IC68177: PASSTICKET GENERATION FAILURE

Rational Host Access Transformation Services, Version 7.1.0.6
Rational Host Access Transformation Services, Version 7.5.1.1
Rational Host Access Transformation Services, Version 7.5.1.2
Rational Host Access Transformation Services, version 7.5.1.3
Rational Host Access Transformation Services Fix Pack 4 (7.5.1.4) for 7.5.1
Rational Host Access Transformation Services Fix Pack 5 (7.5.1.5) for 7.5.1
Rational Host Access Transformation Services Fix Pack 6 (7.5.1.6) for 7.5.1

APAR status

• Closed as program error.

Error description

• When continuosl logging - in using Web Express Logon, results in
  PassTicket generation failures because a socket connection on
  the server side is reset the following exception occurs:
  The message in server logs is "Pass Ticket Generation Failed"..
  Here is a example of the connection reset exception:
  Exception RUNTIME runtime.WelRuntimeRas.traceException()
  com.ibm.eNetwork.security.sso.cms.DCASException:
  ERROR_READING_RESPONSE(java.net.SocketException: Connection
  reset)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: Users using Credential Mapper Servlet in     *
  *                 Web Express Logon                            *
  ****************************************************************
  * PROBLEM DESCRIPTION: Passticket Generation fails randomly.   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Passticket Generation fails randomly due to a SocketException.
  This exception occurs when a request for passticket generation
  is made  after a long interval of time(a long time gap between
  two requests to the same server). Due to this long time of
  inactivity on the socket, socket is closed by the DCAS server
  while DCAS client keeps the socket open. Before sending any
  request  to the DCAS server, client checks the liveliness of
  the socket. If the socket is alive then only request is made
  else this socket is closed and a fresh connection is made.
  This test was insufficient to detect a broken socket.
  

Problem conclusion

• The test for checking the liveliness of the socket is insufficie
  nt. It calls InputStream:available() method and if it does not
  throw any IOException then socket is considered to be alive. But
  InputStream:available() method can return zero even on a broken
  socket. So, this method for checking the liveliness of the
  socket is enhanced by checking the time amount of inactivity.
  If a socket is inactive for more than 10 minutes then the
  socket is closed and fresh socket would be created.
  This way a broken socket is cleaned up before any request
  for passticket could be made.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  RATL HATS FOR 5

• Fixed component ID

  5724U6800

Applicable component levels

• R750 PSY

     UP