CRJAZ1484I - Developer unable to access the Web UI

Any thoughts anyone?


Long shot - are you using LDAP/Active Directory to manage importing users into RTC? If so, has the user been set up on the correct AD group (JazzUsers - you should see this box ticked on the User Management page of the WebUI)? You can't add the user from the WebUI, you need Network Admins to add the user to the AD group.

I agree with Alan's suggestion (except I would say "this is the reason"
as opposed to "this is a long shot" :-).

The key phrase in the error message is "does not belong to the groups".

There are several things that affect what you have read access to:
- the repository groups you are assigned to
- the licenses that you have been assigned
- the access control on the object you are trying to access

For write access, it is all of those things plus the process permissions
you have on that object.

So in this case, the problem is the "repository group", not the
licenses. As Alan says, make sure that user is a member of the
JazzUsers repository group, which when you are using LDAP, requires that
he be a member of the appropriate LDAP group.

Cheers,
Geoff

On 3/24/2011 10:53 AM, bwbarnes wrote:

Hello -

We have added a new developer to our team and he is unable to access
the Web UI. Even accessing the following:

/ccm/web#action=jazz.viewPage&id=com.ibm.team.process.projectAreaList

produces this error:

You are not authorized to view this page.
CRJAZ1484I Your account does not belong to the groups that are
authorized to access the Web UI. Please contact your server
administrator.

Looking at the "Client Access Licenses," he has the
following:

Rational Team Concert - Developer for IBM Enterprise Platforms
Unlocked - 35 available

He gets the same error when attempting to access the team project area
(and he is a member of the team with the "Team Member"
role).

We had this problem before with our contributors, but we fixed it by
changing the "Access Control" for our project area to
"Grant read access to: Everyone."

What is particularly strange is that I have the exact same permissions
(as far as I can tell), but I do not get this error.

Any thoughts anyone?


-------------------------------
Here is our version information:

Build Information Version Build ID
Change and Configuration Management - Core
Libraries 3.0 RTC-I20101112-1731
Jazz Foundation - Core Libraries 3.0 RJF-I20101112-0630
About the Rational Jazz Team Server

Build Information Version Build ID
Jazz Foundation - Core Libraries 3.0 RJF-I20101112-0630
Client Access License Types Assigned to user West Barnes
Product Variant Type
Rational Team Concert Unlocked Developer for IBM Enterprise Platforms

Thanks for the suggestions.

We are not using an LDAP for managing the JazzUsers group. We had the WebSphere security setting, set to "All Authenticated in Application's Realm." Just for testing I changed it to "Everyone" and restarted the server. Still no luck.

I would have been surprised if this worked since things were working fine with the previous setting. I have been unable to determine what changed that caused this new behavior.

Any other thoughts?

Geoffrey et al:

I am seeing the same problem. We are running RTC 3.0 on Tomcat. My developer is a member of the JazzUsers group in AD, and has a floating developer license under lease.

Still, when she tries to upload a file to the stream using the Web UI, she gets this error message.

West - were you able to resolve this problem in the end?

Thanks.

There is another thread where people are discussing the same issue.

http://jazz.net/forums/viewtopic.php?t=15918

FYI - my developer meets all 3 criteria: 1) membership in JazzUsers 2) appropriate developer license 3) membership in project area.

If the user belongs to the right repository group, then please report
this as a bug. Minimally, the error message is incorrect/misleading.

Cheers,
Geoff

On 4/5/2011 2:53 PM, ianonymous wrote:

Geoffrey et al:

I am seeing the same problem. We are running RTC 3.0 on Tomcat. My
developer is a member of the JazzUsers group in AD, and has a
floating developer license under lease.

Still, when she tries to upload a file to the stream using the Web UI,
she gets this error message.

West - were you able to resolve this problem in the end?

Thanks.

If the user belongs to the right repository group, then please report
this as a bug. Minimally, the error message is incorrect/misleading.

Cheers,
Geoff

On 4/5/2011 2:53 PM, ianonymous wrote:

Geoffrey et al:

I am seeing the same problem. We are running RTC 3.0 on Tomcat. My
developer is a member of the JazzUsers group in AD, and has a
floating developer license under lease.

Still, when she tries to upload a file to the stream using the Web UI,
she gets this error message.

West - were you able to resolve this problem in the end?

Thanks.

If you are using AD or LDAP, make sure that LDAP users are sync'ed into RTC. Not sure if "repotool syncuser (?)" still workd?

If you are using WebSphere managed users, make sure the same user id's are created in RTC.

The RTC documentation does not mention that user ids must be "created" within RTC.

Internally, creating users using (embedded) Tomcat automatically creates a user in RTC.

