Sling content distribution (reverse) not working for /home/users

[moalam]

Hi all,

           I am trying to do Sling content distribution (reverse -(Publish to Author))  for the /home/users/ folder in AEM. It's giving me the following exception

ERROR - [default] PACKAGE-FAIL DSTRQ8: could not deliver package dstrpck-2022--10--10--9--53--9c41857f-e8f8-489d-b327-16ae0c652526_9 javax.jcr.AccessDeniedException: OakAccess0000: Access denied

Note: User update and deletion calls are getting accepted. But the new user add is getting dropped and an exception is happening and the Service user has all the required permission as well. 

Use Case :

I am triggering a JCR trigger when the user has been created in /home/users and it gets pulled in the author (I am running a workflow based on this.)

[Saravanan_Dharmaraj]

Hope you would have seen this doc

https://experienceleague.adobe.com/docs/experience-manager-gems-events/assets/aem-gems-scd.pdf?lang=...

[moalam]

Hi Sarvanan,

Thanks for your reply. I did look into the pdf. But not able to find any specific answer. My agent is working fine but somehow new user creation giving this below error.

10.10.2022 12:26:21.088 *ERROR* [sling-threadpool-8eccb855-16dd-4f4f-b4a0-ac445595a9e6-(apache-sling-job-thread-pool)-15-org_apache_sling_distribution_queue_myreverse_default(org/apache/sling/distribution/queue/myreverse/default)] org.apache.sling.distribution.util.impl.DistributionUtils cannot commit changes to resource resolver

org.apache.sling.api.resource.PersistenceException: Unable to commit changes to session.

at org.apache.sling.jcr.resource.internal.helper.jcr.JcrResourceProvider.commit(JcrResourceProvider.java:519) [org.apache.sling.jcr.resource:3.0.18]

at org.apache.sling.resourceresolver.impl.providers.stateful.AuthenticatedResourceProvider.commit(AuthenticatedResourceProvider.java:215) [org.apache.sling.resourceresolver:1.7.10]

at org.apache.sling.resourceresolver.impl.helper.ResourceResolverControl.commit(ResourceResolverControl.java:433) [org.apache.sling.resourceresolver:1.7.10]

at org.apache.sling.resourceresolver.impl.ResourceResolverImpl.commit(ResourceResolverImpl.java:1005) [org.apache.sling.resourceresolver:1.7.10]

at org.apache.sling.distribution.util.impl.DistributionUtils.ungetResourceResolver(DistributionUtils.java:66) [org.apache.sling.distribution.core:0.4.0.B006]

at org.apache.sling.distribution.agent.impl.SimpleDistributionAgentQueueProcessor.processQueueItem(SimpleDistributionAgentQueueProcessor.java:173) [org.apache.sling.distribution.core:0.4.0.B006]

at org.apache.sling.distribution.agent.impl.SimpleDistributionAgentQueueProcessor.process(SimpleDistributionAgentQueueProcessor.java:91) [org.apache.sling.distribution.core:0.4.0.B006]

at org.apache.sling.distribution.queue.impl.jobhandling.DistributionAgentJobConsumer.process(DistributionAgentJobConsumer.java:49) [org.apache.sling.distribution.core:0.4.0.B006]

at org.apache.sling.event.impl.jobs.JobConsumerManager$JobConsumerWrapper.process(JobConsumerManager.java:502) [org.apache.sling.event:4.2.12]

at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.startJob(JobQueueImpl.java:293) [org.apache.sling.event:4.2.12]

at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.access$100(JobQueueImpl.java:60) [org.apache.sling.event:4.2.12]

at org.apache.sling.event.impl.jobs.queues.JobQueueImpl$1.run(JobQueueImpl.java:229) [org.apache.sling.event:4.2.12]

at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)

at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)

at java.base/java.lang.Thread.run(Thread.java:834)

