How does the Access Manger Help Desk Admin work
3 years ago
Originally Published: 2009-04-16
Article Number
000046964
Applies To
RSA Access Manager 6.0.4
RSA Access Manager Entitlements Manager (AdminGUI)
Issue
How does the Access Manger Help Desk Admin work

Following error shows in Entitlements Manger when trying to modify the user lockout status of a user:

Not authorized (RC_NOT_AUTHORIZED): Insufficient permission for modify entity user1


Eserver debug output shows the following error message:

13:57:14:671 [*] [APIClientProxy-0] - Thread requesting stream.
sirrus.da.exception.PermissionDeniedException: Insufficient permission for modify entity user1
 at sirrus.da.admin.User.setAdminLockedout(User.java:1273)
 at sirrus.api.adaptors.objects.APIUserAdaptor.fillInUserData(APIUserAdaptor.java:432)
 at sirrus.api.command.write.SaveUserCmd.execute(SaveUserCmd.java:84)
 at sirrus.api.command.APICmdStrategy.executeCmd(APICmdStrategy.java:209)
 at sirrus.api.command.APICmdStrategy.executeOn(APICmdStrategy.java:89)
 at sirrus.util.strategy.StrategyManager.executeStrategyFor(StrategyManager.java:141)
 at sirrus.api.server.APIClientProxy.executeCmd(APIClientProxy.java:1003)
 at sirrus.api.server.APIClientProxy.run(APIClientProxy.java:742)
13:57:14:671 [*] [APIClientProxy-0] - Thread requesting stream.
Not authorized (RC_NOT_AUTHORIZED): Insufficient permission for modify entity user1
 at sirrus.api.command.APICmdStrategy.executeCmd(APICmdStrategy.java:214)
 at sirrus.api.command.APICmdStrategy.executeOn(APICmdStrategy.java:89)
 at sirrus.util.strategy.StrategyManager.executeStrategyFor(StrategyManager.java:141)
 at sirrus.api.server.APIClientProxy.executeCmd(APIClientProxy.java:1003)
 at sirrus.api.server.APIClientProxy.run(APIClientProxy.java:742)
13:57:14:671 [*] [APIClientProxy-0] - Return code is 4 msg is Not authorized (RC_NOT_AUTHORIZED): Insufficient permission for modify entity user1


Cause
The Role to edit passwords only provides rights to change the users passwords.  No other rights to the user object are provided with this role.  In order to change the users lockout status you must assign the "Edit" "Users" role as well.
Resolution
Access Manager includes a special built in administrator object specifically for managing passwords and user lockout status. This object is called "Help Desk Admin" and is available as a check-box on the user page after promoting a user to an administrator.  Administrators that are Help Desk Admins automatically get the rights to change passwords and change user lockout status regardless of any other roles.  As with any administrator you must also assign an administrative role to the user.  For help desk users it is typical to create an empty role that does not have any additional rights although you may assign additional right if you wish.
Workaround
Created an Administrative Role that only has permissions for the Administrator to "Edit" "Passwords".

Related Articles

Trending Articles

Don't see what you're looking for?