update asset workflow javax.jcr.AccessDeniedException: OakAccess0000: Access denied

[sreenu539]

I tried to upload an image to dam using admin/admin and following is the error I see. When I check admin user in user admin, admin associated to everyone group and has permissions on all folders.

What am I missing ? AEM 6.4.2

29.10.2018 13:16:39.122 *ERROR* [JobHandler: /var/workflow/instances/server0/2018-10-25/update_asset_23:/content/dam/test/test-sample-1.jpg/jcr:content/renditions/original] com.adobe.granite.workflow.core.job.JobHandler Error executing workflow step

javax.jcr.AccessDeniedException: OakAccess0000: Access denied

  at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:231) [org.apache.jackrabbit.oak-api:1.8.7]

  at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:212) [org.apache.jackrabbit.oak-api:1.8.7]

  at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.newRepositoryException(SessionDelegate.java:670) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:496) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.SessionImpl$8.performVoid(SessionImpl.java:420) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.performVoid(SessionDelegate.java:274) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.SessionImpl.save(SessionImpl.java:417) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at com.adobe.granite.repository.impl.CRX3SessionImpl.save(CRX3SessionImpl.java:208) [com.adobe.granite.repository:1.4.88]

  at com.adobe.granite.workflow.core.WorkflowSessionImpl.persist(WorkflowSessionImpl.java:1469) [com.adobe.granite.workflow.core:2.0.168.CQ640-B0006]

  at com.adobe.granite.workflow.core.job.JobHandler.process(JobHandler.java:394) [com.adobe.granite.workflow.core:2.0.168.CQ640-B0006]

  at org.apache.sling.event.impl.jobs.JobConsumerManager$JobConsumerWrapper.process(JobConsumerManager.java:502) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.startJob(JobQueueImpl.java:293) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.access$100(JobQueueImpl.java:60) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl$1.run(JobQueueImpl.java:229) [org.apache.sling.event:4.2.12]

  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

  at java.lang.Thread.run(Unknown Source)

Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakAccess0000: Access denied

  at org.apache.jackrabbit.oak.security.authorization.permission.PermissionValidator.checkPermissions(PermissionValidator.java:240) [org.apache.jackrabbit.oak-core:1.8.7]

29.10.2018 15:53:24.553 *ERROR* [JobHandler: /var/workflow/instances/server0/2018-10-25/update_asset_35:/content/dam/we-retail/en/people/mens/moon-2.jpg/jcr:content/renditions/original] com.day.cq.dam.core.impl.AssetImpl addRendition: cannot add new rendition [cq5dam.thumbnail.140.100.png] for asset [/content/dam/we-retail/en/people/mens/moon-2.jpg]:

com.adobe.granite.asset.api.AssetException: Failed to set Rendition [ cq5dam.thumbnail.140.100.png] under /content/dam/we-retail/en/people/mens/moon-2.jpg

  at com.adobe.granite.asset.core.impl.AssetImpl.setRendition(AssetImpl.java:146) [com.adobe.granite.asset.core:2.2.56]

  at com.day.cq.dam.core.impl.AssetImpl.addRendition(AssetImpl.java:523) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.AssetImpl.addRendition(AssetImpl.java:516) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.RenditionMakerImpl$PlanBasedTemplate.apply(RenditionMakerImpl.java:133) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.RenditionMakerImpl.generateRenditions(RenditionMakerImpl.java:210) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.process.CreateThumbnailProcess.createThumbnails(CreateThumbnailProcess.java:119) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.process.ThumbnailProcess.execute(ThumbnailProcess.java:102) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.workflow.compatibility.CQWorkflowProcessRunner.execute(CQWorkflowProcessRunner.java:93) [com.day.cq.workflow.cq-workflow-impl:6.2.12]

  at com.adobe.granite.workflow.core.job.HandlerBase.executeProcess(HandlerBase.java:194) [com.adobe.granite.workflow.core:2.0.168.CQ640-B0006]

  at com.adobe.granite.workflow.core.job.JobHandler.process(JobHandler.java:261) [com.adobe.granite.workflow.core:2.0.168.CQ640-B0006]

  at org.apache.sling.event.impl.jobs.JobConsumerManager$JobConsumerWrapper.process(JobConsumerManager.java:502) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.startJob(JobQueueImpl.java:293) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.access$100(JobQueueImpl.java:60) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl$1.run(JobQueueImpl.java:229) [org.apache.sling.event:4.2.12]

  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

  at java.lang.Thread.run(Unknown Source)

Caused by: javax.jcr.AccessDeniedException: Access denied.

