Troubleshooting actions by Users not Authorized | "Error: U00000009 '&01': Access denied"

Products

• CA Automic One Automation
• CA Automic Workload Automation - Automation Engine

Issue/Introduction

Error Message :
"Error: U00000009 '&01': Access denied"
"Error: U0000009 '&01': Access denied"

Whenever an Automic UserInterface User performs an action which it is not authorized to perform, the above error message is displayed.

The insert '&01' is replaced by the object name which casued the violation. Often it's not easy to determine which permission is missing in the details.  

Investigation

• A user wants to release a job manually via the activity window.

But the message "Error: U0000009 'JOBS.WIN.NO$JCL': Access denied" or "JOBS.WIN.NO$JCL': Access denied" is issued. Without the "Security audit failure" it's difficult to find out which authorization the user needs to own for this action, because no additional information is given.

• Add the Key: 'SECURITY_AUDIT_FAILURE' and the Value 1: 'HOST_ACCESS LOGON OBJECT_ACCESS USER_PRIVILEGES' to the 'UC_CLIENT_SETTINGS' to activate the "Security audit failure" trace. It takes place immediately after the variable was saved, no restart is necessary.
  
  
  
• The user also needs to open the messages window by clicking on the "messages" icon in the upper right of the screen Afterwards additional information is displayed in the message window.
  
• Then the user needs to click on the "Settings" icon in the Messages window
  
  
• In the Settings window that comes up, make sure that
  • Scope is set to "Client" (if this user should see only their own messages, then this can be "Current User")
  • Source has "Security" checked
    
• Once this is done, when the user attempts to release the hold manually, an error still pops up, and now there is information in the messages window as well:
  
  
  
  10/4/2023 08:39:13 PM        U00004519 Access violation details: Used filter: 'JOBS' .
  10/4/2023 08:39:13 PM        U00004505 Access violation: User: 'TEST/NIX' Object: 'JOBS.WIN.NO$JCL' Access type: 'U00909807 M' Reason: prohibition in authorization profile: 'TEST/NIX'.

Environment

Component: Automic Automation

OS Version: N/A

Cause

Cause type:
By design
Root Cause: UserInterface authorizations prevent users from performing actions on objects that they are not authorized to access. Use the Security audit to determine which authorizations are required when access denied error is thrown.

Resolution

Use  the "Security audit" as it is an appropriate function to determine the details:

• "Security audit failure" traces all authorization violations.
• "Security audit success" traces all successful authorization checks.

The security audit can be set up differently for each Automic client via the UC_CLIENT_SETTINGS. More details on that can be found in the Automic Documentation.  See the references listed below.

Additional Information

Automic Automation Documentation on SECURITY Parameters in UC_CLIENT_SETTINGS