Skip to main content
Question

API Error Ora-20105 The directory id is not allowed to run the application

  • February 19, 2026
  • 3 replies
  • 277 views

Forum|alt.badge.img

I’m trying to test AccountSet (GET) API IFS Cloud Demo environment as follows. Im able to retrieve the bearer token using following IAM client but once I pass the bearer token to the API it gives me following error. Appreciate if you can help with resolving this error.

 

{

    "error": {

        "code": "DB_ACCESS_ERROR",

        "message": "Database access error. Contact administrator.",

        "details": [

            {

                "code": 20105,

                "message": "ORA-20105: Login.FUSRNULL: The directory id XXX is not allowed to run the application."

            }

        ]

    }

}

3 replies

Forum|alt.badge.img+1
  • Do Gooder (Partner)
  • August 27, 2026

I am also getting the same error. if you have  the solution kindly share


Forum|alt.badge.img+10

​@kulind,

In order to troubleshoot this error it would be helpful to get the following details:

  • package name
  • release level of IFS Cloud in use
  • user account in use to execute the package
  • permissions, i.e. database roles and privileges, granted to the user account

Kelum Pradeep Kumara
Superhero (Employee)
Forum|alt.badge.img+18

The error means your bearer token is valid, but IFS cannot map the identity inside it to an active IFS user. Authentication at the IAM level succeeded; the failure is one step later when the IFS backend tries to resolve your token's directory ID to a real application user.
 

The most common cause is that the IAM client was not fully configured to create and activate an IFS service user.


Can you try below:
 

Go to Solution Manager > Users and Permissions > Identity and Access Manager > IAM Client and open the client you are using.
 

Make sure all four of these are enabled:

Service Accounts - Yes
Direct Access Grants - Yes
Create IFS Service User - Yes
Activate IFS Service User - Yes

When Create IFS Service User is enabled, IFS automatically creates a service user whose Directory ID matches the IAM service account name (service-account-<your_client_id>). If this was skipped during setup, the IFS user simply does not exist and every API call returns FUSRNULL.
 

Navigate to Solution Manager > Users and Permissions > Users,
find the newly created service user, go to User Permissions, and grant a permission set that includes access to the entities you need (e.g. Customer/AccountSet projections).

Obtain a fresh bearer token and retry your AccountSet GET call.