Caused by: javax.jcr.AccessDeniedException: OakAccess0000: Access denied

at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:232) [org.apache.jackrabbit.oak-api:1.22.9]

at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:213) [org.apache.jackrabbit.oak-api:1.22.9]

at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.newRepositoryException(SessionDelegate.java:669) [org.apache.jackrabbit.oak-jcr:1.22.9]

at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:495) [org.apache.jackrabbit.oak-jcr:1.22.9]

at org.apache.jackrabbit.oak.jcr.session.SessionImpl$8.performVoid(SessionImpl.java:424) [org.apache.jackrabbit.oak-jcr:1.22.9]

at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.performVoid(SessionDelegate.java:273) [org.apache.jackrabbit.oak-jcr:1.22.9]

at org.apache.jackrabbit.oak.jcr.session.SessionImpl.save(SessionImpl.java:421) [org.apache.jackrabbit.oak-jcr:1.22.9]

at com.adobe.granite.repository.impl.CRX3SessionImpl.save(CRX3SessionImpl.java:208) [com.adobe.granite.repository:1.6.28.CQ650-B0001]

at org.apache.sling.jcr.resource.internal.helper.jcr.JcrResourceProvider.commit(JcrResourceProvider.java:517) [org.apache.sling.jcr.resource:3.0.18]

... 14 common frames omitted

Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakAccess0000: Access denied

at org.apache.jackrabbit.oak.security.authorization.permission.PermissionValidator.checkPermissions(PermissionValidator.java:209) [org.apache.jackrabbit.oak-core:1.22.9]

at org.apache.jackrabbit.oak.security.authorization.permission.PermissionValidator.childNodeAdded(PermissionValidator.java:146) [org.apache.jackrabbit.oak-core:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeAdded(VisibleValidator.java:104) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeAdded(VisibleValidator.java:30) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.CompositeEditor.childNodeAdded(CompositeEditor.java:107) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeAdded(EditorDiff.java:115) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.plugins.memory.EmptyNodeState.compareAgainstEmptyState(EmptyNodeState.java:160) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:504) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeAdded(EditorDiff.java:124) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:440) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:444) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.EditorDiff.childNodeChanged(EditorDiff.java:147) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.segment.MapRecord.compare(MapRecord.java:517) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.segment.SegmentNodeState.compareAgainstBaseState(SegmentNodeState.java:651) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.EditorDiff.process(EditorDiff.java:51) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.EditorHook.processCommit(EditorHook.java:54) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.spi.commit.CompositeHook.processCommit(CompositeHook.java:60) [org.apache.jackrabbit.oak-store-spi:1.22.9]

at org.apache.jackrabbit.oak.segment.scheduler.Commit.apply(Commit.java:99) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.segment.scheduler.LockBasedScheduler.execute(LockBasedScheduler.java:299) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.segment.scheduler.LockBasedScheduler.schedule(LockBasedScheduler.java:270) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.segment.SegmentNodeStore.merge(SegmentNodeStore.java:211) [org.apache.jackrabbit.oak-segment-tar:1.22.9]

at org.apache.jackrabbit.oak.core.MutableRoot.commit(MutableRoot.java:251) [org.apache.jackrabbit.oak-core:1.22.9]

at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.commit(SessionDelegate.java:346) [org.apache.jackrabbit.oak-jcr:1.22.9]

at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:493) [org.apache.jackrabbit.oak-jcr:1.22.9]

... 19 common frames omitted

[Saravanan_Dharmaraj]

It looks to me the access privilege issue. Please cross check with the steps done with this video and the service user mapping

https://www.youtube.com/watch?v=5pODUOFx5lQ

[moalam]

Thanks, Saravanan,  I followed the above link, and reverse replication is happening successfully but somehow any new user creation under /home/users, it's throwing the OakAccess0000: Access denied exception. In fact, I have given all the nodes permission to the service user.

I am wondering for /home/users, do I need to do something else?

Regards

Mohammed

[moalam · Accepted solution]

Hi Sarvanan,

Thanks for your input. We found the issue and fixed it.

The replication service had missing JCR permission.

Regards

Mohammed