Knife bootstrap error - Successful authentication but not authorized for this action

Question

ERROR: You authenticated successfully to https:<chef_server_url> as <user> but you are not authorized for this action Response: missing create permission

I'm running a pretty basic bootstrap command for a Windows AWS instance

knife bootstrap windows winrm ....

Currently running the Chef server on-site and not hosted at this time. I also get the same error using knife to attempt to create a new group. I SSH'd into the Chef server and verified my user is listed when I run

sudo chef-server-ctl list-server-admins

so it appears I have been granted server-admins permissions. I also see the same errors when trying to view and create things via the web UI. I've been going in circles almost all day trying to resolve this with no luck

Answer 1

Well, this turned out to be pretty simple after all. From the terminal on the Chef server:

sudo chef-server-ctl org-user-add <org> <user> --admin

Docs - https://docs.chef.io/server_users.html

I was able to add myself to the admins group and handle other permission related task from there

Answer 2

The server-admins group means you have permission to create and modify orgs/users, for operations within a single org (like creating a new client during bootstrap) you need ACLs within that org. Generally you get this by being a member of the admins group in that org, but you can also assign yourself specific permissions manually.