  at org.apache.jackrabbit.oak.jcr.security.AccessManager.checkPermissions(AccessManager.java:71) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl$5.perform(NodeImpl.java:296) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl$5.perform(NodeImpl.java:265) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.perform(SessionDelegate.java:208) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.ItemImpl.perform(ItemImpl.java:112) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl.addNode(NodeImpl.java:265) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at com.adobe.granite.asset.core.impl.AssetImpl.setRenditionResource(AssetImpl.java:328) [com.adobe.granite.asset.core:2.2.56]

  at com.adobe.granite.asset.core.impl.AssetImpl.setRendition(AssetImpl.java:143) [com.adobe.granite.asset.core:2.2.56]

  ... 16 common frames omitted

29.10.2018 15:53:24.566 *ERROR* [JobHandler: /var/workflow/instances/server0/2018-10-25/update_asset_35:/content/dam/we-retail/en/people/mens/moon-2.jpg/jcr:content/renditions/original] com.day.cq.dam.core.impl.AssetImpl addRendition: cannot add new rendition [cq5dam.thumbnail.48.48.png] for asset [/content/dam/we-retail/en/people/mens/moon-2.jpg]:

com.adobe.granite.asset.api.AssetException: Failed to set Rendition [ cq5dam.thumbnail.48.48.png] under /content/dam/we-retail/en/people/mens/moon-2.jpg

  at com.adobe.granite.asset.core.impl.AssetImpl.setRendition(AssetImpl.java:146) [com.adobe.granite.asset.core:2.2.56]

  at com.day.cq.dam.core.impl.AssetImpl.addRendition(AssetImpl.java:523) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.AssetImpl.addRendition(AssetImpl.java:516) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.RenditionMakerImpl$PlanBasedTemplate.apply(RenditionMakerImpl.java:133) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.RenditionMakerImpl.generateRenditions(RenditionMakerImpl.java:210) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.process.CreateThumbnailProcess.createThumbnails(CreateThumbnailProcess.java:119) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.process.ThumbnailProcess.execute(ThumbnailProcess.java:102) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.workflow.compatibility.CQWorkflowProcessRunner.execute(CQWorkflowProcessRunner.java:93) [com.day.cq.workflow.cq-workflow-impl:6.2.12]

  at com.adobe.granite.workflow.core.job.HandlerBase.executeProcess(HandlerBase.java:194) [com.adobe.granite.workflow.core:2.0.168.CQ640-B0006]

  at com.adobe.granite.workflow.core.job.JobHandler.process(JobHandler.java:261) [com.adobe.granite.workflow.core:2.0.168.CQ640-B0006]

  at org.apache.sling.event.impl.jobs.JobConsumerManager$JobConsumerWrapper.process(JobConsumerManager.java:502) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.startJob(JobQueueImpl.java:293) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.access$100(JobQueueImpl.java:60) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl$1.run(JobQueueImpl.java:229) [org.apache.sling.event:4.2.12]

  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

  at java.lang.Thread.run(Unknown Source)

Caused by: javax.jcr.AccessDeniedException: Access denied.

  at org.apache.jackrabbit.oak.jcr.security.AccessManager.checkPermissions(AccessManager.java:71) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl$5.perform(NodeImpl.java:296) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl$5.perform(NodeImpl.java:265) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.perform(SessionDelegate.java:208) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.ItemImpl.perform(ItemImpl.java:112) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl.addNode(NodeImpl.java:265) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at com.adobe.granite.asset.core.impl.AssetImpl.setRenditionResource(AssetImpl.java:328) [com.adobe.granite.asset.core:2.2.56]

  at com.adobe.granite.asset.core.impl.AssetImpl.setRendition(AssetImpl.java:143) [com.adobe.granite.asset.core:2.2.56]

  ... 16 common frames omitted

29.10.2018 15:53:24.617 *ERROR* [JobHandler: /var/workflow/instances/server0/2018-10-25/update_asset_35:/content/dam/we-retail/en/people/mens/moon-2.jpg/jcr:content/renditions/original] com.day.cq.dam.core.impl.AssetImpl addRendition: cannot add new rendition [cq5dam.thumbnail.319.319.png] for asset [/content/dam/we-retail/en/people/mens/moon-2.jpg]:

com.adobe.granite.asset.api.AssetException: Failed to set Rendition [ cq5dam.thumbnail.319.319.png] under /content/dam/we-retail/en/people/mens/moon-2.jpg

  at com.adobe.granite.asset.core.impl.AssetImpl.setRendition(AssetImpl.java:146) [com.adobe.granite.asset.core:2.2.56]

  at com.day.cq.dam.core.impl.AssetImpl.addRendition(AssetImpl.java:523) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.AssetImpl.addRendition(AssetImpl.java:516) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.RenditionMakerImpl$PlanBasedTemplate.apply(RenditionMakerImpl.java:133) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.impl.RenditionMakerImpl.generateRenditions(RenditionMakerImpl.java:210) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.process.CreateThumbnailProcess.createThumbnails(CreateThumbnailProcess.java:119) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.dam.core.process.ThumbnailProcess.execute(ThumbnailProcess.java:102) [com.day.cq.dam.cq-dam-core:5.11.326]

