"Not authorized to perform task" Error Troubleshooting - Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

When attempting to execute a task in Identity Manager, you may encounter an "Not authorized to perform task" error. This error typically appears in the UI or in the Identity Manager (IM) server logs as: Administrator [AdminName] is not authorized to perform task [TaskName].

Environment

Identity Manager 14.5

Cause

This authorization failure is typically caused by one or more of the following configuration issues:

• Missing Admin Role: The administrator does not have the necessary Admin Role assigned to their account.
• Missing Admin Task: The Admin Role assigned to the user does not contain the required Admin Task.
• Disabled Role: The Admin Role is assigned to the user but is currently disabled.
• Admin Scope Limitations: The Admin Role is correctly configured, but the administrator's "Admin Scope" (the set of objects they are allowed to manage) does not include the target user or organization.

Resolution

Follow these steps to troubleshoot and resolve the authorization error:

1. Verify Role Assignment:
   • Navigate to the Admin User's profile in the Identity Manager User Console.
   • Confirm the user is assigned the necessary Admin Role.
2. Verify Admin Task Inclusion:
   • Navigate to Roles and Tasks > Admin Roles > Modify Admin Role.
   • Ensure the required task is listed within the "Admin Tasks" tab of that role.
3. Verify Role Status:
   • Ensure the status of the Admin Role is set to "Enabled."
4. Verify Admin Scope:
   • If the user has the role and the task, check the Admin Scope tab of the Admin Role.
   • Confirm the scope is wide enough to include the target object/user you are attempting to manage. If the scope is limited to a specific organization, ensure the target user belongs to that organization.
5. Clear Caches:
   • After making configuration changes, ensure you clear the Identity Manager cache (or wait for the cache refresh interval) before testing the task again.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.