# Service User denied access to Alarm API even with requiredRoles set

**URL:** <https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354>\
**Category:** Forum\
**Tags:** cumulocity\
**Created:** [October 19, 2023, 10:44am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354 "2023-10-19T10:44:23Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![user05627389](https://avatars.discourse-cdn.com/v4/letter/u/9d8465/32.png) [@user05627389](https://community.cumulocity.com/u/user05627389)\
**Post date:** [October 19, 2023, 10:44am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/1 "2023-10-19T10:44:23Z")

</div>

Product: Free trial Cumulocity IoT Backend 1018.0.229 on SaaS environment of eu-latest

Problem: I have followed the Java SDK example guide for the iptracker microservice ( /guides/microservice-sdk/java/#microservice-java )

- via cUrl application is created on tenant, bootstrap user correctly returned, subscription request ok (Status 201 at first try, subsequent calls correctly returns {“error”:“tenants/Duplicate”,“message”:“Application with id ID [type=com\_cumulocity\_model\_idtype\_GId, value=98922] is already assigned to the tenant env314296”,“info”:“/guides/reference/rest-implementat  
ion//#a-name-error-reporting-a-error-reporting”} )
- generated docker image runs locally, container goes up and stays live (health endpoint returns ok), but runtime errors occur.  
Exception are thrown, such as during the periodic microservice subscription event:

```auto
2023-10-19 10:04:50.628 WARN 8 --- [subscriptions-0] c.c.m.context.ContextServiceImpl : execution of task failed within tenant : env314296 - Http status code: 403
{error="security/Forbidden",message="Access is denied",info="<URL>/guides/reference/rest-implementation//#a-name-error-reporting-a-error-reporting",details="null"}
 tenant: env314296 user: service_iptracker-microservice
2023-10-19 10:04:50.629 ERROR 8 --- [subscriptions-0] c.m.s.s.MicroserviceSubscriptionsService : Http status code: 403
{error="security/Forbidden",message="Access is denied",info="<URL>/guides/reference/rest-implementation//#a-name-error-reporting-a-error-reporting",details="null"}
 tenant: env314296 user: service_iptracker-microservice

com.cumulocity.sdk.client.SDKException: Http status code: 403
{error="security/Forbidden",message="Access is denied",info="<URL>/guides/reference/rest-implementation//#a-name-error-reporting-a-error-reporting",details="null"}
 tenant: env314296 user: service_iptracker-microservice
        at com.cumulocity.sdk.client.ResponseParser.checkStatus(ResponseParser.java:81)
        at com.cumulocity.sdk.client.ResponseParser.parse(ResponseParser.java:63)
        at com.cumulocity.sdk.client.RestConnector.parseResponseWithoutId(RestConnector.java:364)
        at com.cumulocity.sdk.client.RestConnector.post(RestConnector.java:270)
        at com.cumulocity.sdk.client.alarm.AlarmApiImpl.create(AlarmApiImpl.java:95)
        at jdk.internal.reflect.GeneratedMethodAccessor33.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:344)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:198)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:163)
        at org.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed(DelegatingIntroductionInterceptor.java:137)
        at org.springframework.aop.support.DelegatingIntroductionInterceptor.invoke(DelegatingIntroductionInterceptor.java:124)
        at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:186)
        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:220)
        at jdk.proxy2/jdk.proxy2.$Proxy131.create(Unknown Source)
        at c8y.example.App.lambda$createAlarm$0(App.java:105)
        at com.cumulocity.microservice.context.ContextServiceImpl.callWithinContext(ContextServiceImpl.java:78)
        **at c8y.example.App.createAlarm(App.java:88)**
        at jdk.internal.reflect.GeneratedMethodAccessor31.invoke(Unknown Source)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:568)
        at org.springframework.context.event.ApplicationListenerMethodAdapter.doInvoke(ApplicationListenerMethodAdapter.java:344)
        at org.springframework.context.event.ApplicationListenerMethodAdapter.processEvent(ApplicationListenerMethodAdapter.java:229)
        at org.springframework.context.event.ApplicationListenerMethodAdapter.onApplicationEvent(ApplicationListenerMethodAdapter.java:166)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.doInvokeListener(SimpleApplicationEventMulticaster.java:176)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.invokeListener(SimpleApplicationEventMulticaster.java:169)
        at org.springframework.context.event.SimpleApplicationEventMulticaster.multicastEvent(SimpleApplicationEventMulticaster.java:143)
        at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:421)
        at org.springframework.context.support.AbstractApplicationContext.publishEvent(AbstractApplicationContext.java:378)
        at com.cumulocity.microservice.subscription.service.impl.MicroserviceSubscriptionsServiceImpl$1.apply(MicroserviceSubscriptionsServiceImpl.java:62)
        at com.cumulocity.microservice.subscription.service.impl.MicroserviceSubscriptionsServiceImpl.lambda$invokeAdded$6(MicroserviceSubscriptionsServiceImpl.java:186)
        at com.cumulocity.microservice.context.ContextServiceImpl.callWithinContext(ContextServiceImpl.java:78)
        at com.cumulocity.microservice.subscription.service.impl.MicroserviceSubscriptionsServiceImpl.invokeAdded(MicroserviceSubscriptionsServiceImpl.java:186)
        at com.cumulocity.microservice.subscription.service.impl.MicroserviceSubscriptionsServiceImpl.lambda$subscribe$2(MicroserviceSubscriptionsServiceImpl.java:132)
        at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
        at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
        at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
        at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
        at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
        at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
        at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
        at com.cumulocity.microservice.subscription.service.impl.MicroserviceSubscriptionsServiceImpl.subscribe(MicroserviceSubscriptionsServiceImpl.java:138)
        at com.cumulocity.microservice.subscription.service.impl.MicroserviceSubscriptionScheduler.lambda$schedulePeriodicSubscription$0(MicroserviceSubscriptionScheduler.java:81)
        at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539)
        at java.base/java.util.concurrent.FutureTask.runAndReset(FutureTask.java:305)
        at java.base/java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:305)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
        at java.base/java.lang.Thread.run(Thread.java:833)

