AAI BusinessArea and JobstreamV2 Policies Not Honored in Web UI

Products

• Automation Analytics & Intelligence

Issue/Introduction

Users authenticating via Embedded Entitlements Manager (EEM) report that configured security policies for BusinessArea and JobstreamV2 are not being applied in the AAI Web UI, despite a successful "Resource Check" within the EEM UI.

Observed behaviors include:

• Users are unable to see specific Business Areas or Jobstreams in the Web UI.
• The UI may display: "You do not have permissions to view business areas."
• Policies that use wildcards (e.g., *) or specific resource paths seem to be ignored by the AAI web interface.

Cause

There are two primary causes for this behavior in version 24.4.0:

1. Defect DE184206: A known issue where EEM-authenticated users cannot view jobstreams if they are only assigned to the default "All Jobstreams" Business Area.
2. Orphaned Legacy Policies: When upgrading to 24.4, AAI migrates from the legacy Jobstream resource class to the new JobstreamV2 class. If old, enabled policies still exist in EEM for the legacy Jobstream class, AAI may remain locked on the deprecated authorization path, which returns "DENIED" for all Web UI resource checks.

Resolution

Step 1: Complete the EEM Migration

If the environment was upgraded from AAI 24.3 or earlier, you must run the migration script to clean up orphaned policies:

1. Navigate to the AAI installation directory.
2. Locate and execute enableAndDeleteEEMPolicies.sh (Linux) or .bat (Windows).
3. When prompted:
   • Disable old policies and enable new policies? — Enter yes.
   • Delete old Jobstream policies? — Enter yes.
4. Restart the AAI (JAWS) service.

Step 2: Assign Jobstreams to Specific Business Areas (Workaround for DE184206)

If the issue is specifically with Jobstream visibility:

1. Open the AAI Thick Client or Web UI with an administrative account.
2. Edit the affected Jobstreams.
3. Under the Jobstream Hierarchy tab, assign the jobstream to a specific Business Area other than the default "All Jobstreams".
4. Have the user log out and log back in to verify visibility.

Step 3: Permanent Fix

This will be fixed in AAI 26.0