Impersonate user throws "Insufficient permissions to perform this action"

Hello experts,

We have an application that connectes to the Content Server 10.0 using the "les-services". At some point the application needs to impersonate the user "Admin" (the application connects with the user Admin) to normal user. The problem is the content server throws the error "javax.xml.ws.soap.SOAPFaultException: Insufficient permissions to perform this action." when the user to impersonate to has no "System administration rights". If the user has "System administration rights" the impersonateUser method works. See below the error trace:

javax.xml.ws.soap.SOAPFaultException: Insufficient permissions to perform this action.
   at com.sun.xml.ws.fault.SOAP11Fault.getProtocolException(SOAP11Fault.java:189)
   at com.sun.xml.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder.java:130)
   at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:119)
   at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:89)
   at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:118)
   at com.sun.proxy.$Proxy36.impersonateUser(Unknown Source)

Thanks!

Vasile.

Find more posts tagged with

Comments

Igor Zottich

Hi Vasile,

Only a System Administrator can impersonate another user.

So if you are connected as Admin and need to impersonate User1 it should work, but if you are User1 you cannot impersonate Admin.

Have you tried to manually connect with the impersonated user so to verify that he has all the authorizations for doing that action?

hope this helps

Igor Zottich

Technical Account Manager

logo5M

IgorZottich@5MInformatica.it

Via Cristoforo Colombo , 456 – 00144 Roma

TEL. +39 06 54224774

FAX. +39 06 54223196

CEL. +39 377 5533416

Da: eLink Entry: Content Web Services Forum [mailto:otdncontentwebservices971forum@elinkkc.opentext.com]
Inviato: giovedì 7 aprile 2016 11.43
A: eLink Recipient
Oggetto: Impersonate user throws "Insufficient permissions to perform this action"

Impersonate user throws "Insufficient permissions to perform this action"

Posted by Gavrila, Vasile On 04/07/2016 05:42 AM

Hello experts,

Thanks!

Vasile.

[To post a comment, use the normal reply function]
Forum:	Content Web Services Forum
Content Server:	Knowledge Center

vgavrila

Hi Igor,

I confirm I can connect with the impersonated user (let say "user1") to the livelink interface and I can create the document in that folder. The "Insufficient permissions to perform this action" is thrown when the code calls the impersonateUser method. The application uses CWS autentication and the connected user is "Admin". If I set "System Administrator Rigths" to the "user1" the impersonation works and the document is created in the specified folder.

Any idea what can cause that behavior?

Thanks a lot for your help!

Vasile.

eLink User

It is quite possible that when CWS user1 login is passing IWA or REMOTE_USER (check if the CWS application is anonymous or not)

If the real userid is passed onto CWS then even though in code you think you are impersonating Admin it may not work so I will tell you simple methods to do this

First and foremost go to the webserver application that is hosting the WSDL and check if its authentication is "anonymous"
Then create your code like you are doing by calling the session using 'Admin' and once you get that impersonate user1
Run Debug=2 wantlapilogs=true on the real livelink server that is doing your CWS call

If you are getting a OTDS authentication token and using it for impersonation check the KB for a code example.

My guess is your website is a default website with "Windows Auth" enabled so it is passing the credential of the real user1.

That is also possible you can allow a real user (kind of SSO) to do your object creation,you just have to edit the 'Web.Config' to pass the

right things.See posts in this forum by me and many others.

.....appu appnair appunair

Well, if I called the wrongnumber, why did you answer the phone?
James Thurber, New Yorker cartoon caption, June 5, 1937

On Thu, Apr 7, 2016 at 9:47 AM, eLink Entry: Content Web Services Forum <otdncontentwebservices971forum@elinkkc.opentext.com> wrote:

Impersonate user throws "Insufficient permissions to perform this action" Posted byGavrila, VasileOn 04/07/2016 10:43 AM

Hi Igor,I confirm I can connect with the impersonated user (let say "user1") to the livelink interface and I can create the document in that folder. The "Insufficient permissions to perform this action" is thrown when the code calls the impersonateUser method. The application uses CWS autentication and the connected user is "Admin". If I set "System Administrator Rigths" to the "user1" the impersonation works and the document is created in the specified folder.Any idea what can cause that behavior?Thanks a lot for your help!Vasile.
[To post a comment, use the normal reply function]
Topic: Impersonate user throws "Insufficient permissions to perform this action"
Forum: Content Web Services Forum
Content Server: Knowledge Center

Igor Zottich

Hi visile,

I have written this snippet that works on my system.

