Release : 10.7.0
Component : APM Agents
The realms.xml had LDAP and EEM realms. But EEM also was using LDAP as a user store for CEM. LDAP was first in realms.xml and was used for APM. But it did not have CEM user groups added. So failed,
So switching to using EEM first, allowed login to CEM.