If the user belongs to the right repository group, then please report
this as a bug. Minimally, the error message is incorrect/misleading.

Cheers,
Geoff

On 4/5/2011 2:53 PM, ianonymous wrote:

Geoffrey et al:

I am seeing the same problem. We are running RTC 3.0 on Tomcat. My
developer is a member of the JazzUsers group in AD, and has a
floating developer license under lease.

Still, when she tries to upload a file to the stream using the Web UI,
she gets this error message.

West - were you able to resolve this problem in the end?

Thanks.

If you are using AD or LDAP, make sure that LDAP users are sync'ed into RTC. Not sure if "repotool syncuser (?)" still workd?

If you are using WebSphere managed users, make sure the same user id's are created in RTC.

The RTC documentation does not mention that user ids must be "created" within RTC.

Internally, creating users using (embedded) Tomcat automatically creates a user in RTC.

We are also seeing this at our company. We are using RTC v2.0.0.2 with iFix4. We have Active Directory and use LDAP. We use Tomcat on the RTC server.

Everything was going fine, until this morning (4/9/11) when a user reported the symptoms that the original poster here reported.

He sees this error message in the Web UI for RTC:

"Error fetching change set: Your account does not belong to the groups that are authorized to access the Web UI. Please contact your server administrator. - Error code 403"

I checked the log on the RTC server and I see a LOT of PermissionDeniedException messages for many of our users. Most users here use the Eclipse or Visual Studio client. (Maybe they handle this issue better than the Web UI?)

I already did what was suggested in the previous posts in this article and the user reporting the issue is in the right LDAP group and a member of the correct team and project. I am thinking of asking to have the RTC server rebooted to see if that helps.

Here is part of the "stdout" log on the RTC server here. The whole log is 11MB in size. (I can't access the real jazz.log so this is the closest I have to it that I can look at):

