WCC jil import

book

Article ID: 206906

calendar_today

Updated On:

Products

CA Workload Automation AE

Issue/Introduction

JIL Import fails with an error "Access is denied"

 2021-01-18 14:14:08,095 @ecli <      Thread-34> []  INFO #WebServerCommandClientReq          # Body: 
  <commandRequest><command>jil &lt; %InFile -saml &quot;UserSession;Version-1.0;670a098d922cdffc39b675e19d0acd82-600584f7-97bbfc0-2e&quot;</command><osUser>ejmcommander</osUser><osPassword>****</osPassword><timeout>300000</timeout><inFile>/* ----------------- test01 ----------------- */ 
 update_job: test01   job_type: CMD 
 command: date /t
 machine: host123
 owner: administrator
 permission: 
 date_conditions: 0
 condition: s(box1)
 description: &quot;rrr&quot;
 alarm_if_fail: 1
 alarm_if_terminated: 1
 resources: (RES1,QUANTITY=1,FREE=A)
 </inFile></commandRequest>

 ..


 2021-01-18 14:14:08,345 @ecli <      Thread-34> []  INFO #WebServerCommandClientReq          # Response: {"stdErr":["Access is denied."]} 
 2021-01-18 14:14:08,347 @ecli <      Thread-34> [] ERROR #WebServerCommandClientReq          # Server Error: 
 com.ca.wcc.command.client.webserver.WebServerException: Access is denied.

 

ECLI and JIL Export are working fine at the same time. Only JIL import fails with this error.

 

 

Cause

The credential user is missing R/X privileges on jil.exe (or jil), or is being denied the R/X privileges during run time by some security / threat prevention program.

 

To reproduce the issue, remove R/X permissions for $AUTOSYS/bin/jil to the user (ejmcommander) in this case. That resulted in a success call to AEWS URL (code 200), but the result of that call was "Access is denied"


INFO | jvm 1 | 2021/01/19 15:36:49 | 6489 | @ecli < Thread-46> [] INFO #WebServerCommandClientReq # Status: 200
INFO | jvm 1 | 2021/01/19 15:36:49 | 6489 | @ecli < Thread-46> [] INFO #WebServerCommandClientReq # Response: {"stdErr":["Access is denied."]}
INFO | jvm 1 | 2021/01/19 15:36:49 | 6489 | @ecli < Thread-46> [] ERROR #WebServerCommandClientReq # Server Error:
INFO | jvm 1 | 2021/01/19 15:36:49 | 6489 | com.ca.wcc.command.client.webserver.WebServerException: Access is denied.

Environment

Release : 12.0

Component : CA Workload Automation AE (AutoSys)

Resolution

Look at the properties of jil.exe (or jil) and verify if R/X security permissions exist for the credential user in question.

Apart from the c:\windows\temp folder also needs R/W/X permissions to the credential user, as the AutosysCommandWrapper.exe creates the jil with input file from the system temp folder. If there's a denial here, then the same behavior surfaces. 

 

If its failing intermittently, verify the behavior via strace/procmon.exe to trace out what is going on from operating system perspective.  (for this customer, when it WCC JIL Import failed, procmon showed that jil.exe is not started)

Work with security monitoring admins to make sure programs in $AUTOSYS/bin are excluded for block out from launch to valid credential users.

Find out the O/S user who is the owner of the AutoSys Restful Webserver by issuing the following commands:

ustat

ps -ef | grep <pid of the Webserver from the results of the above ustat command>

Open up a terminal using that user and run umask for that session. Verify that the umask is set to 0022. If it is not set to 0022, then set the umask in that user's profile and restart the Webserver.