I have written it in c#

string authAdminToken = null;

Node FolderNode = null;

string ImpUserToken = null;

AuthenticationClient authClient = new AuthenticationClient();

try

{

authAdminToken = authClient.AuthenticateUser(textBox1.Text, textBox2.Text);

//System.Windows.Forms.MessageBox.Show(authToken);

// Create the DocumentManagement service client

DocumentManagementClient docManClient = new DocumentManagementClient();

// Create the OTAuthentication object and set the authentication token

Autenticazione.OTAuthentication otAuthAdmin = new Autenticazione.OTAuthentication();

otAuthAdmin.AuthenticationToken = authAdminToken;

ImpUserToken = authClient.ImpersonateUser(ref otAuthAdmin, "utente1");

// Create the OTAuthentication object for the impersonated userand set the authentication token

Documentale.OTAuthentication otAuthImpUser = new Documentale.OTAuthentication();

otAuthImpUser.AuthenticationToken = ImpUserToken;

// Create the Folder

FolderNode = docManClient.CreateFolder(ref otAuthImpUser, 32477, "New Folder2", "", null);

System.Windows.Forms.MessageBox.Show("Folder Created");

} catch (Exception e1)

{

System.Windows.Forms.MessageBox.Show(e1.Message);

}

Igor Zottich

Technical Account Manager

logo5M

IgorZottich@5MInformatica.it

Via Cristoforo Colombo , 456 – 00144 Roma

TEL. +39 06 54224774

FAX. +39 06 54223196

CEL. +39 377 5533416

Da: eLink Entry: Content Web Services Forum [mailto:otdncontentwebservices971forum@elinkkc.opentext.com]
Inviato: giovedì 7 aprile 2016 16.48
A: eLink Recipient
Oggetto: Impersonate user throws "Insufficient permissions to perform this action"

Impersonate user throws "Insufficient permissions to perform this action"

Posted by Gavrila, Vasile On 04/07/2016 10:43 AM

Hi Igor,

Any idea what can cause that behavior?

Thanks a lot for your help!

Vasile.

[To post a comment, use the normal reply function]
Topic:	Impersonate user throws "Insufficient permissions to perform this action"
Forum:	Content Web Services Forum
Content Server:	Knowledge Center

Guy_Pomerleau

In my organisation, we have done different application connecting to CS and we do impersonate. The account the application doing the impersonate DOES not need to be admin. It all depend how you authenticate. If using IWA, then you can impersonate a user using the account running you application pool (if it is a .net or web apps) If you are running CS with CS account and not Windows account then yes the account use need to be admin to impersonate. For us what we do, is we let Windows do the impersonate for us to the apps pool pass the the users token to CWS and it has no idea it the the apps pool making the call. For this to work you have to make sure you properly set-up the windows account with proper SPN

vgavrila

Hello,

Thanks for the answer.

Regarding 1) I like to mention that "les-services" are running on Tomcat so I beleive the concept of "anonymous authentication" does apply in this case. For the livelink server running on IIS the anonymous authentication is enabled.

Regarding 2) the code should be fine since the impersonation works under some conditions (the target user has Administrativ priviledges)

Regarding 3) see below the relevant log from the CS.

On the CS we uses Livelink authentication. So, I can connect with the user "emp1" and created a document in the needed folder but user "Admin" cannot impersonate to user "emp1" unless "emp1" has administrative priviledges.

I'm quite new with OpenText so I'm sorry if I miss some details.

Thanks a lot!

Vasile.