======

12:01:18,021 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I PermissionDeniedException processing GET request for com.ibm.team.filesystem.common.internal.rest.IFilesystemRestService.getChangeSet(). CRJAZ1170I The request was made by user "dflannigan" from "10.1.98.89". CRJAZ1167I The stack trace hash is 7DA9D7E9BCDC631D8C08A4F61EA2B1DDD4931FA8, use it to locate the previously logged stack trace at Fri Apr 08 12:01:06 EDT 2011.
12:01:21,349 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I PermissionDeniedException processing GET request for com.ibm.team.filesystem.common.internal.rest.IFilesystemRestService.getChangeSet(). CRJAZ1170I The request was made by user "dflannigan" from "10.1.98.89". CRJAZ1166I The stack trace hash is E9040660B4966BF3A7ABA74CDD8B2FDED8558BA8.
com.ibm.team.repository.common.PermissionDeniedException: CRJAZ1316I Illegal read access: User "dflannigan" attempted to read item(s) having the following type(s): Workspace
at com.ibm.team.repository.service.internal.ComponentRepositoryItemService.fetchItem(ComponentRepositoryItemService.java:498)
at com.ibm.team.filesystem.service.internal.rest.FilesystemRestService.getChangeSet0(FilesystemRestService.java:121)
at com.ibm.team.filesystem.service.internal.rest.FilesystemRestService.access$0(FilesystemRestService.java:105)
at com.ibm.team.filesystem.service.internal.rest.FilesystemRestService$1.run(FilesystemRestService.java:99)
at com.ibm.team.filesystem.service.internal.rest.FilesystemRestService$1.run(FilesystemRestService.java:1)
at com.ibm.team.repository.service.internal.TransactionService$1.run(TransactionService.java:104)
at com.ibm.team.repository.service.internal.rdb.RepositoryDatabase$Transaction.run(RepositoryDatabase.java:466)
at com.ibm.team.repository.service.internal.rdb.RepositoryDatabase$1.run(RepositoryDatabase.java:292)
at com.ibm.team.repository.service.internal.rdb.ConnectionPoolService.withCurrentConnection(ConnectionPoolService.java:331)
at sun.reflect.GeneratedMethodAccessor63.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:618)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord.invoke(ExportProxyServiceRecord.java:370)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord.access$0(ExportProxyServiceRecord.java:356)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord$ExportedServiceInvocationHandler.invoke(ExportProxyServiceRecord.java:56)
at $Proxy22.withCurrentConnection(Unknown Source)
at com.ibm.team.repository.service.internal.rdb.RepositoryDatabase.runTransaction(RepositoryDatabase.java:288)
at com.ibm.team.repository.service.internal.rdb.RepositoryDatabase.runInTransaction(RepositoryDatabase.java:244)
at com.ibm.team.repository.service.internal.TransactionService.runInTransaction(TransactionService.java:79)
at com.ibm.team.repository.service.internal.TransactionService.runInTransaction(TransactionService.java:68)
at sun.reflect.GeneratedMethodAccessor113.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:618)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord.invoke(ExportProxyServiceRecord.java:370)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord.access$0(ExportProxyServiceRecord.java:356)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord$ExportedServiceInvocationHandler.invoke(ExportProxyServiceRecord.java:56)
at $Proxy45.runInTransaction(Unknown Source)
at com.ibm.team.repository.service.AbstractService.runInTransaction(AbstractService.java:772)
at com.ibm.team.filesystem.service.internal.rest.FilesystemRestService.getChangeSet(FilesystemRestService.java:97)
at sun.reflect.GeneratedMethodAccessor2449.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:618)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord.invoke(ExportProxyServiceRecord.java:370)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord.access$0(ExportProxyServiceRecord.java:356)
at org.eclipse.soda.sat.core.internal.record.ExportProxyServiceRecord$ExportedServiceInvocationHandler.invoke(ExportProxyServiceRecord.java:56)
at $Proxy281.getChangeSet(Unknown Source)
at sun.reflect.GeneratedMethodAccessor2448.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:618)
at com.ibm.team.repository.servlet.AbstractTeamServerServlet.doModelledRestService(AbstractTeamServerServlet.java:571)
at com.ibm.team.repository.servlet.AbstractTeamServerServlet.handleRequest2(AbstractTeamServerServlet.java:1771)
at com.ibm.team.repository.servlet.AbstractTeamServerServlet.handleRequest(AbstractTeamServerServlet.java:1642)
at com.ibm.team.repository.servlet.AbstractTeamServerServlet.service(AbstractTeamServerServlet.java:1555)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
at org.eclipse.equinox.http.registry.internal.ServletManager$ServletWrapper.service(ServletManager.java:180)
at org.eclipse.equinox.http.servlet.internal.ServletRegistration.handleRequest(ServletRegistration.java:90)
at org.eclipse.equinox.http.servlet.internal.ProxyServlet.processAlias(ProxyServlet.java:111)
at org.eclipse.equinox.http.servlet.internal.ProxyServlet.service(ProxyServlet.java:75)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
at org.eclipse.equinox.servletbridge.BridgeServlet.service(BridgeServlet.java:121)
at com.ibm.team.repository.server.servletbridge.JazzServlet.service(JazzServlet.java:54)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:269)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:188)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:213)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:172)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:525)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:117)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:108)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:174)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:873)
at org.apache.coyote.http11.Http11BaseProtocol$Http11ConnectionHandler.processConnection(Http11BaseProtocol.java:665)
at org.apache.tomcat.util.net.PoolTcpEndpoint.processSocket(PoolTcpEndpoint.java:528)
at org.apache.tomcat.util.net.LeaderFollowerWorkerThread.runIt(LeaderFollowerWorkerThread.java:81)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:689)
at java.lang.Thread.run(Thread.java:811)
