IT21968: All LDAP operations in the OAM hang after running REFRESH SECURITY

APAR status

• Closed as program error.

Error description

• A queue manager becomes unresponsive after using MQ Explorer to
  refresh Authorization Service and Connection Authentication, or
  running the REFRESH SECURITY TYPE(AUTHSERV) command.
  
  TYPE(AUTHSERV) is the default.  REFRESH SECURITY commands with
  other values of TYPE are unaffected.
  

Local fix

• Restart queue manager.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Users who have set up the queue manager (using an AUTHINFO
  object) to obtain authorization info from LDAP servers, and who
  then run REFRESH SECURITY TYPE(AUTHSERV).
  
  TYPE(AUTHSERV) is the default.  REFRESH SECURITY commands with
  other values of TYPE are unaffected.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  Following the REFRESH SECURITY command, the queue manager's OAM
  had invalidated its cache of username/password configuration for
  the LDAP server, and was attempting to break and remake its
  connection to the LDAP server.
  
  However, this activity was taking place on a thread that was
  currently in the middle of LDAP rebind processing during an
  ldap_search, at which time it is not valid to break and remake a
  connection.
  

Problem conclusion

• The queue manager OAM code has been corrected so that a
  connection that has to be failed during rebind processing due to
  changing configuration, does so successfully.  Instead the
  rebind processing fails and is retried when context has been
  cleaned up and it becomes safe to retry.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v8.0       8.0.0.8
  v9.0 CD    9.0.4
  v9.0 LTS   9.0.0.3
  
  The latest available maintenance can be obtained from
  'WebSphere MQ Recommended Fixes'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006037
  
  If the maintenance level is not yet available information on
  its planned availability can be found in 'WebSphere MQ
  Planned Maintenance Release Dates'
  http://www-1.ibm.com/support/docview.wss?rs=171&uid=swg27006309
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM MQ APPL M20

• Fixed component ID

  5725S1400

Applicable component levels

• R800 PSY

     UP