Here is the log:

4/11/2016 13:25:57 Mon Apr 11 13:25:57 2016
04/11/2016 13:25:57 Arguments = 'A<1,?,''userName''=''otadmin@otds.admin'',''userPassword''=''XXXXXXXXXX''>'
04/11/2016 13:25:57 ServiceMethod = 'AuthenticateUser'
04/11/2016 13:25:57 ServiceName = 'Authentication'
04/11/2016 13:25:57 _ApiName = 'InvokeService'
04/11/2016 13:25:57 _ClientVersion = '9.7.1'
04/11/2016 13:25:57 _ConnectionName = ''
04/11/2016 13:25:57 _Cookie = ''
04/11/2016 13:25:57 _DomainName = ''
04/11/2016 13:25:57 _ImpersonateUserDomain = ''
04/11/2016 13:25:57 _LLENVIRON_ASSOC = 'A<1,?,''REMOTE_ADDR''=''192.168.1.113''>'
04/11/2016 13:25:57 _Request = 'llweb'
04/11/2016 13:25:57 _UserName = 'otadmin@otds.admin'
04/11/2016 13:25:57 _UserPassword = 'XXXXXXXXXX'
04/11/2016 13:25:57 _LLENVIRON_ASSOC contains:
04/11/2016 13:25:57 REMOTE_ADDR=192.168.1.113
04/11/2016 13:25:57 End _LLENVIRON_ASSOC
04/11/2016 13:25:57 Mon Apr 11 13:25:57 2016 - 26292   Func='lapi.InvokeService:Authentication.AuthenticateUser()'   Timing:   0.019 0.018 0.019
04/11/2016 13:25:57 [3348024320]    Done with Request on socket 000000004FD1DE60
04/11/2016 13:26:02 [3352126451]    Processing Request on socket 000000005047CE10
04/11/2016 13:26:02
04/11/2016 13:26:02 Mon Apr 11 13:26:02 2016
04/11/2016 13:26:02 Arguments = 'A<1,?,''userName''=''emp1''>'
04/11/2016 13:26:02 ServiceMethod = 'ImpersonateUser'
04/11/2016 13:26:02 ServiceName = 'Authentication'
04/11/2016 13:26:02 _ApiName = 'InvokeService'
04/11/2016 13:26:02 _ClientVersion = '9.7.1'
04/11/2016 13:26:02 _ConnectionName = ''
04/11/2016 13:26:02 _Cookie = 'FRAjQsY99LUhapkOPvz0fTdTPg1wsCArCjR4jwcgr2SqopLAgg7k7OdiFtXKfwKS'
04/11/2016 13:26:02 _DomainName = ''
04/11/2016 13:26:02 _ImpersonateUserDomain = ''
04/11/2016 13:26:02 _LLENVIRON_ASSOC = 'A<1,?,''REMOTE_ADDR''=''192.168.1.113''>'
04/11/2016 13:26:02 _Request = 'llweb'
04/11/2016 13:26:02 _UserName = ''
04/11/2016 13:26:02 _UserPassword = 'XXXXXXXXXX'
04/11/2016 13:26:02 _LLENVIRON_ASSOC contains:
04/11/2016 13:26:02 REMOTE_ADDR=192.168.1.113
04/11/2016 13:26:02 End _LLENVIRON_ASSOC
04/11/2016 13:26:02 Allocating DAPISession object for opentext.
04/11/2016 13:26:02 Allocating UAPISession object for opentext.
04/11/2016 13:26:02 Service error occurred
04/11/2016 13:26:02 Error Code: Core.InsufficientPermissionsToPerformThisAction
04/11/2016 13:26:02 Error Message: Insufficient permissions to perform this action.
04/11/2016 13:26:02 Mon Apr 11 13:26:02 2016 - 30421   Func='lapi.InvokeService:Authentication.ImpersonateUser()'   Timing:   0.025 0.024 0.025
04/11/2016 13:26:02 [3352153534]    Done with Request on socket 000000005047CE10
04/11/2016 13:29:46 [3576208403]    Processing Request on socket 00000000509C9480

eLink User

As a check see if the user in your log as shown

'otadmin@otds.admin exists in content server with SA privs this is a functional user like eLink but restrictive in nature
Looks like this functional user is the one who is asking livelink to impersonate
If this user does not have SA then the generic message is thrown
Worth a try if I were you

The tomcat wsdl call lands directly in your livelink on the lapi port so there is really no IIS in your scenario

Ciao, Appu

On Apr 11, 2016, at 6:37 PM, eLink Entry: Content Web Services Forum <otdncontentwebservices971forum@elinkkc.opentext.com> wrote:

eLink : Re Impersonate user throws "Insufficient permissions to perform this action"
Re Impersonate user throws "Insufficient permissions to perform this action" Posted byGavrila, VasileOn 04/11/2016 09:46 AM

