Weblogic Console Access Denied - Admin Role group question

Question

I need to grant access to a user that is authenticated via OAM.
My authentication is succeeding and I am getting the following back as my Principal:
<weblogic.security.service.internal.WLSIdentityServiceImpl.getIdentityFromSubject Subject: 3
     Principal = class weblogic.security.principal.WLSUserImpl("IdentityGuardAppID")
     Principal = class weblogic.security.principal.WLSGroupImpl("cn=FUNC-LDAP-Browse,ou=secure,o=admin")
     Principal = class weblogic.security.principal.WLSGroupImpl("cn=FUNC-IDV-APP,ou=secure,o=admin")
My authorization is failing and I think it's because I cannot figure out how to add the groups returned above to the Admin role in WLS.
Normally, this is a breeze - I simply add it from the Realm Role under the Roles and Policies tab in myrealm.
In this case, my group looks like a subject DN (i.e., it contains commas).
Does anyone know how to add a group that contains a comma to the Admin Role?

Answer 1

Hi Sameer Gawde,
Would you please let me know complete error messages when use RSAT and PowerShell?
In addition, the RSAT is based on MMC console. Please check if you have enabled group policy setting to restrict
MMC snap-ins? In GPME, please refer to the path: User Configuration-> Policies-> Administrative Templates-> Windows Components-> Microsoft Management Console-> Restrict users to the explicitly permitted list of snap-ins. Meanwhile, please check
if you configure the Don't run specified Windows applications setting (path:
User Configuration-> Policies-> Administrative Templates-> System-> configure) to limit RSAT and apply to the domain admin group. This issue is really strange. Just please check and confirm. Thanks for understanding.
Please logon DC via Admin account, then navigate to: ADUC-> Users. Please select and right click Domain
Admins group and select Properties. Please select Member Of tab and check which did this group member of.
Meanwhile, please open Component Services and expand “Component Services-> Computers-> My Computer”. 
Then right click My Computer and select Properties. In COM Security tab, under Access Permissions, please check how configure the “Edit Limit”.
By the way, please navigate to Event Viewer and check if can find some related clues.
Hope this helps.
Best regards,
Justin Gu