PK75902: AUTOGENERATION OF LTPA KEYS DOES NOT SYNCHRONIZE LTPA KEYS WITH NODES WHEN SYNCHRONIZATION IS DISABLED.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• When autogeneration of LTPA keys is enabled, and synchronization
  is disabled, the LTPA keys in the DeploymentManager and Node
  Agent will not be synchronized.
  
  You will see the following messages in both the Deployment
  Manager and the Node Agent.
  SECJ0305I, ADMN0022E, HMGR0149E
  
  The setup may look something like the following: -----
  Autogeneration of LTPA Keys is enabled in the admin console:
  
  Secure administration, applications, and infrastructure >
  Authentication mechanisms and expiration > Key set groups >
  CellLTPAKeySetGroup
  
  Under Key Generation
  Automatically generate keys checkbox = enabled
  
  Synchronization service is disabled:
  
  Synchronization service can be found at:
  Node agents > nodeagent > File synchronization service
  Automatic synchronization = disabled
  Startup synchronization   = disabled
  ----
  

Local fix

• Disable autogeneration of LTPA keys in administration console if
  synchronization service is disabled.
  
  Run syncNode.sh from the application server hfs in order to
  synchronize the files with the DeploymentManagers hfs.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of WebSphere Application Server    *
  *                 V7.0 for z/OS                                *
  ****************************************************************
  * PROBLEM DESCRIPTION: When LTPA keys are set to               *
  *                      automatically generate, and node        *
  *                      synchronization is disabled, nodes      *
  *                      can become out of sync with the         *
  *                      deployment manager. A message similar   *
  *                      to "Validation of LTPA token failed     *
  *                      due to invalid keys or token type"      *
  *                      may be issued.                          *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  WebSphere Application Server was not correctly detecting this
  configuration, and warning users of the effects of having LTPA
  keys set to autogenerate when node synchronization is disabled.
  

Problem conclusion

• WebSphere Application Server will now behave differently in
  two specific areas to help prevent this error from occuring:
  1. When new profiles are created, WebSphere Application Server
  will have automatic LTPA token generation disabled by default.
  2. When a user attempts to either enable automatic LTPA token
  generation while any node has automatic synchronization
  disabled, or a user attempts to disable automatic
  synchronization in any node while automatic LTPA key
  generation is enabled, a new warning message will be displayed
  at the administration console:
  
  "Warning: at least one node in the cell was unreachable or is
  not configured to automatically synchronize. It is strongly
  recommended that you verify your node settings, and do not
  enable automatic generation of LTPA keys while automatic
  syncronization is disabled on any node."
  
  
  APAR PK75902 requires changes to documentation.
  
  NOTE: Periodically, we refresh the documentation on our
  Web site, so the changes might have been made before you
  read this text. To access the latest on-line
  documentation, go to the product library page at:
  
  http://www.ibm.com/software/webservers/appserv/library
  
  The following Change to the WebSphere Application
  Server Version 7.x Information Center
  will be made available in March, 2008.
  
  The description of the Automatically generate keys
  field in the topic "Key set groups settings" will be
  updated to read:
  
  Automatically generate keys
  
  Specifies that the keys are generated automatically
  on a schedule. When a new key is generated, the
  security.xml is updated and saved by the runtime to
  track the key reference version. This can cause save
  conflicts when updating the same file from admin
  applications.
  
  Avoid Trouble: Starting with Versions 6.1.0.23,
  the default value for this property is Disabled.
  If you try to enable this property, and
  automatic synchronization is off in any node, the
  following administrative console message displays:
  
  Warning: At least one node in the cell was
  unreachable or is not configured to automatically
  synchronize. It is strongly recommended that you verify
  your node settings, and do not enable automatic
  generation of LTPA keys while automatic syncronization
  is disabled on any node.
  
  Default      Disabled
  
  APAR PK75902 is currently targeted for inclusion in Service
  Level (Fix Pack) 7.0.0.1 of WebSphere Application Server V7.0
  for z/OS.
  
  Please refer to URL:
  //www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PK67921

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• BBGUBINF BBOUBINF
  

Fix information

• Fixed component name

  WEBSPHERE FOR Z

• Fixed component ID

  5655I3500

Applicable component levels

• R700 PSY UK41764

     UP08/12/05 P F812

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.