Hello,Thanks for the answer. Regarding 1) I like to mention that "les-services" are running on Tomcat so I beleive the concept of "anonymous authentication" does apply in this case. For the livelink server running on IIS the anonymous authentication is enabled.Regarding 2) the code should be fine since the impersonation works under some conditions (the target user has Administrativ priviledges)Regarding 3) see below the relevant log from the CS. On the CS we uses Livelink authentication. So, I can connect with the user "emp1" and created a document in the needed folder but user "Admin" cannot impersonate to user "emp1" unless "emp1" has administrative priviledges.I'm quite new with OpenText so I'm sorry if I miss some details.Thanks a lot!Vasile.Here is the log:4/11/2016 13:25:57 Mon Apr 11 13:25:57 2016
04/11/2016 13:25:57 Arguments = 'A<1,?,''userName''=''otadmin@otds.admin'',''userPassword''=''XXXXXXXXXX''>'
04/11/2016 13:25:57 ServiceMethod = 'AuthenticateUser'
04/11/2016 13:25:57 ServiceName = 'Authentication'
04/11/2016 13:25:57 _ApiName = 'InvokeService'
04/11/2016 13:25:57 _ClientVersion = '9.7.1'
04/11/2016 13:25:57 _ConnectionName = ''
04/11/2016 13:25:57 _Cookie = ''
04/11/2016 13:25:57 _DomainName = ''
04/11/2016 13:25:57 _ImpersonateUserDomain = ''
04/11/2016 13:25:57 _LLENVIRON_ASSOC = 'A<1,?,''REMOTE_ADDR''=''192.168.1.113''>'
04/11/2016 13:25:57 _Request = 'llweb'
04/11/2016 13:25:57 _UserName = 'otadmin@otds.admin'
04/11/2016 13:25:57 _UserPassword = 'XXXXXXXXXX'
04/11/2016 13:25:57 _LLENVIRON_ASSOC contains:
04/11/2016 13:25:57 REMOTE_ADDR=192.168.1.113
04/11/2016 13:25:57 End _LLENVIRON_ASSOC
04/11/2016 13:25:57 Mon Apr 11 13:25:57 2016 - 26292   Func='lapi.InvokeService:Authentication.AuthenticateUser()'   Timing:   0.019 0.018 0.019
04/11/2016 13:25:57 [3348024320]    Done with Request on socket 000000004FD1DE60
04/11/2016 13:26:02 [3352126451]    Processing Request on socket 000000005047CE10
04/11/2016 13:26:02
04/11/2016 13:26:02 Mon Apr 11 13:26:02 2016
04/11/2016 13:26:02 Arguments = 'A<1,?,''userName''=''emp1''>'
04/11/2016 13:26:02 ServiceMethod = 'ImpersonateUser'
04/11/2016 13:26:02 ServiceName = 'Authentication'
04/11/2016 13:26:02 _ApiName = 'InvokeService'
04/11/2016 13:26:02 _ClientVersion = '9.7.1'
04/11/2016 13:26:02 _ConnectionName = ''
04/11/2016 13:26:02 _Cookie = 'FRAjQsY99LUhapkOPvz0fTdTPg1wsCArCjR4jwcgr2SqopLAgg7k7OdiFtXKfwKS'
04/11/2016 13:26:02 _DomainName = ''
04/11/2016 13:26:02 _ImpersonateUserDomain = ''
04/11/2016 13:26:02 _LLENVIRON_ASSOC = 'A<1,?,''REMOTE_ADDR''=''192.168.1.113''>'
04/11/2016 13:26:02 _Request = 'llweb'
04/11/2016 13:26:02 _UserName = ''
04/11/2016 13:26:02 _UserPassword = 'XXXXXXXXXX'
04/11/2016 13:26:02 _LLENVIRON_ASSOC contains:
04/11/2016 13:26:02 REMOTE_ADDR=192.168.1.113
04/11/2016 13:26:02 End _LLENVIRON_ASSOC
04/11/2016 13:26:02 Allocating DAPISession object for opentext.
04/11/2016 13:26:02 Allocating UAPISession object for opentext.
04/11/2016 13:26:02 Service error occurred
04/11/2016 13:26:02 Error Code: Core.InsufficientPermissionsToPerformThisAction
04/11/2016 13:26:02 Error Message: Insufficient permissions to perform this action.
04/11/2016 13:26:02 Mon Apr 11 13:26:02 2016 - 30421   Func='lapi.InvokeService:Authentication.ImpersonateUser()'   Timing:   0.025 0.024 0.025
04/11/2016 13:26:02 [3352153534]    Done with Request on socket 000000005047CE10
04/11/2016 13:29:46 [3576208403]    Processing Request on socket 00000000509C9480
[To post a comment, use the normal reply function]
Topic: Impersonate user throws "Insufficient permissions to perform this action"
Forum: Content Web Services Forum
Content Server: Knowledge Center

