title: WSO2 API Manager and IS as Keymanager: User not authorized for Application
body: <p>I've set up the API Manager and the IS as Key Manager. (2.1.0 and 5.3.0)
  Furthermore I've set up a Primary and a Secondary Userstore.</p>
  
  <p>We've created Users in the Secondary Userstore and used them to subscribe to Applications succesfully in the past, but suddenly, that does not work anymore.</p>
  
  <p>When creating an application to subscribe APIs to and then generating the access tokens the AM and IS throw errors.</p>
  
  <p><strong>IS:</strong></p>
  
  <pre><code>TID: [-1234] [] [2017-10-17 09:07:37,479]  WARN {org.wso2.carbon.identity.application.mgt.ApplicationManagementServiceImpl} -  Illegal Access! User EXTERNAL/test@test.com does not have access to the application EXTERNAL_test-AT-test.com_201710170906_SANDBOX
  TID: [-1234] [] [2017-10-17 09:07:37,480] ERROR {org.wso2.carbon.apimgt.impl.utils.APIUtil} -  Error occurred while creating ServiceProvider for app EXTERNAL_test-AT-test.com_201710170906_SANDBOX
  org.wso2.carbon.identity.application.common.IdentityApplicationManagementException: Error occurred while updating the application: EXTERNAL_test-AT-test.com_201710170906_SANDBOX
      at org.wso2.carbon.identity.application.mgt.ApplicationManagementServiceImpl.updateApplication(ApplicationManagementServiceImpl.java:300)
  [...]
  Caused by:  org.wso2.carbon.identity.application.common.IdentityApplicationManagementException: User not authorized
      at org.wso2.carbon.identity.application.mgt.ApplicationManagementServiceImpl.updateApplication(ApplicationManagementServiceImpl.java:277)
  </code></pre>
  
  <p><strong>AM:</strong></p>
  
  <pre><code>TID: [-1234] [] [2017-10-17 09:07:37,490] ERROR {org.wso2.carbon.apimgt.impl.AMDefaultKeyManagerImpl} -  Can not create OAuth application  : 201710170906_SANDBOX {org.wso2.carbon.apimgt.impl.AMDefaultKeyManagerImpl} 
  org.wso2.carbon.apimgt.keymgt.stub.subscriber.APIKeyMgtSubscriberServiceAPIManagementException: APIKeyMgtSubscriberServiceAPIManagementException
  [...]
  TID: [-1234] [] [2017-10-17 09:07:37,492] ERROR {org.wso2.carbon.apimgt.impl.utils.APIUtil} -  Error occurred while executing SubscriberKeyMgtClient. {org.wso2.carbon.apimgt.impl.utils.APIUtil}
  org.wso2.carbon.apimgt.api.APIManagementException: Can not create OAuth application  : 201710170906_SANDBOX
  [...]
  Caused by: org.wso2.carbon.apimgt.keymgt.stub.subscriber.APIKeyMgtSubscriberServiceAPIManagementException: APIKeyMgtSubscriberServiceAPIManagementException
      at sun.reflect.GeneratedConstructorAccessor339.newInstance(Unknown Source)
      at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
  </code></pre>
  
  <p>I've tried and tested a couple things and verified in the database (Oracle) directly:</p>
  
  <ul>
  <li>When I create an application it is created in the database. (key store)</li>
  <li>When I subscribe to an api, the link between api and app is created in the database. </li>
  <li>When I generate the access tokens the errors occur, the role for the user is created. (auth store)
  
  <ul>
  <li>"View Users" on the role shows the users having the role.</li>
  <li>"View Roles" on the user does not show the user having the role. </li>
  <li>SP_APP table in the database contains the newly created application, but without an access token.</li>
  </ul></li>
  <li>When I delete the application
  
  <ul>
  <li>the SP_APP stays in the database.</li>
  <li>the Role stays in the database.</li>
  </ul></li>
  </ul>
  
  <p>But now for the tricky part:
  Everything works fine for users in the Primary Userstore.</p>
  
  <p>And the really tricky part:
  Sometimes (like once every 15-20 times), the token generation for Secondary Users works. <br /></p>
  
