Access denied message when trying to unlock an account

Question

I have an issue we don't fully understand.

We are running Adaxes v2018.2. Last night I logged in to unlock a user account. Under the "User Management" section I clicked "Unlock account", selected the name, clicked "OK", and received an "Access denied" message on my screen. One of my co-workers tried to unlock the same account this morning and was successful.

I have checked the Web Configuration tool and both of our accounts are present in "Access Control". I have checked both accounts on one of our AD controllers and both accounts are members of the same groups. My account, however, is unable to perform a basic activity like unlocking an account. I've tried this on two different computers running different browsers (Chrome and Firefox). This was working for me last week and to my knowledge no changes have been made to any of our accounts.

Any suggestions as to where to look next? Thanks.

Comments

I have checked the Web Configuration tool and both of our accounts are present in "Access Control".

The Access Control section in Adaxes Web Interface Configurator is used to control user access to the Web Interface and is not related to the operations users can perform.

I have checked both accounts on one of our AD controllers and both accounts are members of the same groups.

The operations users can perform are determined by Security Roles. For troubleshooting purposes, please, check if the Security Roles assigned to your user account include the permissions described in the Grant Rights to Reset Passwords and Unlock Accounts tutorial and do not contain corresponding Deny permissions. For your information, the Deny permissions always override the Allow ones. For information on how to view Security Roles assigned to a user, have a look at the following help article: https://www.adaxes.com/help/?HowDoI.Man ... forms.html.

This was working for me last week and to my knowledge no changes have been made to any of our accounts.

Most probably, the permissions granted by Security Roles assigned to your account or the roles assignments were changed.

---

Many thanks for the reply.

So I logged into the Administration Console and opened up <domain> -> Configuration -> Security Roles -> Builtin -> Account Manager. For some reason, my account is no longer assigned to the Account Manager security role. Not sure why, but it's not there.

Next steps - I click on the Add... button, select my name, click on All Objects on the Select Assignment Scope popup (matching the assignment for all other users in that role), and click Finish. When I try to "Save Changes" I get a popup "An error occurred while saving the Security Role. Access is denied."

I had one of the colleagues try making the change as well and he gets the same error.

One interesting thing we've noticed, under the Assignments for this role is a trustee which has no corresponding entry in the tree:

We are unable to delete this entry. Is it possible that something has been corrupted?

TIA.

Answer 1

Hello,

Most probably, the group that was used as a trustee for the assignment was removed and your account was a member of the group. As a result the group SID is displayed in the Security Role assignments and you are no longer granted the permissions. You need to log on to Adaxes service with the credentials of an account that has required permissions (e.g. Adaxes service account specified during the product installation) and update the Security Role assignments. To check who deleted the group you can view Adaxes general log.

Also, you can try restoring the group. For details, see https://www.adaxes.com/tutorials_Active ... bjects.htm.