```

src/main/resources/application.properties:

```auto
application.name=iptracker-microservice
server.port=80
C8Y.baseURL=<HTTPS>://env314296.eu-latest.cumulocity.com/
C8Y.bootstrap.tenant=env314296
C8Y.bootstrap.user=servicebootstrap_iptracker-microservice
C8Y.bootstrap.password=<REDACTED>
C8Y.microservice.isolation=MULTI_TENANT

```

src/main/configuration/cumulocity.json:

```auto
{
  "apiVersion": "1",
  "version": "@project.version@",
  "provider": {
    "name": "Cumulocity GmbH"
  },
  "isolation": "MULTI_TENANT",
  "settings": [
    {
      "key": "ipstack.key",
      "defaultValue": "<REDACTED>"
    },
    {
      "key": "tracker.id",
      "defaultValue": "761224"
    }
  ],
  "livenessProbe": {
    "httpGet": {
      "path": "/health"
    },
    "initialDelaySeconds": 60,
    "periodSeconds": 10
  },
  "readinessProbe": {
    "httpGet": {
      "path": "/health",
      "port": 80
    },
    "initialDelaySeconds": 20,
    "periodSeconds": 10
  },
  "requiredRoles": [
    "ROLE_EVENT_READ",
    "ROLE_EVENT_ADMIN",
    "ROLE_ALARM_READ",
    "ROLE_ALARM_ADMIN"
  ],
  "roles": []
}

```

As per my understanding the ROLE\_ALARM\_ADMIN should allow me to create alarms, but the service user seems unable to do so

---

<div class="post-metadata">

**Author:** ![user05627389](https://avatars.discourse-cdn.com/v4/letter/u/9d8465/32.png) [@user05627389](https://community.cumulocity.com/u/user05627389)\
**Post date:** [October 19, 2023, 10:54am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/2 "2023-10-19T10:54:59Z")

</div>

pom.xml

```auto
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>c8y.example</groupId>
  <artifactId>iptracker-microservice</artifactId>
  <packaging>jar</packaging>
  <version>1.0.0-SNAPSHOT</version>
  <name>iptracker-microservice</name>
  <url>http://maven.apache.org</url>
  <properties>
    <java.version>17</java.version>
    <maven.compiler.source>${java.version}</maven.compiler.source>
    <maven.compiler.target>${java.version}</maven.compiler.target>
    <spring-boot-dependencies.version>2.5.14</spring-boot-dependencies.version>
    <c8y.version>1018.0.229</c8y.version>
    <microservice.name>iptracker-microservice</microservice.name>
  </properties>
  <repositories>
    <repository>
        <id>cumulocity</id>
        <layout>default</layout>
        <url>https://download.cumulocity.com/maven/repository</url>
    </repository>
</repositories>
<pluginRepositories>
    <pluginRepository>
        <id>public</id>
        <url>https://download.cumulocity.com/maven/repository</url>
    </pluginRepository>
</pluginRepositories>
<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.nsn.cumulocity.clients-java</groupId>
            <artifactId>microservice-dependencies</artifactId>
            <version>${c8y.version}</version>
            <type>pom</type>
            <scope>import</scope>
        </dependency>
    </dependencies>
</dependencyManagement>
<dependencies>
    <dependency>
        <groupId>com.nsn.cumulocity.clients-java</groupId>
        <artifactId>microservice-autoconfigure</artifactId>
        <version>${c8y.version}</version>
    </dependency>
    <dependency>
        <groupId>com.fasterxml.jackson.core</groupId>
        <artifactId>jackson-databind</artifactId>
        <scope>compile</scope>
    </dependency>
    <dependency>
        <groupId>net.minidev</groupId>
        <artifactId>json-smart</artifactId>
        <version>2.5.0</version>
    </dependency>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>3.8.1</version>
      <scope>test</scope>
    </dependency>
  </dependencies>
<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <version>${spring-boot-dependencies.version}</version>
            <configuration>
                <mainClass>c8y.example.App</mainClass>
            </configuration>
            <executions>
                <execution>
                    <goals>
                        <goal>repackage</goal>
                    </goals>
                </execution>
            </executions>
        </plugin>
        <plugin>
            <groupId>com.nsn.cumulocity.clients-java</groupId>
            <artifactId>microservice-package-maven-plugin</artifactId>
            <version>${c8y.version}</version>
            <executions>
                <execution>
                    <id>package</id>
                    <phase>package</phase>
                    <goals>
                        <goal>package</goal>
                    </goals>
                    <configuration>
                        <name>${microservice.name}</name>
                        <image>${microservice.name}</image>
                        <encoding>UTF-8</encoding>
                    </configuration>
                </execution>
            </executions>
        </plugin>
    </plugins>
</build>
</project>