  <p><strong>[EDIT]</strong></p>
  
  <p>Further investigation lead me to the assumption, that something is wrong with the user/role caching/reading. </p>
  
  <p><strong>Logs from the key manager:</strong></p>
  
  <p>Questions: </p>
  
  <ul>
  <li>Why does the <code>org.apache.axis2.transport.http.AxisServlet</code> throw an NPE?</li>
  <li>Shouldn't the <code>2017-10-18 19:46:28,877</code> part work after it created the roles in the DB without a problem?</li>
  </ul>
  
  <p>The full log:</p>
  
  <pre><code>[2017-10-18 19:46:28,732] DEBUG -  Created singleton instance for org.wso2.carbon.identity.auth.service.handler.HandlerManager {org.wso2.carbon.identity.auth.service.handler.HandlerManager}
  [2017-10-18 19:46:28,733] DEBUG -  Get first priority handler for the given handler list. {org.wso2.carbon.identity.auth.service.handler.HandlerManager}
  [2017-10-18 19:46:28,733] DEBUG -  Get first priority handler : DefaultAuthenticationManager(org.wso2.carbon.identity.auth.service.AuthenticationManager) {org.wso2.carbon.identity.auth.service.handler.HandlerManager}
  [2017-10-18 19:46:28,733] DEBUG -   {org.apache.axis2.transport.http.AxisServlet}
  java.lang.NullPointerException
      at javax.servlet.GenericServlet.getServletContext(GenericServlet.java:123)
      at org.apache.axis2.transport.http.AxisServlet.createMessageContext(AxisServlet.java:715)
      at org.apache.axis2.transport.http.AxisServlet.createMessageContext(AxisServlet.java:741)
      at org.apache.axis2.transport.http.AxisServlet.doPost(AxisServlet.java:138)
      at org.wso2.carbon.core.transports.CarbonServlet.doPost(CarbonServlet.java:231)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:650)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
      at org.eclipse.equinox.http.servlet.internal.ServletRegistration.service(ServletRegistration.java:61)
      at org.eclipse.equinox.http.servlet.internal.ProxyServlet.processAlias(ProxyServlet.java:128)
      at org.eclipse.equinox.http.servlet.internal.ProxyServlet.service(ProxyServlet.java:68)
      at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
      at org.wso2.carbon.tomcat.ext.servlet.DelegationServlet.service(DelegationServlet.java:68)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:120)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.wso2.carbon.tomcat.ext.filter.CharacterSetFilter.doFilter(CharacterSetFilter.java:61)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:120)
      at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
      at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
      at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
      at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
      at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
      at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
      at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
      at org.wso2.carbon.identity.context.rewrite.valve.TenantContextRewriteValve.invoke(TenantContextRewriteValve.java:72)
      at org.wso2.carbon.identity.authz.valve.AuthorizationValve.invoke(AuthorizationValve.java:91)
      at org.wso2.carbon.identity.auth.valve.AuthenticationValve.invoke(AuthenticationValve.java:60)
      at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:99)
      at org.wso2.carbon.tomcat.ext.valves.CarbonTomcatValve$1.invoke(CarbonTomcatValve.java:47)
      at org.wso2.carbon.webapp.mgt.TenantLazyLoaderValve.invoke(TenantLazyLoaderValve.java:57)
      at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:47)
      at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:62)
      at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:159)
      at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:958)
      at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
      at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
      at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:452)
      at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1087)
      at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
      at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1756)