12:03:23,199 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I PermissionDeniedException processing GET request for com.ibm.team.filesystem.common.internal.rest.IFilesystemRestService.getChangeSet(). CRJAZ1170I The request was made by user "dflannigan" from "10.1.98.89". CRJAZ1167I The stack trace hash is E9040660B4966BF3A7ABA74CDD8B2FDED8558BA8, use it to locate the previously logged stack trace at Fri Apr 08 12:01:21 EDT 2011.
12:09:53,294 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I PermissionDeniedException processing POST request for com.ibm.team.repository.common.service.IPermissionService.assertPermission(). CRJAZ1170I The request was made by user "kbrandowpsolla" from "10.1.10.101". CRJAZ1167I The stack trace hash is D9E3B63196B55B2D15D7DF9DE5CC7772D68FCD1A, use it to locate the previously logged stack trace at Tue Mar 15 10:33:04 EDT 2011.
12:10:11,889 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I processing POST request for com.ibm.team.repository.common.service.IPermissionService.assertPermission(). CRJAZ1170I The request was made by user "kbrandowpsolla" from "10.1.10.101". CRJAZ1167I The stack trace hash is D9E3B63196B55B2D15D7DF9DE5CC7772D68FCD1A, use it to locate the previously logged stack trace at Tue Mar 15 10:33:04 EDT 2011.
12:20:11,293 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I ItemNotFoundException processing GET request for interface com.ibm.team.workitem.common.internal.model.IImageContentService.get(). CRJAZ1170I The request was made by user "thyatt" from "10.255.254.165". CRJAZ1167I The stack trace hash is 8D346D610D8C7A3D790890AFCFCB1AB8E09F7D99, use it to locate the previously logged stack trace at Sun Mar 13 19:53:57 EDT 2011.
12:20:11,418 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I ItemNotFoundException processing GET request for interface com.ibm.team.workitem.common.internal.model.IImageContentService.get(). CRJAZ1170I The request was made by user "thyatt" from "10.255.254.165". CRJAZ1167I The stack trace hash is 9F876134E5750A12AF0C743B6A21C01D18BA6ABC, use it to locate the previously logged stack trace at Sun Mar 13 19:53:57 EDT 2011.
12:20:11,512 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I ItemNotFoundException processing GET request for interface com.ibm.team.workitem.common.internal.model.IImageContentService.get(). CRJAZ1170I The request was made by user "thyatt" from "10.255.254.165". CRJAZ1167I The stack trace hash is 5572A279F8190E03D4B92377C1E4DEBEE187BD72, use it to locate the previously logged stack trace at Sun Mar 13 19:53:57 EDT 2011.
12:20:12,918 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I ItemNotFoundException processing GET request for interface com.ibm.team.workitem.common.internal.model.IImageContentService.get(). CRJAZ1170I The request was made by user "thyatt" from "10.255.254.165". CRJAZ1167I The stack trace hash is 8D4722B48066780D1BCBF882AC462629891BAE83, use it to locate the previously logged stack trace at Sun Mar 13 19:54:00 EDT 2011.
12:20:12,981 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I ItemNotFoundException processing GET request for interface com.ibm.team.workitem.common.internal.model.IImageContentService.get(). CRJAZ1170I The request was made by user "thyatt" from "10.255.254.165". CRJAZ1167I The stack trace hash is 5889EF24D97B1A922A2DFDC161E9CBA7A95886BE, use it to locate the previously logged stack trace at Sun Mar 13 19:54:00 EDT 2011.
12:20:13,059 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I ItemNotFoundException processing GET request for interface com.ibm.team.workitem.common.internal.model.IImageContentService.get(). CRJAZ1170I The request was made by user "thyatt" from "10.255.254.165". CRJAZ1167I The stack trace hash is F20400F8C7F3C16F29ACC01C78D3502F04CDDA66, use it to locate the previously logged stack trace at Sun Mar 13 19:54:00 EDT 2011.
12:23:39,616 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I PermissionDeniedException processing GET request for com.ibm.team.filesystem.common.internal.rest.IFilesystemRestService.getChangeSet(). CRJAZ1170I The request was made by user "dflannigan" from "10.1.98.89". CRJAZ1167I The stack trace hash is E9040660B4966BF3A7ABA74CDD8B2FDED8558BA8, use it to locate the previously logged stack trace at Fri Apr 08 12:01:21 EDT 2011.
12:24:35,338 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I PermissionDeniedException processing GET request for com.ibm.team.filesystem.common.internal.rest.IFilesystemRestService.getChangeSet(). CRJAZ1170I The request was made by user "dflannigan" from "10.1.98.89". CRJAZ1167I The stack trace hash is E9040660B4966BF3A7ABA74CDD8B2FDED8558BA8, use it to locate the previously logged stack trace at Fri Apr 08 12:01:21 EDT 2011.
12:25:05,823 INFO ervice.internal.userregistry.ldap.LDAPUserRegistry - Connected to LDAP directory "ldap://CAREMEDIC.NET:389".
12:25:42,591 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I PermissionDeniedException processing GET request for com.ibm.team.filesystem.common.internal.rest.IFilesystemRestService.getChangeSet(). CRJAZ1170I The request was made by user "dflannigan" from "10.1.98.89". CRJAZ1167I The stack trace hash is E9040660B4966BF3A7ABA74CDD8B2FDED8558BA8, use it to locate the previously logged stack trace at Fri Apr 08 12:01:21 EDT 2011.
12:25:56,904 WARN .team.repository.servlet.AbstractTeamServerServlet - CRJAZ1163I PermissionDeniedException processing GET request for com.ibm.team.filesystem.common.internal.rest.IFilesystemRestService.getChangeSet(). CRJAZ1170I The request was made by user "dflannigan" from "10.1.98.89". CRJAZ1167I The stack trace hash is E9040660B4966BF3A7ABA74CDD8B2FDED8558BA8, use it to locate the previously logged stack trace at Fri Apr 08 12:01:21 EDT 2011.

============

Any input / advice is appreciated.

Thanks,

-Walter

Work item created:

http://jazz.net/jazz/web/projects/Rational%20Team%20Concert#action=com.ibm.team.workitem.viewWorkItem&id=160855

An observation on this: I received the same message when I tried to delete a Predefined Query from the web UI of a project. I was missing the "Save Project Area" permission on this project. I do believe, in my case, that the message was not accurately describing the error.