Hello!

We have run across a slight hitch, and I'm having trouble working through it.

We host email for various domains. Some domains have been with us for years, dating back to Zimbra 5, others are fairly recent.

Last week, I went to promote one user (user1@domain1.com) to a domain administrator from the admin console, and got the following error:

Grant ACE: 1) domain1.com/domain/domainAdminConsoleRights ......Failed
Grant ACE: 1) globalacltarget/global/domainAdminZimletRights ......Failed
Done.
The user can now log into the admin console, but it is blank. Removing the checkboxes for Domain Administrator and Assign default domain administrator views and rights, saving, and then re-checking these checkboxes again does not reproduce the error.


I get these errors for any accounts of a similar age- so I'm thinking it has more to do with the age of the accounts than the domain. if I add a new email address to that domain and promote it, we get no such issues.

Begin the hunt!
I did a tail -f of mailbox.log grepping for "Grant" and when I get the error quoted above, I see this:

2013-01-22 15:04:54,651 INFO [btpool0-23324://our.domainname.com:7071/service/admin/soap/GrantRightRequest] [name=my.name@our.domain.com;ip=my.ip.add.ress;ua=Z imbraWebClient - FF3.0 (Win);] soap - GrantRightRequest

2013-01-22 15:04:54,651 INFO [btpool0-23324://our.domainname.com:7071/service/admin/soap/GrantRightRequest] [name=my.name@our.domain.com;ip=my.ip.add.ress;ua=Z imbraWebClient - FF3.0 (Win);] SoapEngine - handler exception
ExceptionId:btpool0-23324://our.domainname.com:7071/service/admin/soap/GrantRightRequest:1358885094651:db7a84d4dfa67b29 at com.zimbra.cs.account.accesscontrol.RightCommand.v alidateGrant(RightCommand.java:1112)
at com.zimbra.cs.service.admin.GrantRight.handle(Gran tRight.java:66)
2013-01-22 15:04:54,671 INFO [btpool0-23328://our.domainname.com:7071/service/admin/soap/GrantRightRequest] [name=my.name@our.domain.com;ip=my.ip.add.ress;ua=Z imbraWebClient - FF3.0 (Win);] soap - GrantRightRequest

2013-01-22 15:04:54,671 INFO [btpool0-23328://our.domainname.com:7071/service/admin/soap/GrantRightRequest] [name=my.name@our.domain.com;ip=my.ip.add.ress;ua=Z imbraWebClient - FF3.0 (Win);] SoapEngine - handler exception
ExceptionId:btpool0-23328://our.domainname.com:7071/service/admin/soap/GrantRightRequest:1358885094671:db7a84d4dfa67b29
at com.zimbra.cs.account.accesscontrol.RightCommand.v alidateGrant(RightCommand.java:1112)
at com.zimbra.cs.service.admin.GrantRight.handle(Gran tRight.java:66)
But if I make the same change to a new account on the same domain, I only see the first two lines.

I'm guessing this as something to do with the Exception ID btpool0-23328 noted above- but a quick search around the internet with that error code gave no clues.




My first goal is to understand why this is happening- and possibly determine which other accounts on our system might have this issue. The next goal would be to fix it

Has anyone seen this before?
-Nick