      at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1715)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
      at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
      at java.lang.Thread.run(Thread.java:748)
  [2017-10-18 19:46:28,734] DEBUG -  getAction (null) from org.apache.axis2.client.Options@72ca18ef {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,734] DEBUG -  Old SoapAction is (null) {org.apache.axis2.context.MessageContext}
  [2017-10-18 19:46:28,734] DEBUG -  New SoapAction is (null) {org.apache.axis2.context.MessageContext}
  [2017-10-18 19:46:28,734] DEBUG -  setAction Old action is (null) {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,734] DEBUG -  setAction New action is (null) {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,734] DEBUG -  Input contentType (application/soap+xml; charset=UTF-8; action="urn:createOAuthApplicationByApplicationInfo") {org.apache.axis2.builder.BuilderUtil}
  [2017-10-18 19:46:28,734] DEBUG -  CharSetEncoding from content-type (UTF-8) {org.apache.axis2.builder.BuilderUtil}
  [2017-10-18 19:46:28,734] DEBUG -  getAction (null) from org.apache.axis2.client.Options@72ca18ef {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,734] DEBUG -  Old SoapAction is (null) {org.apache.axis2.context.MessageContext}
  [2017-10-18 19:46:28,734] DEBUG -  New SoapAction is (urn:createOAuthApplicationByApplicationInfo) {org.apache.axis2.context.MessageContext}
  [2017-10-18 19:46:28,734] DEBUG -  setAction Old action is (null) {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,734] DEBUG -  setAction New action is (urn:createOAuthApplicationByApplicationInfo) {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,734] DEBUG -  getAction (urn:createOAuthApplicationByApplicationInfo) from org.apache.axis2.client.Options@72ca18ef {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,734] DEBUG -  SoapAction is (urn:createOAuthApplicationByApplicationInfo) {org.apache.axis2.context.MessageContext}
  [2017-10-18 19:46:28,734] DEBUG -  createSOAPEnvelope using Builder (class org.apache.axis2.builder.SOAPBuilder) selected from type (application/soap+xml) {org.apache.axis2.transport.TransportUtils}
  [2017-10-18 19:46:28,734] DEBUG -  char set encoding set from default =UTF-8 {org.apache.axis2.builder.BuilderUtil}
  [2017-10-18 19:46:28,734] DEBUG -  [MessageContext: logID=62aa565ba9f5ad1bb8a9618af3ccb60006e855dbc7d5825a] Checking for Service using target endpoint address : https://wimtest.domain.com/services/APIKeyMgtSubscriberService {org.apache.axis2.dispatchers.RequestURIBasedServiceDispatcher}
  [2017-10-18 19:46:28,735] DEBUG -  org.apache.axis2.i18n.resource::handleGetObject(servicefound) {org.apache.axis2.i18n.ProjectResourceBundle}
  [2017-10-18 19:46:28,735] DEBUG -  [MessageContext: logID=62aa565ba9f5ad1bb8a9618af3ccb60006e855dbc7d5825a] Found AxisService : APIKeyMgtSubscriberService {org.apache.axis2.engine.AbstractDispatcher}
  [2017-10-18 19:46:28,735] DEBUG -  getAction (urn:createOAuthApplicationByApplicationInfo) from org.apache.axis2.client.Options@72ca18ef {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,735] DEBUG -  SoapAction is (urn:createOAuthApplicationByApplicationInfo) {org.apache.axis2.context.MessageContext}
  [2017-10-18 19:46:28,735] DEBUG -  [MessageContext: logID=62aa565ba9f5ad1bb8a9618af3ccb60006e855dbc7d5825a] Checking for Operation using Action : urn:createOAuthApplicationByApplicationInfo {org.apache.axis2.dispatchers.ActionBasedOperationDispatcher}
  [2017-10-18 19:46:28,735] DEBUG -  getOperationBySOAPAction: Operation (org.apache.axis2.description.InOutAxisOperation@5dd7070f,createOAuthApplicationByApplicationInfo) for soapAction: urn:createOAuthApplicationByApplicationInfo found in action map. {org.apache.axis2.description.AxisService}
  [2017-10-18 19:46:28,735] DEBUG -  org.apache.axis2.i18n.resource::handleGetObject(operationfound) {org.apache.axis2.i18n.ProjectResourceBundle}
  [2017-10-18 19:46:28,735] DEBUG -  [MessageContext: logID=62aa565ba9f5ad1bb8a9618af3ccb60006e855dbc7d5825a] Found AxisOperation : createOAuthApplicationByApplicationInfo {org.apache.axis2.engine.AbstractDispatcher}
