IBM Support

IBM Security Guardium: OAUTH "access denied" error when querying RestAPI with LDAP user

Troubleshooting


Problem

Setting up RestAPI, the Register the application and get the token successfully.

https://www.ibm.com/docs/en/gdp/12.x?topic=commands-using-guardium-rest-apis#using_rest_api__register_api__title__1

When actually querying RestAPI with an LDAP user, an access denied error is returned.

OAUTH error {"error":"access_denied","error_description":"Access is denied"} 

Symptom

OAuth token retrieval succeeds
Subsequent REST calls return { "error":"access_denied","error_description":"Access is denied" }.

Cause

Missing parameters LDAP username and password.

Resolving The Problem

When runing the command to get the token,  include these parameter in the command:

&username=<LDAP User>&password=<LDAP Password>

When running the RestAPI calls, include the following parameter:

grant_types=password


Examples 

Using separate --data-urlencode arguments:

curl -k --proxy https://mysite.example.com:9090 -X POST \
 -H "Content-Type: application/x-www-form-urlencoded" \
 --data-urlencode "client_id=MYRESTCLIENT" \
 --data-urlencode "client_secret=0000-000-0000-000" \
 --data-urlencode "grant_type=password" \
 --data-urlencode "username=MYRESTCLIENT" \
 --data-urlencode "password=p@$$w0Rd" \
 "https://myguardiumappliance.example.com:8443/oauth/token"


2/ Example using -d switch, with the additional parameters included.

curl -k --proxy https://mysite.example.com:9090 -X POST \
 -H "Content-Type: application/x-www-form-urlencoded" \
 -d "client_id=MYRESTCLIENT&client_secret=0000-000-0000-000&grant_type=password&username=MYRESTCLIENT&password=p%40%24%24w0Rd" \
 "https://myguardiumappliance.example.com:8443/oauth/token"

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB76","label":"Data Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSDKGA","label":"IBM Guardium Data Protection"},"ARM Category":[{"code":"a8m0z000000Gp0MAAS","label":"AUTHENTICATION"},{"code":"a8m0z0000001errAAA","label":"GRDAPI"},{"code":"a8m0z0000001h0MAAQ","label":"LDAP"}],"ARM Case Number":"TS021517567","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"and future releases;12.2.2"}]

Document Information

Modified date:
13 May 2026

UID

ibm17272683