```

---

<div class="post-metadata">

**Author:** ![Korbinian\_Butz](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/korbinian_butz/32/10473_2.png) [@Korbinian\_Butz](https://community.cumulocity.com/u/Korbinian_Butz)\
**Post date:** [October 19, 2023, 11:12am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/3 "2023-10-19T11:12:53Z")

</div>

Hi,

your cumulocity.json differs slightly to the docs. Try setting `isolation` field in your cumulocity.json to “PER\_TENANT”, see [Microservice SDK for Java - Cumulocity IoT Guides](https://cumulocity.com/guides/microservice-sdk/java/#update-the-application-manifest).

---

<div class="post-metadata">

**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\
**Post date:** [October 19, 2023, 11:19am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/4 "2023-10-19T11:19:15Z")

</div>

I actually assume that the application has been created but the microservice with the manifest wasn’t uploaded resulting in a service user without any global permissions.  
Try to upload the microservice before you start it locally.

---

<div class="post-metadata">

**Author:** ![user05627389](https://avatars.discourse-cdn.com/v4/letter/u/9d8465/32.png) [@user05627389](https://community.cumulocity.com/u/user05627389)\
**Post date:** [October 19, 2023, 3:51pm UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/5 "2023-10-19T15:51:48Z")

</div>

Hello, thank you for the feedback.  
Unfortunately the isolation parameter set to the single or multi tenant (like the hello microservice example) does not fix the exception.  
Also, since it is the free trial I cannot upload the resulting zip file which maven creates, it failed when I tried due to permissions. Unless there is a way to upload only the manifest, but it doesn’t seem like it.

---

<div class="post-metadata">

**Author:** ![Stefan\_Witschel](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/stefan_witschel/32/31955_2.png) [@Stefan\_Witschel](https://community.cumulocity.com/u/Stefan_Witschel)\
**Post date:** [October 20, 2023, 8:00am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/6 "2023-10-20T08:00:18Z")

</div>

If the microservice feature is not enabled you cannot test it against your tenant (even not locally only).  
You might ask your SAG contact or approach Sales if the microservice features can be enabled for your tenant.

---

<div class="post-metadata">

**Author:** ![user05627389](https://avatars.discourse-cdn.com/v4/letter/u/9d8465/32.png) [@user05627389](https://community.cumulocity.com/u/user05627389)\
**Post date:** [October 23, 2023, 9:53am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/7 "2023-10-23T09:53:25Z")

</div>

Yeah, on the free trial version only the hello-world example can be executed successfully

---

<div class="post-metadata">

**Author:** ![elcarim1802](https://avatars.discourse-cdn.com/v4/letter/e/3bc359/32.png) [@elcarim1802](https://community.cumulocity.com/u/elcarim1802)\
**Post date:** [October 24, 2023, 2:14am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/8 "2023-10-24T02:14:45Z")

</div>

Hi,  
You can run microservice locally with a trial version. You don’t need to upload microservice to the platform, just call API to create an application with the required role then go to the platform and subscribe to it, and then get a bootstrap user.

 ![image](https://europe1.discourse-cdn.com/flex005/uploads/cumulocity/original/3X/3/a/3a68c2d098bfc0698eae77bce08278adfe188c7a.png)

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/flex005/user_avatar/community.cumulocity.com/system/32/31990_2.png) [@system](https://community.cumulocity.com/u/system)\
**Post date:** [April 21, 2024, 2:15am UTC](https://community.cumulocity.com/t/service-user-denied-access-to-alarm-api-even-with-requiredroles-set/7354/9 "2024-04-21T02:15:30Z")

</div>

Closed on April 21, 2024, 2:15am UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.