Unable to schedule new Explore and Correlate in IM

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

Not able to create a new Explore and Correlate definition from the execute explore and correlate menu page at /iam/im/identityEnv/ui7/index.jsp?task.tag=ExecuteEACI

When clicking the Schedule New Job radio button. The page displays HTTP 403 Forbidden error.

The environment was protected by siteminder, but the logs did not show the 403 error being generated.  

Environment

Release : 14.2

Component : CA IDENTITY SUITE (VIRTUAL APPLIANCE)

This environment is running the Identity Suite Vapp in AWS.

Cause

AWS web application firewall (WAF) was too restrictive and blocking the access.

Resolution

The html information on the the 403 Forbidden page was reviewed using the chrome browser developer tools. This showed that the error message was coming from the AWS load balancers. The 403 error was generated a few times and the ALB captured the traffic being generated, but the information was limited.  After reviewing AWS web application firewall (WAF) and disabling it as a test, the IM task was access succesfully.  The  WAF was re-enabled with a less restrictive ruleset to resolve the issue.