ARTIFACTORY: Resolving "Request failed with status code 400" When Generating Access Tokens in JFrog Artifactory Due to User Account Lock

Description 

Users may encounter the following error message when attempting to generate Access Tokens through the JFrog Artifactory UI:
UI Error Message:

Request failed with status code 400

Root Cause 

When you meet the same error message in UI, please run following API to generate the same Access Token for further investigation:

curl --location 'http://127.0.0.1:8082/access/api/v1/tokens' \
--header 'Content-Type: application/json' \
--header 'Authorization: Bearer <access-token>\
--header 'Host: 127.0.0.1:8082' \
--data '{
  "name": "zhltest1",
  "description": "Support bundle generated because of issue with XYZ",
  "include_reference_token": true,
  "username": "test"
}'

If the API returns the following response with error description, we can identify that the root cause is typically a locked or disabled user account status that prevents access token generation:

{
  "error" : "invalid_request",
  "error_description" : "User test is not enabled and has user status locked."
}

Resolution 

To resolve such issue, please follow the steps below:

1. Identify the Locked User Account
First, confirm if the user account is experiencing the lock status by using this API call:
(the username is “test”)

curl -X GET 'http://127.0.0.1:8082/access/api/v2/users/test' \
-H 'Authorization: Bearer <admin token>\
-H 'Content-Type: application/json'

Expected Response for a Locked Account is as following:

{
  "username" : "test",
  "email" : "test@test.com",
  "admin" : false,
  "effective_admin" : false,
  "profile_updatable" : true,
  "disable_ui_access" : false,
  "internal_password_disabled" : false,
  "last_logged_in" : null,
  "realm" : "internal",
  "groups" : [ "readers" ],
  "status" : "locked"
}

Note the "status": "locked" field confirms the account is locked.

2. Unlock the User Account
Use the following API call to unlock the user account:
(the username is “test”)

curl -X POST 'http://127.0.0.1:8082/access/api/v2/users/test/unlock' \
-H 'Authorization: Bearer <admin token>'

3.Verify the new Account Status
After unlocking, verify the account status has been changed to "enabled":
(the username is “test”)

curl -X GET 'http://127.0.0.1:8082/access/api/v2/users/test' \
-H 'Authorization: Bearer <admin token>' \
-H 'Content-Type: application/json'

Expected Response After Unlocking:

{
  "username" : "test",
  "email" : "test@test.com",
  "admin" : false,
  "effective_admin" : false,
  "profile_updatable" : true,
  "disable_ui_access" : false,
  "internal_password_disabled" : false,
  "last_logged_in" : null,
  "realm" : "internal",
  "groups" : [ "readers" ],
  "status" : "enabled"
}

Note the "status": "enabled" field confirms the account is unlocked.

4. Generate the Access Token again via UI or API
Rerun the access token generation again, and this time it will be generated successfully.