  at com.day.cq.workflow.compatibility.CQWorkflowProcessRunner.execute(CQWorkflowProcessRunner.java:93) [com.day.cq.workflow.cq-workflow-impl:6.2.12]

  at com.adobe.granite.workflow.core.job.HandlerBase.executeProcess(HandlerBase.java:194) [com.adobe.granite.workflow.core:2.0.168.CQ640-B0006]

  at com.adobe.granite.workflow.core.job.JobHandler.process(JobHandler.java:261) [com.adobe.granite.workflow.core:2.0.168.CQ640-B0006]

  at org.apache.sling.event.impl.jobs.JobConsumerManager$JobConsumerWrapper.process(JobConsumerManager.java:502) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.startJob(JobQueueImpl.java:293) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl.access$100(JobQueueImpl.java:60) [org.apache.sling.event:4.2.12]

  at org.apache.sling.event.impl.jobs.queues.JobQueueImpl$1.run(JobQueueImpl.java:229) [org.apache.sling.event:4.2.12]

  at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

  at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

  at java.lang.Thread.run(Unknown Source)

Caused by: javax.jcr.AccessDeniedException: Access denied.

  at org.apache.jackrabbit.oak.jcr.security.AccessManager.checkPermissions(AccessManager.java:71) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl$5.perform(NodeImpl.java:296) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl$5.perform(NodeImpl.java:265) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.perform(SessionDelegate.java:208) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.ItemImpl.perform(ItemImpl.java:112) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at org.apache.jackrabbit.oak.jcr.session.NodeImpl.addNode(NodeImpl.java:265) [org.apache.jackrabbit.oak-jcr:1.8.7]

  at com.adobe.granite.asset.core.impl.AssetImpl.setRenditionResource(AssetImpl.java:328) [com.adobe.granite.asset.core:2.2.56]

  at com.adobe.granite.asset.core.impl.AssetImpl.setRendition(AssetImpl.java:143) [com.adobe.granite.asset.core:2.2.56]

  ... 16 common frames omitted

[smacdonald2008]

Please describe the steps you performed to upload the asset to the AEM Dam.

[sreenu539]

I saw javax.jcr.AccessDeniedException: OakAccess0000: Access denied once I deploy client application code on 6.4.2

Following is the update, what I have been trying after posting above question.

Fresh aem 6.4.2

localhost:4502/aem/start -> assets -> files -> file upload  ---- worked

install client application code (worked in 6.2 aem) - deployed on aem 6.4.2

file upload --- not working. - image is blank.

What I did : edit and sync workflows -> generated client application custom workflows  in new folder structure /conf/global, var/workflow

made code restructuring of etc/workflows into /conf/global, var/workflow

changed references in client application custom workflow from /etc/workflow -> libs/settings/workflows, libs/workflow/scripts/, conf/global, var/workflow ../request_for_activation

I do see instances of upload_asset running in localhost:4502/workflow, I do not see errors ( access denied errors) in error.log file.

I do not see image uploaded though. it is blank. - Any ideas??

[sreenu539]

I do not see my application custom workflows at http://localhost:4502/libs/cq/workflow/content/console.html  why ?

I have custom workflows code below - /conf/global/settings/workflow/dam/my-dam/ ....

I have changed code references

FROM  workflow="/etc/workflow/models/dam/my-dam/dam-assets-custom-writeback/jcr:content/model"/>

TO   workflow="/conf/global/settings/workflow/models/dam/my-dam/dam-assets-custom-writeback/jcr:content/model"/>

I do not see any node called "model" below "/conf/global/settings/workflow/models/dam/my-dam/dam-assets-custom-writeback/jcr:content"

please help me.

[sreenu539]

Any one from AEM Experts group about workflow restructuring and references and issues I am facing ?

[smacdonald2008]

Is the instance where you are not seeing your custom workflow the updated instance?

If something works as it should not a Fresh instance - but not on a upgraded instance - looks like the update progress introduced a bug somewhere.

If you have it working on a Fresh 6.4 install - and it works - this informs you that you implemented your use case correctly.

For the updated instance - you may need a hotfix installed on that instance.

[sreenu539]

Is there anything changed in gate keeper process , renditions are not generated and renditions workflow step throwing access denied exceptions.

[Andras_Fejer]

I have also encountered this issue on an AEM 6.5 instance after upgrading from AEM 6.2 (fresh install). Apparently  this issue was caused in our case due to using the crx2oak migration tool to migrate content-pages and assets. It turned out that for some reason the user "workflow-process-service" lost all the ACL permissions on the node "/content" which it requires to complete the DAM asset update workflow.