403 status while calling Add-TtmWebsite

Question

When running the following script on SDL Web 8 CU1 ...

import-module Tridion.TopologyManager.Automation
Add-TtmCdEnvironment -Id localStagingEnvironment `
            -EnvironmentPurpose Staging `
            -DiscoveryEndpointUrl http://localhost:9082/discovery.svc `
            -AuthenticationType OAuth -ClientId cduser `
            -ClientSecret CDUserP@ssw0rd 
Add-TtmWebsite -Id stagingVisitorsWeb `
            -CdEnvironmentId localStagingEnvironment `
            -BaseUrls http://staging.visitorsweb.local

I get this error:

Add-TtmWebsite : Unable to save item of type 'WebApplicationData' with id 
                                                     'stagingVisitorsWeb_RootWebApp'.
One or more errors occurred.
An error occurred while communicating with CD Discovery Service
        'http://localhost:9082/discovery.svc' in CD Environment 'localStagingEnvironment'. 
Response status code does not indicate success: 403 (Forbidden).

Following the advice here, I have been able to verify that the discovery service accepts a token created using the credentials used when creating the environment. So far the logs haven't given me any great insights.

What can cause this problem? How can I further investigate? Which logs should I look in, and what should I look for?

Update: The Web Capability is registered. On running the registration tool, I see this in the output:

WebCapability{id='DefaultWeb', lastUpdateTime=1460141689675}

and afterwards I still have the problem.

Answer 1

You should use cmuser instead of cduser as OAuth ClientId; cduser is intended to be used by the Web Application and has fewer permissions than cmuser.

See SDL web8 - Issue with adding a website