage(), e);
            }
        }
    }

This works on my local Author instance, but when I view my page on Publish, I get the following error message:

    Caused by: org.apache.sling.api.resource.PersistenceException: Unable to commit changes to session.
        at org.apache.sling.jcr.resource.internal.helper.jcr.JcrResourceProvider.commit(JcrResourceProvider.java:585) [org.apache.sling.jcr.resource:3.2.4]
        at org.apache.sling.resourceresolver.impl.providers.stateful.AuthenticatedResourceProvider.commit(AuthenticatedResourceProvider.java:240) [org.apache.sling.resourceresolver:1.10.0]
        at org.apache.sling.resourceresolver.impl.helper.ResourceResolverControl.commit(ResourceResolverControl.java:531) [org.apache.sling.resourceresolver:1.10.0]
        at org.apache.sling.resourceresolver.impl.ResourceResolverImpl.commit(ResourceResolverImpl.java:1031) [org.apache.sling.resourceresolver:1.10.0]
        at com.wvc.agrabah.aem.core.models.SportArticleModel.createResource(SportArticleModel.java:143) [wvc-aem-project.core:6.0.0.SNAPSHOT]
        ... 323 common frames omitted
    Caused by: javax.jcr.AccessDeniedException: OakAccess0000: Access denied
        at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:232) [org.apache.jackrabbit.oak-api:1.54.0.T20230817132355-3800a65]
        at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:213) [org.apache.jackrabbit.oak-api:1.54.0.T20230817132355-3800a65]
        at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.newRepositoryException(SessionDelegate.java:737) [org.apache.jackrabbit.oak-jcr:1.54.0.T20230817132355-3800a65]
        at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:551) [org.apache.jackrabbit.oak-jcr:1.54.0.T20230817132355-3800a65]
        at org.apache.jackrabbit.oak.jcr.session.SessionImpl$9.performVoid(SessionImpl.java:459) [org.apache.jackrabbit.oak-jcr:1.54.0.T20230817132355-3800a65]
        at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.performVoid(SessionDelegate.java:299) [org.apache.jackrabbit.oak-jcr:1.54.0.T20230817132355-3800a65]
        at org.apache.jackrabbit.oak.jcr.session.SessionImpl.save(SessionImpl.java:456) [org.apache.jackrabbit.oak-jcr:1.54.0.T20230817132355-3800a65]
        at com.adobe.granite.repository.impl.CRX3SessionImpl.save(CRX3SessionImpl.java:220) [com.adobe.granite.repository:1.8.86]
        at org.apache.sling.jcr.resource.internal.helper.jcr.JcrResourceProvider.commit(JcrResourceProvider.java:583) [org.apache.sling.jcr.resource:3.2.4]
        ... 327 common frames omitted

My situation is similar to this solution, where he went into the CRX and configMgr to create a system user and used a `resourceResolverFactory` to get the resolver.

But although his solution works on a local Publish instance, I cannot create an user on an instance deployed to Cloud AEM as I don't have access to CRX and configMgr there.

What would be the proper solution in this case?

Thank you,

[A_H_M_Imrul · Accepted solution]

@sean12341 

You already attached the standard solution for this use case. You need to get ResourceResolver for a user and that user should have proper permissions to perform read/write in JCR.

Regarding permissions, I would recommend you to talk to the operations team or product own (who supposed to have access to the relevant console).

[aanchal-sikka]

@sean12341 

Publish instance is read-only for AEMaaCS. 

All edits/updates should happen on author and replicated to publish.