Sun Java System Access Manager - Delegation plugin errors on AM 7.1 Realm mode

Hello,

I am trying to create a user in Sun Access Manager 7.1 (installed in realm mode) from Sun Identity Manager 7.0. I have configured the default Realm resource adapter with amadmin credentials for the root realm. However, when I try to create a user from IdM and associate the AM realm resource, the creation fails with the following error.

com.waveset.util.WavesetException: An error occurred crea

ting user. com.sun.identity.idm.IdRepoException: Permission to perform the create operation denied to uid=amAdmin,ou=People,d

c=example,dc=com

I also see this error message in "amIdm" log file.

03/27/2007 03:38:18:669 PM EDT: Thread[Provisioning for Configurator,5,main]

ERROR: IdServicesImpl.checkPermission Got Delegation Exception:

com.sun.identity.delegation.DelegationException(1):The user does not have permission to perform the operation.

com.sun.identity.sm.SMSException(2):The user does not have permission to perform the operation.

Message:The user does not have permission to perform the operation.

at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)

at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)

Now, AM 7.1 documents talk about a Delegation plugin through which realm administration can happen. However, this code is not public.

If any one has faced this issue, please help me out.

Thanks,

Srinivas

[1611 byte] By [srinivask__jesa] at [2007-11-26 23:08:49]
# 1
Hi Srini,Does creation as "cn=Directory Manager" works ? If yes then I would say check the aci. Can you put your DS in logging mode ? If yes then see what happens, when you try to create a user, in error log.HTH,Vivek
Vivek.Gupta.eToucha at 2007-7-10 14:03:41 > top of Java-index,Web & Directory Servers,Directory Servers...
# 2

The resource adapter works just fine when the realm is in on a realm which has the data source amSDK by creating a referral policy.

I am getting the same error whe trying to plug in a LDAPv3 as data source. I see in the log that it tries to access an application/role resource.

Does anyone know if the resource adapter is supported for realm with the data source a plain LDAPv3 with no goodies from the AM Schema?

If yes, what need to be done to cope with that error?

nolemea at 2007-7-10 14:03:41 > top of Java-index,Web & Directory Servers,Directory Servers...
# 3
Why don't you provision directly to the LDAP v3 user store from IDM instead of indirectly through Access Manager?
Aaron_Andersona at 2007-7-10 14:03:41 > top of Java-index,Web & Directory Servers,Directory Servers...
# 4

Why don't you provision directly to the LDAP v3 user

store from IDM instead of indirectly through Access

Manager?

That was my backup plan :) I would still like to know if a LDAP v3 data source is supported.

A realm is an abstraction above the datasource. So if you configure a realm through the access manager its data source is "hidden". In the case of the LDAP adapter, one is actually dependent on the specific LDAP server.

All LDAP servers are not created equal (the old story with standards compliat products :), e.g. some don't support roles/filtered roles. This is why I was a bit surprised when the log showed a query over the realm administrator rights to administer roles. Probably the adapter tries to retrieve all roles/users/groups and assumes backing data source has this capability.

Now... why the designated realm admin (which otherwise works just fine from the AM console) doesn't have rights on the roles (even when the data source is a Sun DS with AM schema and the roles are added to the capabilities via configuration) would be another question.

nolemea at 2007-7-10 14:03:41 > top of Java-index,Web & Directory Servers,Directory Servers...