Impersonation error when creating a token using runtimeAPI.createToken

3 years ago

Originally Published: 2013-06-06

Article Number

000052696

Applies To

RSA Access Manger AdminAPI
RSA Access Manager 6.1
RSA Access Manager version 6.2

Issue

Impersonation error when creating a token using runtimeAPI.createToken
The following error is logged in the eserver standard output file in DEBUG mode:

15:29:33:115 [*] [MuxWorker-10] - result: {EXCEPTION_TYPE=TokenException, EXCEPTION_MESSAGE=Impersonation is allowed only for administrative user}

Cause

This error occurs when using runtimeAPI.createToken() or RunTimeAPI .setTokenValue() on the token map of a token of an authenticated user. When a token is created with an authenticate method the token is populated with several default keys including SC_IMPERSONATED_ID. No errors are generated when the token is created as the result of the authentication call, but any attempts to subsequently modify the token map and create a new token afterwards will generate this error. User impersonation is a new feature introduced in Access Manager 6.1 that is supposed to ensure that tokens created by a user other than the authenticated user are created through the impersonation API. The check for an impersonation ID in the token incorrectly occurs even if cleartrust.aserver.impersonation.enable=false is set in the aserver.conf file.

Resolution

Before calling the create token method remove the key the token key for impersonation with the remove method. This will prevent check for a valid impersonation from being made.

values.remove(TokenKeys. SC_IMPERSONATED_ID);

This error should not occur when cleartrust.aserver.impersonation.enable=false. This will be fixed in a future service pack.

Workaround

Upgraded from 6.0 to 6.1

Don't see what you're looking for?

Related Articles

Trending Articles