Authorization failed. The user is either not assigned as a contact, or the assigned contact is not authorized to use the product. Click here to log in to the product again. APM and EEM integration has been enabled and EEM is also integrated with AD. User are able to connect to PAM without any issues as PAM is also using the same EEM.
Even though they had previously authorized these users on APM it was still returning this error.
We had to:
1) temporarily please switch back to internal users (after saving the AD connection strings so we can make sure to switch it back properly)
2) See if you find uapmadmin. There would be no reason for this account to be deleted since internal users are not valid once you switch to AD.
Remember you would need to find it under the application group and not grobal users.
If uapmadmin is still gone (indicating that for some unknown reason it was removed even if it was not valid once you moved to AD anyway) and the serviceDesk account is not in fact a full service admin (not just an admin) with permission to authenticate other users, then we might be forced to rerun the setup to recreate uapmadmin.
3) Login to APM (ITAM) with uapmadmin and remove the new users you are trying to authenticate from the authentication list.
4) Add the users back to the authentication list by using the Administration - User/Role Management - Role Search.
Also make sure you search for the user name when you add them back and select it this way.