Scheduled OOTB workflow on author does not run due to javax.jcr.AccessDeniedException: Access denied.

[oligawen]

Hi,
I am currently facing the following issue. I have created a scheduled job which runs every night and collects assets which have failed and re-uploads them using "dynamic-media-reupload" workflow. When I ran the same code in a test Servlet all worked as expected, the problem comes when the workflow gets executed by the scheduler job. Is there a specific way the Workflowsession needs to be instantiated, do I need to provide some additional privileges / metadata info. I am attaching the error in the error log

com.adobe.granite.workflow.core.jcr.WorkflowBucketManager Error creating unique instance id: /var/workflow/instances/server1901/2023-02-19/dynamic-media-reupload_131
javax.jcr.AccessDeniedException: Access denied.
at org.apache.jackrabbit.oak.jcr.security.AccessManager.checkPermissions(AccessManager.java:71) [org.apache.jackrabbit.oak-jcr:1.44.0.T20221206170501-6d59064]
at org.apache.jackrabbit.oak.jcr.session.NodeImpl$5.perform(NodeImpl.java:320) [org.apache.jackrabbit.oak-jcr:1.44.0.T20221206170501-6d59064]
at org.apache.jackrabbit.oak.jcr.session.NodeImpl$5.perform(NodeImpl.java:289) [org.apache.jackrabbit.oak-jcr:1.44.0.T20221206170501-6d59064]
at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.perform(SessionDelegate.java:210) [org.apache.jackrabbit.oak-jcr:1.44.0.T20221206170501-6d59064]
at org.apache.jackrabbit.oak.jcr.session.ItemImpl.perform(ItemImpl.java:112) [org.apache.jackrabbit.oak-jcr:1.44.0.T20221206170501-6d59064]
at org.apache.jackrabbit.oak.jcr.session.NodeImpl.addNode(NodeImpl.java:289) [org.apache.jackrabbit.oak-jcr:1.44.0.T20221206170501-6d59064]
at com.adobe.granite.workflow.core.jcr.WorkflowBucketManager.createWorkflowInstanceNode(WorkflowBucketManager.java:206) [com.adobe.granite.workflow.core:2.1.84]
at com.adobe.granite.workflow.core.jcr.WorkflowManager.createWorkflowInstance(WorkflowManager.java:366) [com.adobe.granite.workflow.core:2.1.84]
at com.adobe.granite.workflow.core.WorkflowSessionImpl.startWorkflow(WorkflowSessionImpl.java:2025) [com.adobe.granite.workflow.core:2.1.84]
at com.adobe.granite.workflow.core.WorkflowSessionImpl.startWorkflow(WorkflowSessionImpl.java:543) [com.adobe.granite.workflow.core:2.1.84]

[Shiv_Prakash_Patel · Accepted solution]

Hi @oligawen ,

How are getting the workflow session?

Try to get the workflow session from the system user with proper permission to the system user.

private static final String SYSTEM_USER = "system_user";

//Getting ResourceResolver and Session using System Users
Map<String, Object> param = new HashMap<>();
param.put(ResourceResolverFactory.SUBSERVICE, SYSTEM_USER);
resourceResolver = resourceResolverFactory.getServiceResourceResolver(param);

// Get the workflow session from the resource resolver
final WorkflowSession workflowSession = resourceResolver.adaptTo(WorkflowSession.class);

 The rest of the code for workflow initialization can follow as below:

// Workflow model path
final String model = "/var/workflow/models/version-creation";

// Get the workflow model object
final WorkflowModel workflowModel = Objects.requireNonNull(workflowSession).getModel(model);

// Create a workflow payload object pointing to a resource via JCR(asset path)
final WorkflowData workflowData = workflowSession.newWorkflowData("JCR_PATH", payloadPath);

Map<String, Object> workflowMetadata = new HashMap<>();
workflowMetadata.put("startDate", new Date());

//start the workflow
workflowSession.startWorkflow(workflowModel, workflowData, workflowMetadata);

Hope this could help you!!!

Regards,

Shiv

[oligawen]

Hi @Shiv_Prakash_Patel ,
Thank you very, very much for the detailed answer and code snippet. I was getting the workflow session like this

WorkflowSession workflowSession = resourceResolver.adaptTo(WorkflowSession.class);

 and the resource resolver I got like this

final ResourceResolver resourceResolver = resourceResolverService.createReader().get()

 where resourceResolverService is 

@Reference

[Shiv_Prakash_Patel]

Please check if the implementation of createReader() method has read and writes permission to the var folder or just get resource resolver from the system user with read & write permission to the var folder.

[oligawen]

Yeah, that is what I neglected to check, createReader had only the read rights, I now provided the createWriter, who has both read and write permissions. Question is where do I check the permissions for specific folders ? I was not able to find a system_user locally 

[Shiv_Prakash_Patel]

You can check the system user associated with your bundle in the config manager. It will give you an idea about this and once will know the system user you can check the permission from the user admin console.

please check - https://unlocklearning.in/resource-resolver-in-aem/ 

[oligawen]

@Shiv_Prakash_Patel  once again thank you very much for your time and detailed explanations.