Pemecahan masalah error runtime kebijakan AccessControl
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Anda sedang melihat dokumentasi Apigee dan Apigee hybrid.
Lihat dokumentasi
Apigee Edge.
IPDeniedAccess
Kode error
accesscontrol.IPDeniedAccess
Isi respons error
{
"fault": {
"faultstring": "Access Denied for client ip : client_IP",
"detail": {
"errorcode": "accesscontrol.IPDeniedAccess"
}
}
}
Contoh pesan error
{
"fault": {
"faultstring": "Access Denied for client ip : 104.132.196.83",
"detail": {
"errorcode": "accesscontrol.IPDeniedAccess"
}
}
}
Penyebab
Error ini terjadi jika alamat IP klien, atau alamat IP apa pun yang diteruskan sebagai bagian dari permintaan API, cocok dengan alamat IP apa pun yang ditentukan dalam elemen <SourceAddress> dalam elemen <MatchRule> dari Kebijakan Kontrol Akses, dan atribut action dari elemen <MatchRule> ditetapkan ke DENY.
Misalnya, misalkan <SourceAddress> ditentukan seperti yang ditunjukkan di bawah ini:
Jika alamat IP di atas cocok dengan alamat IP sistem klien (ditunjukkan oleh variabel proxy.client.ip), atau salah satu alamat IP yang diteruskan sebagai bagian dari permintaan API, error akan terjadi.
Diagnosis
Identifikasi alamat IP yang ditolak aksesnya untuk permintaan API tertentu. Anda dapat menemukan informasi ini di elemen faultstring respons error.
Misalnya, dalam faultstring berikut, alamat IP-nya adalah 104.132.196.83:
"faultstring": "Access Denied for client ip : 104.132.196.83"
Periksa semua kebijakan Kontrol Akses di Proxy API yang gagal dan tentukan kebijakan spesifik tempat alamat IP yang ditentukan dalam elemen <SourceAddress> cocok dengan alamat IP yang diidentifikasi dalam faultstring (Langkah 1 di atas).
Misalnya, kebijakan berikut menentukan IP <SourceAddress> sebagai 104.132.196.83, yang cocok dengan yang ada di faultstring:
Menentukan alamat IP tempat permintaan API dibuat. Hal ini dapat dilakukan dengan beberapa cara:
Menggunakan UI Trace
Rekam rekaman aktivitas untuk permintaan API yang gagal.
Pilih Kebijakan Kontrol Akses tertentu yang telah gagal dari panel sebelah kanan.
Di panel Phase Details, periksa nilai variabel proxy.client.ip seperti yang ditunjukkan dalam screenshot rekaman aktivitas sampel berikut.
Jika proxy.client.ip tidak tercantum, periksa nilai header pesan
X-Forwarded-For atau True-Client-IP.
Menggunakan Laporan Kustom
Anda dapat membuat Laporan Kustom untuk menentukan apakah kode status 403 ditampilkan selama eksekusi kebijakan Kontrol Akses dalam proxy API dan juga menentukan alamat IP klien. Hal ini sangat berguna jika masalah telah terjadi sebelumnya atau jika masalahnya bersifat intermiten dan Anda tidak dapat merekam rekaman aktivitas di UI.
Proxy, Response Status Code, Proxy Client IP, dan X-Forwarded-For-IP sebagai Dimensi.
Hal ini akan membantu Anda menentukan IP klien atau alamat IP yang diteruskan yang menyebabkan error.
Jika alamat IP klien (ditunjukkan oleh variabel proxy.client.ip), atau alamat IP apa pun yang diteruskan sebagai bagian dari permintaan API, cocok dengan alamat IP yang ditentukan dalam elemen <SourceAddress> dalam elemen <MatchRule> Kebijakan Kontrol Akses, dengan atribut action ditetapkan ke DENY, maka itulah penyebab error.
Dalam contoh yang ditampilkan di atas, nilai yang ditetapkan dalam variabel referensi proxy.client.ip (seperti yang terlihat pada screenshot rekaman aktivitas di atas) cocok dengan alamat IP yang ditentukan dalam elemen <SourceAddress> kebijakan Access Control, sehingga memicu respons error:
"faultstring": "Access Denied for client ip : 104.132.196.83"
Resolusi
Jika kebijakan Kontrol Akses dimaksudkan untuk menolak akses ke permintaan API yang berasal dari alamat IP tertentu yang tercantum dalam faultstring, pesan error akan muncul. Dalam hal ini, Anda tidak perlu melakukan tindakan tambahan apa pun.
