000013054 - This token type is not allowed error in RSA Authentication Manager 8.x Self-Service Console

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support on Apr 12, 2019
Version 3Show Document
  • View in full screen mode

Article Content

Article Number000013054
Applies ToRSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition:  8.x
IssueThe error following message shows in the Self-Service Console when requesting a token:


The <hostname>_server.log is located in /opt/rsa/am/server/logs.  It will show the following error while creating a self-service request for enrollment with hardware token:
com.rsa.command.exception.InvalidArgumentException: This token type is not allowed in UCM
   at weblogic.rjvm.ResponseImpl.unmarshalReturn(ResponseImpl.java:217)
   at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:338)
   at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:252)
   at com.rsa.command.CommandServer_qt4u4w_EOImpl_1000_WLStub.executeFrameworkManagedTx(Unknown Source)
   at com.rsa.command.EJBRemoteTargetBase$CommandExecutor.run(EJBRemoteTargetBase.java:219)
   at com.rsa.command.EJBRemoteTargetBase$CommandExecutor.run(EJBRemoteTargetBase.java:168)
   at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:363)
   at weblogic.security.service.SecurityManager.runAs(Unknown Source)
  at weblogic.security.Security.runAs(Security.java:61)
CauseBefore using the self-service-request samples you must first configure the desired setting for how your self-service system will work. 

The file in question come with the RSA Authentication Manager 8.x SDK that is available in the extras.zip.  Review 000034558 - How to download RSA Authentication Manager 8.x full kits and service packs from RSA Link for steps to download.

These settings are found in the Security Console under Setup > Self Service Settings > Manage Authenticators in RSA Authentication Manager 8.x and above


This error can also happen when not using the SDK.  A customer can set up Credential Manager > Manage Tokens to allow users to request one type of token (for example, Desktop PC 4.0) but when the user goes to the Self-Service Console he selects Generic AES.  Since this is not an approved token type, the error message of "This token type is not allowed in UCM" will display.  To resolve the issue simply add the correct token type.
ResolutionThis specific error is cause because the sample code generates a request for a hardware token but the self-service system (Credential Manager) has not been configured to enable hardware tokens to be requested.  This option is handled on the Manage Tokens link under the Token Provisioning section and the option to allow users to
WorkaroundA workaround would be to run the SDK example code CreateSelfServiceRequest.class.
Legacy Article IDa50271