Igor Zottich

Hi Vasile,

Can you send us your code?

Igor Zottich

Technical Account Manager

logo5M

IgorZottich@5MInformatica.it

Via Cristoforo Colombo , 456 – 00144 Roma

TEL. +39 06 54224774

FAX. +39 06 54223196

CEL. +39 377 5533416

Da: eLink Entry: Content Web Services Forum [mailto:otdncontentwebservices971forum@elinkkc.opentext.com]
Inviato: martedì 12 aprile 2016 01.38
A: eLink Recipient
Oggetto: Re Impersonate user throws "Insufficient permissions to perform this action"

Re Impersonate user throws "Insufficient permissions to perform this action"

Posted by Gavrila, Vasile On 04/11/2016 09:46 AM

Hello,

Thanks for the answer.

Regarding 2) the code should be fine since the impersonation works under some conditions (the target user has Administrativ priviledges)

Regarding 3) see below the relevant log from the CS.

I'm quite new with OpenText so I'm sorry if I miss some details.

Thanks a lot!

Vasile.

Here is the log:

[To post a comment, use the normal reply function]
Topic:	Impersonate user throws "Insufficient permissions to perform this action"
Forum:	Content Web Services Forum
Content Server:	Knowledge Center

vgavrila

Dear all,

I manage to find the issue. The application does the following:

1) Impersonate the user "Admin" to the user "emp1" (that works!!!)

2) create the document

3) Impersonate the user "emp1" back to "Admin" for performing some other actions. (of course, that failes when "emp1" has no administrative privileges!!!)

So a I need to raise a new question now: How to "revert" the impersonation so the user become "Admin"? Should I re-authenticate the user "Admin" or would it be enought to set the authetication token that was created before step 1)?

I'm sorry for the my mistake when I reported the problem. I was confused by a wrong error trace that point me the error happened at step 1) since it actually happened at 3).

Thanks a lot againt! I apreciate your fast help and patience!

Vasile.

Igor Zottich

Hi Vasil,

You should have 2 different Authentication Tokens, one form Admin and 1 from emp1, just switch the tokens.

Igor Zottich

Technical Account Manager

logo5M

IgorZottich@5MInformatica.it

Via Cristoforo Colombo , 456 – 00144 Roma

TEL. +39 06 54224774

FAX. +39 06 54223196

CEL. +39 377 5533416

Da: eLink Entry: Content Web Services Forum [mailto:otdncontentwebservices971forum@elinkkc.opentext.com]
Inviato: martedì 12 aprile 2016 16.45
A: eLink Recipient
Oggetto: R Re Impersonate user throws "Insufficient permissions to perform this action"

R Re Impersonate user throws "Insufficient permissions to perform this action"

Posted by Gavrila, Vasile On 04/12/2016 10:41 AM

Dear all,

I manage to find the issue. The application does the following:

1) Impersonate the user "Admin" to the user "emp1" (that works!!!)

2) create the document

3) Impersonate the user "emp1" back to "Admin" for performing some other actions. (of course, that failes when "emp1" has no administrative privileges!!!)

I'm sorry for the my mistake when I reported the problem. I was confused by a wrong error trace that point me the error happened at step 1) since it actually happened at 3).

Thanks a lot againt! I apreciate your fast help and patience!

Vasile.

[To post a comment, use the normal reply function]
Topic:	Impersonate user throws "Insufficient permissions to perform this action"
Forum:	Content Web Services Forum
Content Server:	Knowledge Center