mlDeploy Forbidden Error

[sparnell]

After we created a “deployment” role with the manage-admin and rest-admin roles plus xdbc-insert-in, we started seeing this exception message when running mlDeploy. I don’t see enough information in the output below to determine which user credentials are being used and what operation it’s trying to perform when the error occurs. The mlDeploy task runs to completion, reports success, and everything appears to be correctly deployed.

19:22:13.720 [INFO] [com.marklogic.client.batch.RestBatchWriter] Thread pool finished shutdown
19:22:13.720 [INFO] [com.marklogic.appdeployer.command.schemas.LoadSchemasCommand] Finished loading schemas from: src/main/ml-schemas
19:22:13.720 [INFO] [com.marklogic.client.impl.DatabaseClientImpl] Releasing connection
19:22:13.720 [DEBUG] [com.marklogic.client.impl.JerseyServices] Releasing connection
19:22:13.720 [INFO] [com.marklogic.appdeployer.impl.SimpleAppDeployer] Finished executing command [com.marklogic.appdeployer.command.schemas.LoadSchemasCommand]
 
19:22:13.720 [INFO] [com.marklogic.appdeployer.impl.SimpleAppDeployer] Executing command [com.marklogic.appdeployer.command.clusters.ModifyLocalClusterCommand] with sort order [350]
19:22:13.720 [INFO] [com.marklogic.appdeployer.impl.SimpleAppDeployer] Finished executing command [com.marklogic.appdeployer.command.clusters.ModifyLocalClusterCommand]
 
19:22:13.720 [INFO] [com.marklogic.appdeployer.impl.SimpleAppDeployer] Executing command [com.marklogic.appdeployer.command.modules.LoadModulesCommand] with sort order [400]
19:22:13.720 [INFO] [com.marklogic.appdeployer.command.modules.LoadModulesCommand] Initializing instance of DefaultModulesLoader
19:22:13.735 [ERROR] [system.err] Exception in thread "ThreadPoolTaskExecutor-1" com.marklogic.client.ForbiddenUserException: Local message: User is not allowed to apply resource at documents. Server Message: You do not have permission to this method and URL.
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.JerseyServices.checkStatus(JerseyServices.java:4622)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.JerseyServices.postResource(JerseyServices.java:3594)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.JerseyServices.postBulkDocuments(JerseyServices.java:3677)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.DocumentManagerImpl.write(DocumentManagerImpl.java:564)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.GenericDocumentImpl.write(GenericDocumentImpl.java:23)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.DocumentManagerImpl.write(DocumentManagerImpl.java:557)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.GenericDocumentImpl.write(GenericDocumentImpl.java:23)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.DocumentManagerImpl.write(DocumentManagerImpl.java:541)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.impl.GenericDocumentImpl.write(GenericDocumentImpl.java:23)
19:22:13.735 [ERROR] [system.err]           at com.marklogic.client.batch.RestBatchWriter$1.run(RestBatchWriter.java:64)
19:22:13.735 [ERROR] [system.err]           at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
19:22:13.735 [ERROR] [system.err]           at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
19:22:13.735 [ERROR] [system.err]           at java.lang.Thread.run(Unknown Source)
19:22:13.798 [DEBUG] [com.marklogic.client.DatabaseClientFactory] Creating new database client for server at alvc-mrkdbdev01:8060
19:22:13.798 [DEBUG] [com.marklogic.client.impl.JerseyServices] Connecting to alvc-mrkdbdev01 at 8060 as monte.wade
19:22:13.813 [INFO] [com.sun.jersey.core.spi.component.ProviderFactory] A dependent class, javax/mail/MessagingException, of the component class com.sun.jersey.core.impl.provider.entity.MimeMultipartProvider is not found. The component is ignored.
19:22:13.845 [INFO] [com.sun.jersey.core.spi.component.ProviderFactory] A dependent class, javax/mail/MessagingException, of the component class com.sun.jersey.core.impl.provider.entity.MimeMultipartProvider is not found. The component is ignored.
19:22:13.860 [INFO] [com.marklogic.appdeployer.command.modules.LoadModulesCommand] Loading asset modules from dir: src/main/ml-modules
19:22:13.860 [DEBUG] [com.marklogic.client.modulesloader.impl.DefaultModulesLoader] Loading modules from base directory: D:\ML_Project\phase-1.5\autoliv\src\main\ml-modules
19:22:13.907 [INFO] [org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor] Initializing ExecutorService
19:22:13.907 [DEBUG] [com.marklogic.client.modulesloader.impl.XccAssetLoader] Initializing XCC session; host: alvc-mrkdbdev01; username: monte.wade; database name: autoliv_dev-modules
19:22:13.985 [DEBUG] [com.marklogic.xcc.spi.ConnectionProvider] constructing new SocketPoolProvider

[rjrudin]

What version of ml-gradle is this? And all of the modules were loaded okay?

[sparnell]

We're currently using version 2.9.0. We're continuing to review the deployment, but as far as we can tell the deployment completed successfully.

[rjrudin]

It's an interesting error. In 2.9, XCC is used for loading modules via port 8000 into your modules database. And that starts up at these lines:

19:22:13.860 [DEBUG] [com.marklogic.client.modulesloader.impl.DefaultModulesLoader] Loading modules from base directory: D:\ML_Project\phase-1.5\autoliv\src\main\ml-modules
19:22:13.907 [INFO] [org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor] Initializing ExecutorService
19:22:13.907 [DEBUG] [com.marklogic.client.modulesloader.impl.XccAssetLoader] Initializing XCC session; host: alvc-mrkdbdev01; username: monte.wade; database name: autoliv_dev-modules

And that's the first thing that happens in the LoadModulesCommand - it loads "asset" modules. But the error message is from a call via a DatabaseClient to the REST API. I can't think of what that call would have been.

[rjrudin]

Going to close this, but please open if this pops up again.