  [2017-10-18 19:46:28,735] DEBUG -  getAddressingRequirementParemeterValue: value: 'null' {org.apache.axis2.addressing.AddressingHelper}
  [2017-10-18 19:46:28,735] DEBUG -  [MessageContext: logID=62aa565ba9f5ad1bb8a9618af3ccb60006e855dbc7d5825a] isReplyRedirected: ReplyTo is null. Returning false {org.apache.axis2.addressing.AddressingHelper}
  [2017-10-18 19:46:28,735] DEBUG -  Resolving tenant id from tenant domain {org.wso2.carbon.context.PrivilegedCarbonContext}
  [2017-10-18 19:46:28,735] DEBUG -  Authorization cache miss for username : admin resource /permission/admin/login action : ui.execute {org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager}
  [2017-10-18 19:46:28,735] DEBUG -  Roles which have permission for resource : /permission/admin/login action : ui.execute {org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager}
  [2017-10-18 19:46:28,736] DEBUG -  Role :  admin {org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager}
  [2017-10-18 19:46:28,736] DEBUG -  Role :  INTERNAL/creator {org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager}
  [2017-10-18 19:46:28,736] DEBUG -  Role :  INTERNAL/subscriber {org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager}
  [2017-10-18 19:46:28,736] DEBUG -  Role :  INTERNAL/publisher {org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager}
  [2017-10-18 19:46:28,736] DEBUG -  Retrieving internal roles for user name :  admin and search filter * {org.wso2.carbon.user.core.common.AbstractUserStoreManager}
  [2017-10-18 19:46:28,740] DEBUG -  Searching for user admin {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,740] DEBUG -  Replace escape characters configured to: true {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,740] DEBUG -  Replace escape characters configured to: true {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,740] DEBUG -  value after escaping special characters in admin : admin {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,740] DEBUG -  User: admin exist: true {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,740] DEBUG -  Replace escape characters configured to: true {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,740] DEBUG -  Reading roles with the memberOfProperty Property: memberOf {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,740] DEBUG -  Result for searchBase: CN=admin,OU=EDV,DC=test,DC=com searchFilter: (&amp;(|(objectClass=userProxyFull)(objectClass=user))(mail=admin)) property:memberOf appendDN: false {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,755] DEBUG -  Replace escape characters configured to: true {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,757] DEBUG -  Found user: CN=admin,OU=GROUPS,DC=test,DC=com {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,757] DEBUG -  Result  :  CN=admin,OU=GROUPS,DC=test,DC=com {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,757] DEBUG -  GetGroupNameAttributeValuesOfGroups with DN {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,773] DEBUG -  Using DN: CN=admin,OU=GROUPS,DC=test,DC=com {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,773] DEBUG -  Found role: admin {org.wso2.carbon.user.core.ldap.ReadOnlyLDAPUserStoreManager}
  [2017-10-18 19:46:28,774] DEBUG -  admin user has permitted resource :  /permission/admin/login, action :ui.execute {org.wso2.carbon.user.core.authorization.JDBCAuthorizationManager}
  [2017-10-18 19:46:28,774] DEBUG -  getAction (null) from org.apache.axis2.client.Options@7889e70c {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,774] DEBUG -  Old WSAAction is (null) {org.apache.axis2.context.MessageContext}
  [2017-10-18 19:46:28,774] DEBUG -  New WSAAction is (urn:createOAuthApplicationByApplicationInfoResponse) {org.apache.axis2.context.MessageContext}
  [2017-10-18 19:46:28,774] DEBUG -  setAction Old action is (null) {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,774] DEBUG -  setAction New action is (urn:createOAuthApplicationByApplicationInfoResponse) {org.apache.axis2.client.Options}
  [2017-10-18 19:46:28,774] DEBUG -  messageID is null. {org.apache.axis2.context.ConfigurationContext}
