PK97668: If customized SAF profile mapper class is used, SAF role to profile mapper is initilized using default role mapper.

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• If a custom class is used in the "SAF profile mapper" field,
  custom SAF role to profile mapper is initialized using the
  default mapper com.ibm.ws.security.zOS.authz.SAFRoleMapperImpl
  and the custom class is ignored.
  
  If an invalid class name is entered or the class that is
  entered cannot be found in the "SAF profile mapper" field,
  custom SAF role to profile mapper is still initialized using the
  default mapper.
  If class name entered is not found, an error should be printed.
  The following error is documented in the InfoCenter, but not
  issued in this case:
  
  SECJ6225E: Unable to load the custom SAF role to profile mapper
  "{0}" due to the following exception: {1}
    Explanation: WebSphere was unable to load and and
      instantiate the configured class. This is generally due
      to an incorrect class name.
    Action: Verify that the specified class name is correct and
      that it can be loaded by the WebSphere class loader.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of IBM WebSphere Application       *
  *                 Server V7.0                                  *
  ****************************************************************
  * PROBLEM DESCRIPTION: For WebSphere Application Server for    *
  *                      z/OS, the SAF role mapper setting       *
  *                      com.ibm.websphere.security.SAF.RoleMapp *
  *                      er is not being honored.                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  For WebSphere Application Server for z/OS, the default role
  mapper com.ibm.ws.security.zOS.authz.SAFRoleMapperImpl is used
  regardless of the setting of the security custom property
  com.ibm.websphere.security.SAF.RoleMapper or regardless of the
  class name specified for the "SAF profile mapper" in the admin
  console in Security > Secure administration, applications, and
  infrastructure > External authorization provider > System
  Authorization Facility (SAF) > SAF authorization options panel.
  

Problem conclusion

• The code was modified to honor the class name specified either
  in the security custom property
  com.ibm.websphere.security.SAF.RoleMapper or through the
  administration console panel.
  
  APAR PK97668 is currently targeted for inclusion in Service
  Level (Fix Pack) 7.0.0.9 of WebSphere Application Server V7.0.
  
  Please refer to URL:
  //www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
  for Fix Pack availability.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PK97553

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE FOR Z

• Fixed component ID

  5655I3500

Applicable component levels

• R500 PSN

     UP

• R601 PSN

     UP

• R610 PSN

     UP

• R700 PSY UK55133

     UP10/03/26 P F003

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.