Troubleshoot authorization

Use these solutions to diagnose and resolve common authorization issues in automation orchestrator.

Cannot access a workflow or credential

Symptom: You receive an "Access denied" or "Forbidden" error when attempting to view, edit, or execute a workflow or credential.

Resolution:

  • Verify your group memberships: 
    curl https://orchestrator.example.com/api/v1/auth/me \
  -H "Authorization: Bearer $ACCESS_TOKEN"
  • Check your effective permissions: 
    curl -X POST https://orchestrator.example.com/api/v1/authz/what_can_i \
  -H "Authorization: Bearer $ACCESS_TOKEN"
  • Use the authorization check API to see why access is denied: 
    curl -X POST https://orchestrator.example.com/api/v1/authz/can_i \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "action": "read",
    "resource_type": "workflow",
    "resource_id": "resource-id"
  }'

    Review matched_policy and denial_reason in the response to identify why access is denied.

  • Grant appropriate role assignments to the user or their groups through Access Management > Assignments.

User can view but not run a workflow

Symptom: You can see workflow details but receive "Access denied" when attempting to run.

Resolution:

  • Verify your permissions using POST /api/v1/authz/can_i with "action": "run" and "resource_type": "execution".
  • The execution:run permission is separate from workflow:read. The auditor role grants read access but not run access.
  • Assign the user role or project-user role to the user or their group through Access Management > Assignments.

Permission changes not taking effect

Symptom: Role assignments were changed but you still cannot access resources.

Resolution:

  • Log out and log back in to refresh session and group memberships.
  • Verify the identity provider is sending updated group claims.
  • If the problem persists, revoke the user's sessions to force re-authentication.

Groups not inheriting permissions correctly

Symptom: You belong to a group but do not have the expected permissions from that group.

Resolution:

  • Verify group role assignments: 
    curl "https://orchestrator.example.com/api/v1/role_assignments?group_id[isnull]=false" \
  -H "Authorization: Bearer ADMIN_ACCESS_TOKEN"
  • Verify the user's group memberships have the expected role assignments.
  • Use POST /api/v1/authz/can_i to test the specific action. Review matched_policy, denial_reason, and denied_by to understand which policies are affecting the decision.

Cannot manage role assignments

Symptom: You receive "Access denied" when attempting to assign or revoke roles.

Resolution:

  • Verify you have the required permission using POST /api/v1/authz/can_i with "action": "assign" and "resource_type": "role-assignment".
  • The admin and project-admin roles grant the role-assignment:assign permission.
  • Contact an administrator to assign you the appropriate role.

Authorization evaluation is slow

Symptom: Authorization checks take longer than expected, causing slow page loads or API responses.

Resolution:

  • Review your group memberships using GET /api/v1/auth/me.
  • If you belong to 50+ groups, consider consolidating group memberships.
  • Contact an administrator to review policy performance.