Namun, jika Anda menentukan bahwa alamat IP tertentu dapat diberi akses ke permintaan API untuk Proxy API tertentu, ubah Kebijakan Kontrol Akses untuk mengizinkan akses ke alamat IP tersebut. Atau, Anda dapat menghapus Kebijakan Kontrol Akses dari Proxy API jika tidak ingin menolak akses ke alamat IP mana pun.
Berikut adalah contoh yang menunjukkan cara mengizinkan akses hanya ke Alamat IP 104.132.196.83 tertentu dan menolak akses untuk yang lainnya:
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-10 UTC."],[[["\u003cp\u003eThis documentation pertains to the \u003ccode\u003eaccesscontrol.IPDeniedAccess\u003c/code\u003e error in Apigee and Apigee hybrid, which occurs when a client IP is denied access by an Access Control Policy.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eaccesscontrol.IPDeniedAccess\u003c/code\u003e error is triggered when the client's IP address, or an IP passed in the request, matches an IP in the \u003ccode\u003e<SourceAddress>\u003c/code\u003e element within the \u003ccode\u003e<MatchRule>\u003c/code\u003e of an Access Control Policy with the \u003ccode\u003eaction\u003c/code\u003e attribute set to \u003ccode\u003eDENY\u003c/code\u003e.\u003c/p\u003e\n"],["\u003cp\u003eTo diagnose the issue, identify the denied IP address from the \u003ccode\u003efaultstring\u003c/code\u003e in the error response, and locate the corresponding Access Control Policy where the IP is listed in the \u003ccode\u003e<SourceAddress>\u003c/code\u003e element.\u003c/p\u003e\n"],["\u003cp\u003eThe source IP address can be determined by examining the \u003ccode\u003eproxy.client.ip\u003c/code\u003e variable in a UI Trace or by creating a custom report that includes Proxy, Response Status Code, Proxy Client IP, and X-Forwarded-For-IP as dimensions.\u003c/p\u003e\n"],["\u003cp\u003eResolving this error involves either confirming the intended denial of access or modifying the Access Control Policy to allow the specific IP address by changing the \u003ccode\u003eaction\u003c/code\u003e to \u003ccode\u003eALLOW\u003c/code\u003e or removing the Access Control Policy altogether.\u003c/p\u003e\n"]]],[],null,["# AccessControl policy runtime error troubleshooting\n\n*You're viewing **Apigee** and **Apigee hybrid** documentation.\nView [Apigee Edge](https://docs.apigee.com/api-platform/troubleshoot/policies/runtime/access-control-runtime-errors) documentation.*\n| **Note:** Was this troubleshooting playbook helpful? Please let us know by clicking [Send Feedback]().\n\nIPDeniedAccess\n--------------\n\n### Error code\n\n accesscontrol.IPDeniedAccess\n\n### Error response body\n\n```scdoc\n{\n \"fault\": {\n \"faultstring\": \"Access Denied for client ip : client_IP\",\n \"detail\": {\n \"errorcode\": \"accesscontrol.IPDeniedAccess\"\n }\n }\n}\n```\n\n### Example error message\n\n {\n \"fault\": {\n \"faultstring\": \"Access Denied for client ip : 104.132.196.83\",\n \"detail\": {\n \"errorcode\": \"accesscontrol.IPDeniedAccess\"\n }\n }\n }\n\n### Cause\n\nThis error occurs if the client IP address, or any IP address passed as part of the API request, matches any IP address(es) specified in the `\u003cSourceAddress\u003e` element within the `\u003cMatchRule\u003e` element of the Access Control Policy, and the `action` attribute of the `\u003cMatchRule\u003e` element is set to `DENY`.\n\nFor example, let's say the `\u003cSourceAddress\u003e` is defined as shown below: \n\n \u003cSourceAddress mask=\"32\"\u003e104.132.196.83\u003c/SourceAddress\u003e\n\nIf the above IP address matches the IP address of the client system (indicated by the variable `proxy.client.ip`), or any of the IP addresses passed as part of the API request, the error will occur.\n\n### Diagnosis\n\n1. Identify the IP address(es) denied access for a specific API request. You can find this information in the `faultstring` element of the error response.