A fix is available
APAR status
Closed as program error.
Error description
User is attempting to use the SAFRunAs directive ("SAFRunAs %%CLIENT%%") in his httpd.conf file. The userid/password entered at the browser pop-up has an OMVS segment and is a superuser, but the following is received on the error log: mod_auth_saf: Error calling pthread_security_np() ...and no useful information is provided to diagnose this. Eventually we found that the reason for SAFRunAs not working was because the IBM HTTP Server UserId did not have READ access to the BPX.SERVER Facility class profile. The problem may also occur if the BPX.SERVER Facility class profile is not defined.
Local fix
Use these example RACF commands to define and set up the correct profiles and access: RDEFINE FACILITY BPX.SERVER UACC(NONE) (if not defined already) PERMIT BPX.SERVER CLASS(FACILITY) ID(ihs_user_id) ACC(read) SETROPTS RACLIST(FACILITY) REFRESH
Problem summary
**************************************************************** * USERS AFFECTED: IBM HTTP Server users with "SAFRunAs" in * * their configuration with unexpected 401 * * responses. * * * **************************************************************** * PROBLEM DESCRIPTION: mod_auth_saf does not properly log a * * failure message when it fails to * * assume the identity of the target user. * * * **************************************************************** * RECOMMENDATION: * **************************************************************** Errors on z/OS system calls to switch userid are communicated only via a generic 401 HTTP status code, and the errno value is not logged for the administrator
Problem conclusion
mod_auth_saf was updated to log a meaningful message when the switch of userid fails, including the name of the failing system call and the errno value at the time of failure. Additionally, two common sources of errors for SAFRunAs are added to the documentation: To use SAFRunAs, the IBM HTTP Server userid must be permitted to the BPX.SERVER FACILITY class profile in RACF and the target userid must have an OMVS segment." APAR PM12095 is currently targeted for inclusion in Service Level (Fix Pack) 6.1.0.31 of WebSphere Application Server V6.1. Please refer to URL: //www.ibm.com/support/docview.wss?rs=404&uid=swg27006970 for Fix Pack availability.
Temporary fix
Comments
APAR Information
APAR number
PM12095
Reported component name
WEBSPHERE FOR Z
Reported component ID
5655I3500
Reported release
610
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2010-04-12
Closed date
2010-04-22
Last modified date
2010-06-03
APAR is sysrouted FROM one or more of the following:
PM01714
APAR is sysrouted TO one or more of the following:
Modules/Macros
BBGUBINF BBOUBINF
Fix information
Fixed component name
WEBSPHERE FOR Z
Fixed component ID
5655I3500
Applicable component levels
R610 PSY UK56378
UP10/05/08 P F005
Fix is available
Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
10 February 2022