AWI Authorization System – Access denied Error: U00000009

Products

• CA Automic Workload Automation - Automation Engine

Issue/Introduction

Whenever a user performs an action in the Automic Web interface (AWI) and this action is not authorized, following message appears:

Error: U00000009 '&01': Access denied

The insert '&01' is replaced by the object name which caused the violation. Often it's not so easy to find out which permission is missing in detail. Therefore the so-called "Security audit" is an appropriate function to find out details. There are two different functions available:

• "Security audit failure" traces all authorization violations.
• "Security audit success" traces all successful authorization checks.

The security audit can be set up differently for each Automic client via the UC_CLIENT_SETTINGS.

Environment

Release: 11.2 and higher
Component: Automic Workload Automation

Resolution

Add the Key SECURITY_AUDIT_FAILURE to the variable UC_CLIENT_SETTINGS with the value "HOST_ACCESS","LOGON","OBJECT_ACCESS","USER_PRIVILEGES"
 

Go to the settings of the Message Window and set the settings marked red:
 

 

Now execute the action that caused the error message. In the Message Window there will be messages like these:

The first two lines e.g. show that the user JAC/SUP tried to access the folder PLAYGROUND\JAC, but cannot access it as the Read right is missing.

By this way, you can find out, what access rights are missing to execute an action.

Additional Information

There are particular cases where the error will just indicate that there are no permissions at the Object level, such us on this case, whenever a user tried to Restart the Task the following error appeared stating that the user had no permissions in that Object:

U00000009 'JOBS_WIN.SYSTEM_OBJECTS@RUN_CMD.GNR': Access denied

 But when looking at the Usergroup permissions, the X-Execute for that particular JOBS was granted succesfully:

On this case, the issue was that a specific "Object Authorization" for a particular User had been granted at Object level as seen below:

So you should also check In the General - Object Authorizations if some particular permissions have been set at the Object throwing the U00000009 message.