\n\n For example, in the following `faultstring`, the IP address is `104.132.196.83:` \n\n \"faultstring\": \"Access Denied for client ip : 104.132.196.83\"\n\n2. Examine all the Access Control policies in the failed API Proxy and determine the specific policy where the IP address(es) specified in the `\u003cSourceAddress\u003e` element matches the IP address(es) identified in the `faultstring` (Step 1 above).\n\n For example, the following policy defines the `\u003cSourceAddress\u003e` IP as `104.132.196.83,` which matches what is in the `faultstring`: \n\n \u003c?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"yes\"?\u003e\n \u003cAccessControl async=\"false\" continueOnError=\"false\" enabled=\"true\" name=\"Access-Control\"\u003e\n \u003cDisplayName\u003eAccess-Control\u003c/DisplayName\u003e\n \u003cProperties/\u003e\n \u003cIPRules noRuleMatchAction=\"ALLOW\"\u003e\n \u003cMatchRule action=\"DENY\"\u003e\n \u003cSourceAddress mask=\"32\"\u003e104.132.196.83\u003c/SourceAddress\u003e\n \u003c/MatchRule\u003e\n \u003c/IPRules\u003e\n \u003c/AccessControl\u003e\n\n3. Determine the IP address(es) from which the API request was made. This can be done in multiple ways:\n\n 1. Using UI Trace\n\n 1. Capture the trace for the failing API request.\n 2. Select the specific Access Control Policy that has failed from the right hand panel.\n 3. In the **Phase Details** pane, check the value of the variable `proxy.client.ip` as shown in the following screenshot of a sample trace.\n\n 4. If the `proxy.client.ip` is not listed, then check the value of the\n X-Forwarded-For or True-Client-IP message headers.\n\n 2. Using Custom Reports\n\n You can create Custom Reports to determine whether a 403 status code was thrown during the execution of the Access Control policy within the API proxy and also determine the client IP address. This is particularly useful if the issue has occurred in the past or if the issue is intermittent and you are unable to capture the trace in UI.\n\n Refer to [Creating and managing custom reports](/apigee/docs/api-platform/analytics/create-custom-reports) to understand how to create custom reports. In the custom report, choose:\n 1. **Sum of Traffic** as a Metric, and\n\n 2. **Proxy** , **Response Status Code** , **Proxy Client IP** , and **X-Forwarded-For-IP** as Dimensions.\n\n This should help you to determine the client IP or IP addresses passed that led to the error.\n4. If the client IP address (indicated by the variable `proxy.client.ip`), or any IP address passed as part of the API request, matches the IP address(es) specified in the `\u003cSourceAddress\u003e` element within the `\u003cMatchRule\u003e` element of Access Control Policy, where the `action` attribute is set to `DENY`, then that is the cause of the error.\n\n In the example shown above, the value set in the reference variable `proxy.client.ip` (as seen in the screenshot of the trace above) matches the IP address defined in the `\u003cSourceAddress\u003e` element of the Access Control policy, thus triggering the error response: \n\n \"faultstring\": \"Access Denied for client ip : 104.132.196.83\"\n\n### Resolution\n\nIf the Access Control policy is intended to deny access to API requests coming from the specific IP address(es) listed in the `faultstring`, then the error message is expected. In this case, there is no additional action is required.\n\nHowever, if you determine that the specific IP address(es) can be given access to the API requests for the specific API Proxy, then modify the Access Control Policy to allow access to those IP address(es). Alternatively, you can remove the Access Control Policy from the API Proxy if you don't want to deny access to any IP address(es).\n\nHere is an example that shows how to allow access to a specific IP Address `104.132.196.83` only and deny access for the rest: \n\n \u003cAccessControl name=\"ACL\"\u003e\n \u003cIPRules noRuleMatchAction = \"DENY\"\u003e\n \u003cMatchRule action = \"ALLOW\"\u003e\n \u003cSourceAddress mask=\"32\"\u003e104.132.196.83\u003c/SourceAddress\u003e\n \u003c/MatchRule\u003e\n \u003c/IPRules\u003e\n \u003c/AccessControl\u003e"]]
