After upgrading to AAI 24.4 with EEM authentication, no jobstreams or definitions are visible in the UI for any user
search cancel

After upgrading to AAI 24.4 with EEM authentication, no jobstreams or definitions are visible in the UI for any user

book

Article ID: 444128

calendar_today

Updated On:

Products

Automation Analytics & Intelligence

Issue/Introduction

After upgrading Automation Analytics and Intelligence (AAI) to version 24.4 and configuring role-based security using EEM (Embedded Entitlements Manager), users are unable to see any jobstreams, definitions, or business areas in the AAI UI.

Symptoms observed:

  • Authentication via EEM succeeds — users can log in without error.

  • After login, no Jobstream Definitions.

  • The issue affects all EEM-authenticated users regardless of their group membership.

  • JobstreamV2 policies are configured in EEM and appear correct.

Repeated entries in jaws.log:

AC=view:RC=Jobstream:RN=<stream name>:PO=null DENIED

Warning at startup in jaws.log:

JAWS resource class not found in eIAM: "Jobstream"; all access checks for this class will be denied

Environment

 

  • Product: Automation Analytics and Intelligence (AAI)

  • Version: 24.4

  • Authentication: EEM (Embedded Entitlements Manager)

  • Upgraded from: AAI 24.3 or earlier

  • Condition: Post-upgrade EEM migration steps not completed, or completed partially.

 

Cause

AAI 24.4 replaces the legacy Jobstream EEM resource class with a new JobstreamV2 resource class. A migration switch in AAI determines which resource class to use by querying EEM for any policies still associated with the old Jobstreamresource class.

  • If enabled Jobstream policies are found: AAI continues to use the deprecated Jobstream path.

  • If none are found: AAI switches to the new JobstreamV2 path.

During the 24.4 upgrade, the Jobstream resource class is removed from the EEM application registration. However, existing Jobstream policies are not automatically removed from EEM's policy database. These policies become orphaned:

  • They are no longer visible in the EEM administration UI because the Jobstream category no longer exists in the application registration.

  • They are still present in EEM's internal policy database and are returned by AAI's policy query API (searchPolicies).

Because AAI's migration switch finds these orphaned, enabled policies, it stays locked on the deprecated Jobstreamauthorization path. Since the Jobstream resource class is no longer registered in EEM, all checks on this path return PO=null DENIED—making all jobstreams invisible to all users. The JobstreamV2 policies configured in EEM are never evaluated.

Typical orphaned policy names:

  • Simple Jobstream policy

  • Simple Jobstream add-delete policy

  • Simple Business Area policy

Note: This can be confirmed by exporting the EEM configuration with safex and searching the exported XML for: <ResourceClassName>Jobstream</ResourceClassName>

Resolution

OPTION 1 — Run the post-upgrade EEM migration script (Recommended)

  1. Locate enableAndDeleteEEMPolicies.sh in the AAI installation directory.

  2. Run the script:

    Bash
     
    ./enableAndDeleteEEMPolicies.sh \
  -h <EEM_hostname> \
  -u EiamAdmin \
  -p <password> \
  -exportPath /tmp/eem

  3. Answer the resulting prompts:

    • Disable old policies and enable new policies? — enter: yes

    • Delete old Jobstream policies? — enter: yes

  4. Restart the JAWS service.

  5. Confirm the fix. In jaws.log, the following line should now appear:

    areAllPoliciesDisabledForResource=true

    Jobstream access checks will now use RC=JobstreamV2, and users covered by the JobstreamV2 policies will be able to see their jobstreams.

OPTION 2 — Disable or remove orphaned policies via safex import

Use this option if the migration script is not working to resolve this.

  1. Export the current EEM configuration using safex, or obtain the existing AAI.xml export.

  2. In the exported XML, locate all <Policy> elements that contain: <ResourceClassName>Jobstream</ResourceClassName>

  3. For each of these policies, change: <Disabled>False</Disabled> to <Disabled>True</Disabled> or just remove these Resource Classes from the file.

  4. Re-import the modified XML using safex.

    safex – u <username> –p <password> –f JAWSCreate.xml

  5. Restart the JAWS service.

  6. Confirm the fix as described in step 5 of Option 1.

AFTER APPLYING THE FIX: Ensure that users' accounts are members of the JAWSUsers or JAWSAdministrators Dynamic User Groups (DUGs) in EEM. The JobstreamV2 policies gate access on these groups. Users who are not members of either DUG will not see jobstreams even after the fix is applied.

Powered by Wolken Software