Using Buildforge 7x to RTC 3x build definition get API: Access denied

Andy Jewell (242●3●63●74) | asked Jul 10 '13, 8:05 p.m.
edited Jul 10 '13, 8:06 p.m.

Having finally got our RTC project connected to our Build Forge server, I get this while trying to run a build through the RTC build definition:

com.ibm.team.build.common.TeamBuildException: Error sending request "Create build for project af530bd50c621000ca2dd3c675547554" to Build Forge server at "172.172.172.172:3966" for build engine id "BF": API: Access denied.
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeConnection.createTeamBuildException(BuildForgeConnection.java:132)
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeConnection.runAsRetryable(BuildForgeConnection.java:99)
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeConnection.createBuild(BuildForgeConnection.java:430)
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeBuildLoopRunnable.startBuildForgeProject(BuildForgeBuildLoopRunnable.java:245)
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeBuildLoopRunnable.run(BuildForgeBuildLoopRunnable.java:193)
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeBuildLoopScheduledTask.runTask(BuildForgeBuildLoopScheduledTask.java:71)
	at com.ibm.team.repository.service.async.AbstractAutoScheduledTask.executeTask(AbstractAutoScheduledTask.java:88)
	at sun.reflect.GeneratedMethodAccessor129.invoke(Unknown Source)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:37)
	at java.lang.reflect.Method.invoke(Method.java:611)
	at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord.invoke(ExportProxyServiceRecord.java:361)
	at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord.access$0(ExportProxyServiceRecord.java:347)
	at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord$ExportedServiceInvocationHandler.invoke(ExportProxyServiceRecord.java:56)
	at $Proxy487.executeTask(Unknown Source)
	at com.ibm.team.repository.service.internal.scheduler.AsynchronousTaskRunner.runTask(AsynchronousTaskRunner.java:158)
	at com.ibm.team.repository.service.internal.scheduler.AsynchronousTaskRunner.run(AsynchronousTaskRunner.java:119)
	at java.lang.Thread.run(Thread.java:738)
Caused by: com.buildforge.services.common.api.APIException: Message[uuid=null, timestamp=1373498694, userUuid=, processId=0, severity=ERROR, type=, componentUuid=null, messageKey=APIAccessDenied, indirectionMask=0, args={}]
	at com.buildforge.services.client.api.APIClientConnection.call(APIClientConnection.java:607)
	at com.buildforge.services.client.dbo.Build.create(Build.java:569)
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeConnection$4.run(BuildForgeConnection.java:437)
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeConnection$4.run(BuildForgeConnection.java:1)
	at com.ibm.rational.buildforge.team.internal.service.BuildForgeConnection.runAsRetryable(BuildForgeConnection.java:95)
	... 15 more

Here's something interesting that may provide a clue: when I first set up the Environment on Build Forge to use the Jazz source code adapter, I had the wrong repository set. So when I ran it, I got an error that said:

2013-07-10 16:09:48 [Jazz build engine] Searching for buildResultUUID=_woYl4Om1EeKyK_0LrHLRhA
2013-07-10 16:09:48 [Jazz build engine] The -noComplete argument was specified. The build result will not be completed by JBE.
2013-07-10 16:09:48 [Jazz build engine] Building only the specified participants: "[com.ibm.team.build.jazzscm]"
2013-07-10 16:09:48 [Jazz build engine] Not using a proxy to reach https://ourrepo-address.org:9443/ccm
2013-07-10 16:09:51 [Jazz build engine] CRRTC3526W: Warning: The build engine is either not in the repository, or it cannot be accessed by the following user: "O386600". The UUID of the build engine is "_uUlzwOm0EeK3_LMAcS2E1w". For more details, open the help system and search for CRRTC3526W.
2013-07-10 16:09:51 [Jazz build engine] No requests found.
2013-07-10 16:09:51 [Jazz build engine] Exiting JBE after completing single build request, RC=1.
CRRTC3529W: The execution of Jazz Build Engine completed with a non-zero return code (RC=1). For more details, open the help system and search for CRRTC3529W.
ENDBFBomPlaceholder425838192bomp2

So this one is easy enough to understand. The point is that this was reported as an error for that particular step. The first error message (the one I'm having trouble with, above), is reported under the RTC build engine log as a ServerRunTimeError - yet, I don't get any step-related logs. It seems that once I advance to the point of connecting to RTC from the build agent, something happens that causes the server enough anxiety to completely abort and to throw an exception rather than report a step-related error.

Any ideas??

- Andy

Accepted answer

permanent link

Spencer Murata (2.3k●11●59●71) | answered Jul 11 '13, 11:12 a.m.
FORUM MODERATOR / JAZZ DEVELOPER

The APIAccessDenied is an authentication problem. Check that the user who is connecting to Build Forge has the right username/password. Then check that the user isn't locked in Build Forge.

The JBE wrong repository shouldn't have a bearing on this since it is strictly RTC and RTC authentication. The JBE execution only happens after the build is started in BF, and the first error indicates that we have the API auth failure before we can connect to BF and start the build via the services layer.

~Spencer

Andy Jewell selected this answer as the correct answer

Comments

Andy Jewell commented Jul 11 '13, 11:48 a.m.

Thanks, Spencer! I included the information about the repository information because it's actually somehow opposite as one would expect. The build does start and on the build agent it creates an appropriate folder under the build root directory. The BF Agent log provides some information that looks like it's authenticating with something (I'm not sure what).

If I run a straight JBE build, it works. On the other hand, if I run a non-RTC BF job, it works. Can you think of any test case I could set up that would narrow the issue?

Andy Jewell commented Jul 11 '13, 1:40 p.m.

