title: AccessDeniedException when i'm creating Group and User in aem 6.2 (6.1) programmatically?
body: <p>I want to create Group first and then User and then i want to add user to group using getServiceResourceResolver(map) or loginService("datawrite",null).</p>
  
  <p>I tried following code and i'm getting exception at the time of session save (adminSession.save()):</p>
  
  <pre><code>    public void addGroupUser(SlingHttpServletRequest request) {
          log.info("----------------------------------------&gt; addGroupUser");
          String groupName = request.getParameter("groupName");
          String userName = request.getParameter("userName");
          String password = request.getParameter("password");
  
          Session adminSession = null;
          ResourceResolver adminResolver = null;
          try {
              Map&lt;String, Object&gt; authInfoParam = new HashMap&lt;String, Object&gt;();
              authInfoParam.put(ResourceResolverFactory.SUBSERVICE, "datawrite");
              adminResolver = resolverFactory.getServiceResourceResolver(authInfoParam);
              //adminResolver = resolverFactory.getAdministrativeResourceResolver(null); //deprecated method
              adminSession = slingRepository.loginService("datawrite", null);
              log.info("----------------------------------------&gt; Session user id = {}",adminSession.getUserID());
  
              // Create UserManager Object
              final UserManager userManager = AccessControlUtil.getUserManager(adminSession);
  
              // Create a Group
              Group group= null;
              if (userManager.getAuthorizable(groupName) == null) {
                  //adminResolver.refresh();
                  group = userManager.createGroup(groupName,new SimplePrincipal(groupName),"/home/groups/test");
  
                  ValueFactory valueFactory = adminSession.getValueFactory();
                  Value groupNameValue = valueFactory.createValue(groupName, PropertyType.STRING);
                  group.setProperty("./profile/givenName", groupNameValue);
                  //adminResolver.commit();
                  log.info("----------------------------------------&gt; {} Group successfully created.",group.getID());
              } else {
                  log.info("----------------------------------------&gt; Group already exist..");
              }
  
              // Create a User
              User user = null;
              if (userManager.getAuthorizable(userName) == null) {
                  //adminResolver.refresh();
                  user=userManager.createUser(userName, password,new SimplePrincipal(userName),"/home/users/test");
  
                  ValueFactory valueFactory = adminSession.getValueFactory();
                  Value firstNameValue = valueFactory.createValue("Arpit", PropertyType.STRING);
                  user.setProperty("./profile/givenName", firstNameValue);
  
                  Value lastNameValue = valueFactory.createValue("Bora", PropertyType.STRING);
                  user.setProperty("./profile/familyName", lastNameValue);
  
                  Value emailValue = valueFactory.createValue("arpit.p.bora@gmail.com", PropertyType.STRING);
                  user.setProperty("./profile/email", emailValue);
                  //adminResolver.commit();
                  log.info("----------------------------------------&gt; {} User successfully created.",user.getID());
              } else {
                  log.info("----------------------------------------&gt; User already exist..");
              }
  
              // Add Users to Group
              Group addUserToGroup = (Group)(userManager.getAuthorizable(groupName));
              addUserToGroup.addMember(userManager.getAuthorizable(userName));
              adminSession.save();
  
          }catch (Exception e) {
              log.info("----------------------------------------&gt; Not able to perform User Management..");
              log.info("----------------------------------------&gt; Exception.." + e.getMessage());
          } finally {
              if (adminSession != null &amp;&amp; adminSession.isLive()) {
                  adminSession.logout();
              }
              if (adminResolver != null)
                  adminResolver.close();
          }
      }
  </code></pre>
  
  <p>Exception log is:</p>
  
  <pre><code>    javax.jcr.AccessDeniedException: OakAccess0000: Access denied
      at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:231)
      at org.apache.jackrabbit.oak.api.CommitFailedException.asRepositoryException(CommitFailedException.java:212)
      at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.newRepositoryException(SessionDelegate.java:670)
      at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.save(SessionDelegate.java:496)
      at org.apache.jackrabbit.oak.jcr.session.SessionImpl$8.performVoid(SessionImpl.java:419)
      at org.apache.jackrabbit.oak.jcr.delegate.SessionDelegate.performVoid(SessionDelegate.java:274)
      at org.apache.jackrabbit.oak.jcr.session.SessionImpl.save(SessionImpl.java:416)
      ...
  Caused by: org.apache.jackrabbit.oak.api.CommitFailedException: OakAccess0000: Access denied
      at org.apache.jackrabbit.oak.security.authorization.permission.PermissionValidator.checkPermissions(PermissionValidator.java:212)
      at org.apache.jackrabbit.oak.security.authorization.permission.PermissionValidator.childNodeAdded(PermissionValidator.java:150)
      at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeAdded(VisibleValidator.java:104)
      at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeAdded(VisibleValidator.java:104)
      at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeAdded(VisibleValidator.java:104)
      at org.apache.jackrabbit.oak.spi.commit.VisibleValidator.childNodeAdded(VisibleValidator.java:32)
      at org.apache.jackrabbit.oak.spi.commit.CompositeEditor.childNodeAdded(CompositeEditor.java:108)
      ...
  </code></pre>
  
  <p>I have "datawrite" service mapping with system user in “Apache Sling Service User Mapper Service” which is configurable in the OSGI configuration admin interface.</p>