  [2017-10-18 19:46:28,778] DEBUG -  Resolving tenant id from tenant domain {org.wso2.carbon.context.PrivilegedCarbonContext}
  [2017-10-18 19:46:28,778] DEBUG -  Creating application role : Application/EXTERNAL_test-AT-test.com_201710181946_SANDBOX and assign the user : [EXTERNAL/test@test.com] to that role {org.wso2.carbon.identity.application.mgt.ApplicationMgtUtil}
  [2017-10-18 19:46:28,779] DEBUG -  Is roleName: Application/EXTERNAL_test-AT-test.com_201710181946_SANDBOX Exist: false TenantId: -1234 {org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager}
  [2017-10-18 19:46:28,783] DEBUG -  Is roleName: Application/EXTERNAL_test-AT-test.com_201710181946_SANDBOX Exist: false TenantId: -1234 {org.wso2.carbon.user.core.jdbc.JDBCUserStoreManager}
  [2017-10-18 19:46:28,792] DEBUG -  Executed a batch update. Query is : INSERT INTO UM_HYBRID_USER_ROLE (UM_USER_NAME, UM_ROLE_ID, UM_TENANT_ID, UM_DOMAIN_ID) VALUES (?,(SELECT UM_ID FROM UM_HYBRID_ROLE WHERE UM_ROLE_NAME=? AND UM_TENANT_ID=?), ?, (SELECT UM_DOMAIN_ID FROM UM_DOMAIN WHERE UM_TENANT_ID=? AND UM_DOMAIN_NAME=?)): and result is[1] {org.wso2.carbon.user.core.util.DatabaseUtil}
  [2017-10-18 19:46:28,812] DEBUG -  Creating Application EXTERNAL_test-AT-test.com_201710181946_SANDBOX for user EXTERNAL/test@test.com {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,820] DEBUG -  Application Stored successfully with application id 135 {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,822] DEBUG -  Loading Basic Application Data of EXTERNAL_test-AT-test.com_201710181946_SANDBOX {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,823] DEBUG -  ApplicationID: 135 ApplicationName: EXTERNAL_test-AT-test.com_201710181946_SANDBOX UserName: test@test.com TenantDomain: carbon.super {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,823] DEBUG -  Reading Clients of Application 135 {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,825] DEBUG -  Reading Steps of Application 135 {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,831] DEBUG -  Reading Claim Mappings of Application 135 {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,834] DEBUG -  Reading Role Mapping of Application 135 {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,874] DEBUG -  Clearing cache entry for EXTERNAL_test-AT-test.com_201710181946_SANDBOX {org.wso2.carbon.identity.provisioning.listener.ProvisioningApplicationMgtListener}
  [2017-10-18 19:46:28,874] DEBUG -  Provisioning cached entry not found for sp EXTERNAL_test-AT-test.com_201710181946_SANDBOX {org.wso2.carbon.identity.provisioning.listener.ProvisioningApplicationMgtListener}
  [2017-10-18 19:46:28,874] DEBUG -  Checking whether user has role : Application/EXTERNAL_test-AT-test.com_201710181946_SANDBOX by retrieving role list of user : EXTERNAL/test@test.com {org.wso2.carbon.identity.application.mgt.ApplicationMgtUtil}
  [2017-10-18 19:46:28,874] DEBUG -  Loading Application Name for ID: 135 {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,876] DEBUG -  ApplicationName : EXTERNAL_test-AT-test.com_201710181946_SANDBOX {org.wso2.carbon.identity.application.mgt.dao.impl.ApplicationDAOImpl}
  [2017-10-18 19:46:28,877] DEBUG -  Checking whether user has role : Application/EXTERNAL_test-AT-test.com_201710181946_SANDBOX by retrieving role list of user : EXTERNAL/test@test.com {org.wso2.carbon.identity.application.mgt.ApplicationMgtUtil}
  [2017-10-18 19:46:28,877]  WARN -  Illegal Access! User EXTERNAL/test@test.com does not have access to the application EXTERNAL_test-AT-test.com_201710181946_SANDBOX {org.wso2.carbon.identity.application.mgt.ApplicationManagementServiceImpl}
  [2017-10-18 19:46:28,877] ERROR -  Error occurred while creating ServiceProvider for app EXTERNAL_test-AT-test.com_201710181946_SANDBOX {org.wso2.carbon.apimgt.impl.utils.APIUtil}
  org.wso2.carbon.identity.application.common.IdentityApplicationManagementException: Error occurred while updating the application: EXTERNAL_test-AT-test.com_201710181946_SANDBOX
      at org.wso2.carbon.identity.application.mgt.ApplicationManagementServiceImpl.updateApplication(ApplicationManagementServiceImpl.java:300)
  </code></pre>
  
  <p>Regards,
  Mat</p>