An error 404 would suggest the URL was bad, (I.e. Wrong endpoint.)  401 is usually a permission error. Which is how a Web service indicates that the user making the request did not have permissions.

Try that with the User App admin account, which has all the permissions and I suspect it will work. So check that the object defined i the GCV cdsRoleAdministratorDN exists and that the password in Named Password cdsRoleAdministratorPassword has a value.

Very often the Named Password is wiped out, and you do not notice.  I often when using one of these token, drop in a code block, of if Named PAssword not equals Regex .+ then trace out at level 0 that the password is blank. 

Hi Geoffrey Carman,

We have recently migrated these drivers to new servers (Where IDM newly installed) and old driver the same add logic is working.Not getting how the permissions are failed for same object which using old edirectoy server.

Thanks

Naveen 

If this stopped working after moving the drivers to new server, check that all required GCVs and Named passwords are copied to new server.

Remember, all GCVs and Named passwords are per server.

Hi Sebastijan,

Even I have passed the hard coded password in the logic, still same error we have received.

Thanks

Naveen

Do we need to pash full URL like "https://userappurl/idmdash or enough https://UserappUrl.

Currently passing without idmpash. is throwing an error.

Thanks

Naveen

Hi Naveen,

when using the API from driver policies you should not use the URL to "talk to" the frontend, rather the URL to talk to the Web Service layer; typical URL to use for a ADD or REMOVE role looks like this:

https://ua01.dev.mycorp.me:8543/IDMProv

The IDMProv endpoint is the one to use in most cases.

You should have by default a GCV set at driverset level; by default that GCV is called UAProvURL (Display Name = User Application Provisioning Services URL), visible in the "Advanced Settings" GCV tab.

Hope this helps!

I'm a bit late, but wanted to add this as a note for anybody else coming across this post, the similarly named UAProvAdmin is in the wrong format to be put in the authorized user DN field, you need a comma-separated QDN

JakantanaAlso as noted earlier, those GCVs are at the DriverSet level. Someone improperly importing a project from IDV is very likely to lose the linkage of those objects to the Driver set object (DirXML-Policy object) and in that case, it would be unavailable.  This and Named Passwords lost are the most common causes I see.

Also, you can use simply uaadmin if there is but one, in the scope f the User Apps' search for users.  If not, you need to use the full LDAP DN.