Hmm, I take that back. I tried to replicate the error I got before the APIAccessDenied serverruntime error and was unable to so maybe something else is going on.

Spencer Murata commented Jul 11 '13, 1:48 p.m.

FORUM MODERATOR / JAZZ DEVELOPER

So as far as the second error, the engineUUID SHOULD be valid since BF sets that value before the build. So look at the build log in Build Forge and verify that the engineUUID environment variable exists and is set to something that looks like a UUID. I'm going to assume that the user O386600 has access to the Build Forge engine on RTC.

~Spencer

Kevin Ramer commented Jul 30 '13, 10:01 p.m.

Two of our freshly upgraded to 4.0.3 RTC repositories are reporting this on a frequent basis. Funny thing is that on one repository two of the now failing builds SUCCEEDED once before failures started. I've been so involved with RTC of late I've forgotten almost all the Build Forge I knew. In addition to an exception with strong similarity to OP, there is a complaint about missing metadata

[ https://jazz.net/forum/questions/90548/illegalstateexception-inverse-metadata-missing-for-item-uuid-_9j4b8juqeegrragux4ocxg ]

Spencer Murata commented Jul 31 '13, 8:12 a.m.

FORUM MODERATOR / JAZZ DEVELOPER

You might try creating a new BF user and setting the RTC BF engine creds to that brand new user. That way you can ensure that no one else is doing anything with that user and make sure that there isn't some kind of mix up with different creds trying to connect to BF from RTC.

~Spencer

Andy Jewell commented Jul 31 '13, 11:36 a.m. | edited Jul 31 '13, 11:57 a.m.

@Spencer: regarding a new BF user. I'm not sure if I can (within the logistics of our support group) but I'll try. Here's something else I noticed about this problem: I recreated it but setting up a brand new build definition, new BF project, new workspace, etc. It worked the first time (as far as connecting to BF, getting logs, etc) but again get the API Denied error on subsequent attempts - exactly like my original problem. The BF admin asked if I was using lscm because he was not seeing a logout so I wonder if somehow the adapter doesn't break the RTC connection so it works once - an only once.

Andy Jewell commented Jul 31 '13, 11:57 a.m.

@Spencer: regarding the engineUUID - I only get that on the very first attempt. The subsequent attempts where I'm getting the APIDenied error, there are no BF logs whatsoever.

Kevin Ramer commented Aug 01 '13, 11:18 a.m.

@Spencer
After our session yesterday ( we did NOT try to update build defs with new ID) the builds could begin but RTC wasn't updating likely because the build definition was using different BF id and could not update the in-flight build started by another ID.

We suggested users reset password on the RTC BE with 4.0.3 client. No help. A new build engine was defined and attached to build which is executing properly.

Andy Jewell commented Oct 08 '13, 2:37 p.m.

Ultimately, the problem was that the build definition was locking the Build Forge account. Our communication between the users (us) and the Build Forge administrators is not that fluid so it took a while to figure that out. Still a mystery why it would always work that first time but fail subsequently. Also discovered at this time, as well, that any BF connection will somehow do a "keep alive" ping since this account was being locked regardless of whether any builds were being requested.

Kevin Ramer commented Dec 11 '13, 2:29 p.m.

My observation(s) of late: We have several RTC projects (different repos) trying to use our build forge server. MANY builds are getting this API: Access denied even though the Build Engine Test works fine. Observing the BF_USERS table only 1 ID is changing with respect to the BF_FAILCOUNT -- root. But no build engines are using root ID (might have used to force an update on the Build Engine). RTC server A is reporting API: Access denied frequently, while RTC server B IS ALSO IMPACTED.

Kevin Ramer commented Dec 11 '13, 3:00 p.m.

The BF_FAILCOUNT increases when rtc server logs a message also containing "API: Access denied" Blocking ALL API access based on one failing ID, apparently.

showing 5 of 11 show 6 more comments

3 other answers

Most liked answers ↑|Newest answers|Oldest answers

permanent link

praveen patidar (86●2●35●44) | answered Dec 11 '13, 5:55 p.m.

Hi All,

After a long test runs I ultimately got success in the issue. Actually I had more then one build engine each with different build userid. After Access Denied lets say I did expire the password for user, reset via RBF web console and again triggered the build as soon as I am using the same build engine it worked fine. The moment I trigger the different build engine the first one start getting the API access denied.

Simple resolution is to have only one user for all the build engine. Also if you have less user license then make the user used for build as priority user. That allow the build user to access the buld forge even all licenses occupied. Also if build user logged in , it will not be logged out by someone else.

- Make user as priority
- Use only one user for all build engine.

permanent link

praveen patidar (86●2●35●44) | answered Nov 19 '13, 9:17 p.m.

Hello ,

I am getting the issue in RTC4.0.3 with all users. my build forge is 7.1.3.3. And I all working till day before. Suddenly the issue appears. I used some builduser account got issue. Then I used my account I got success in first time and thats it it fails from next onward. I check my login and manual trigger as well. Its working fine.

Not I used root users but same happening with root user as well. If there is access issue why the root user also getting the issue.

permanent link

Nick Edgar (6.5k●7●11) | answered Jun 11 '14, 12:47 p.m.
JAZZ DEVELOPER

From Investigate "API: Access Denied" error in Build Forge builds (302262):

We discovered that BF can return APIAccessDenied instead of APILoginFailed if the request fails due to an expired session. The session timeout can be changed, or disabled, in the BF system settings. It's unclear why the session was timing out though.

There's a fix in 5.0.1 in item 317575.

Your answer

Register or log in to post your answer.

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

It's all about the answers!

Related questions

Using Buildforge 7x to RTC 3x build definition get API: Access denied

Accepted answer

3 other answers

Your answer