CF Admin API access denied

[chewymole]

Hi,

this has probably been asked many many times but i cant seem to find a solution.

Environment: CF11 CFH6 (but admin says its not installed..)

Windows server 2012 R2

16GB Ram

Intel Xeon E3 3.1Ghz 64bit

Issue: All cache features in CF admin are disabled.

I dont like this but my issue is concerning the cache.

I have a custom CMS, the content is served via the VFS (ram://) drive, its stored in a DB and if the file does not exist we create it in the VFS and its included into the index.cfm.

anyway, when a change is made to this type of content, the changes are not visible. I can restart the application which clears out the VFS, i can add white space to the end of the file and a few other tricks to trick CF into thinking the file has changes so that it will reload it but nothing works.

The only way to fix is to log into the CF admin console and click the clear template cache button. Again the Trusted Cache is disabled.

This is the first issue.

The second is when i attempt to call the admin API to clear the Template Cache, i get the CFACCESSDENIED error.

I am using the same user/pass as i use to log into the console.

I have tried creating a second user with API only access but get the same error.

I have had this issue since the initial install of CF11. 9 never had this issue.

Can anyone shed some light on this for me?

Thanks in advance

Tim    

[pete_freitag]

Tim,

Is your CF admin setup with multiple users, or a single root / admin user? If multiple users you need to use the root admin user and make sure your user does not have it under Prohibited Roles?

The second possible cause that comes to mind is the Allowed IP Addresses setting, make sure if you are accessing the admin api as a remote method that the remote ip is listed under "Allowed IP Addresses for ColdFusion Administrator access".

[chewymole]

Hi Pete,

i have a second user, but i tried both users when attempting to use the API.

if i comment out the line that calls the request.clearTemplateCache() it does not error out but also does not clear the cache...

so i know i can instantiate the CFC's or at least i think i can, i can dump them out after the login method call, but i guess that is not the same as calling the methods.

          <cfset createObject("component","cfide.adminapi.administrator").login(adminpassword="xxxxxxxxxxxxx",adminuserid="admin")>

          <cfset myObj = createObject("component","cfide.adminapi.runtime")>

          <cfset myObj.clearTrustedCache()> <!--- this throws the error --->

I wouldn't have to worry about this part if the first part was working as expected. Although, i would prefer to have Caching enabled, and it actually cache templates as expected, then i would need to use this feature for my CMS users.

For example i have 4 blog users who will be writing blog entries for my site, i dont want to give them CFAdmin user rights and they surely do not want do have to do that after every post/edit/update/edit/update...... then publish..

I have added my servers IP to the list of allowed IP, but not sure if it should local host 127.0.0.1? or the real external IP, i have 10..

Thanks

Tim

[BKBK]

chewymole wrote:

Hi Pete,

i have a second user, but i tried both users when attempting to use the API.

if i comment out the line that calls the request.clearTemplateCache() it does not error out but also does not clear the cache...

so i know i can instantiate the CFC's or at least i think i can, i can dump them out after the login method call, but i guess that is not the same as calling the methods.

          <cfset createObject("component","cfide.adminapi.administrator").login(adminpassword="xxxxxxxxxxx xx",adminuserid="admin")>

          <cfset myObj = createObject("component","cfide.adminapi.runtime")>

          <cfset myObj.clearTrustedCache()> <!--- this throws the error --->

<!--- Use this to log in: --->

<cfset adminObj = createObject("component","cfide.adminapi.administrator")>

<cfset adminObj.login("your_cfAdmin_password")>

<!---Then get the runtime service, which includes methods for clearing cache --->

<cfset rtService = createObject("component","cfide.adminapi.runtime")>

<!--- Examine the methods and their signatures--->

<!--- <cfdump var="#rtService#">--->

<!--- Choose the method you wish to use--->

<!--- 1. Clear cache for all the templates in a specific folder, recursively--->

<!---<cfset rtService.clearTemplateFolderFromCache("absolute_path_of_folder")>--->

<!--- 2. Clear cache for specific list of - one or more - templates--->

<cfset templatePathList = "comma_delimited_list_of_absolute_paths_of_templates">

<cfset rtService.clearTrustedCache(templatePathList)>

[chewymole]

Hi BKBK,

I have tried the save class path enabled and disabled doesnt make a difference.

Also i tried the clearTrustedCache(list_of_files) with and without a list of files, does not matter, i still get a CFACCESSDENIED error on the runtime cfc. i have dumped the main cfc to log in with so i could see the user/password. i tried using it with just a password without the argument names and with, using ADMIN and my admin api user. nothing works. Here is the error i get when attempting to call the API.

Detail	[empty string]
ErrorCode	CFACCESSDENIED
ExtendedInfo	[empty string]
Message	The current user is not authorized to invoke this method.
StackTrace	coldfusion.runtime.CustomException: The current user is not authorized to invoke this method. at coldfusion.tagext.lang.ThrowTag.doStartTag(ThrowTag.java:142) at ....................

Also, i have made sure the option to disable internal Java objects is not checked.

Not sure what else to do at this point. Any ideas? is this just another one of CF11's many bugs?

Thanks

Tim

[chewymole]

BK,

Also, the caching is only affecting RAM drive files. not files stored on the hard drive.

Tim

[BKBK]

Change your Coldfusion Administrator password and see what happens.

[chewymole]

Hmm

same error.

[BKBK]

1. You should take the following into consideration when changing the password:

Pete_freitag wrote:

Is your CF admin setup with multiple users, or a single root / admin user? If multiple users you need to use the root admin user and make sure your user does not have it under Prohibited Roles?

2. Is there perhaps another version of ColdFusion on the same server?

[Guest]

Just a thought: in your Server Settings, do you have this enabled?

Disable access to internal ColdFusion Java components

Disables the ability for CFML code to access and create Java objects that are part of the internal ColdFusion implementation. This prevents an unauthenticated CFML template from reading or modifying administration and configuration information for this server.

[chewymole]

Hi Pawel

no this option is not checked.

[chewymole]

Guys

This is only affecting VFS/RAM drive files.

We were already having issues with RAM drive with this bug: Bug#3928294 - Global Memory Limit for In-Memory Virtual FileSystem exceeded messages on createObject...

And my forum post asking for help : CF11 VFS error: The Global Memory Limit 1000 MB for In-Memory Virtual FileSystem exceeded .on the issue with no resolution. This issue is happening on the same server, but a different application that uses the VFS exclusively as its source for cfm pages. Although this issue is not throwing the above mentioned bug error we are also not able to effectivly clear the template cache from the ram drive file system.

Again i can modify a c:\sites\cms\index.cfm and my changes show up each time without having to clear the cache in CFAdmin. Its the changes that are made to the VFS files that are not showing up until i log into the CF Admin and click the clear template cache button. That is not so bad if i can automate that with the API but I cant do that either.

Any help is greatly appreciated. And i am wondering if anyone else can replicate my results?

Thanks again

Tim

[BKBK]

Have you tried this setting in the Coldfusion Administrator?

[MichaelXMongeau]

Was this issue ever resolved?  I am having the same problem (CF11 / HF 7).  I created a "cache" user with the allowed role "Server Settings" and I can log into the UI and clear the cache.  Using the API results in Access Denied. Same thing if I used the primary Admin account, which has all roles.  What is going on?  This always worked fine in CF9.

Michael

[MichaelXMongeau]

Okay, I solved my issue.  I was passing the login arguments in the wrong order - (username,password) instead of (password,username).  Once I put them in the correct order it started working.

Michael