IBM Support

PM12095: USE OF SAFRUNAS DIRECTIVE REQUIRES THE IHS USERID TO BE PERMITTED READ ACCESS TO THE BPX.SERVER FACILITY CLASS PROFILE

A fix is available

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • User is attempting to use the SAFRunAs directive ("SAFRunAs
    %%CLIENT%%") in his httpd.conf file. The userid/password entered
    at the browser pop-up has an OMVS segment and is a superuser,
    but the following is received on the error log:
    mod_auth_saf: Error calling pthread_security_np()
    ...and no useful information is provided to diagnose this.
    Eventually we found that the reason for SAFRunAs not working was
    because the IBM HTTP Server UserId did not have READ access to
    the BPX.SERVER Facility class profile.
    The problem may also occur if the BPX.SERVER Facility class
    profile is not defined.
    

Local fix

  • Use these example RACF commands to define and set up the correct
    profiles and access:
    RDEFINE FACILITY BPX.SERVER UACC(NONE) (if not defined already)
    PERMIT BPX.SERVER CLASS(FACILITY) ID(ihs_user_id) ACC(read)
    SETROPTS RACLIST(FACILITY) REFRESH
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED: IBM HTTP Server users with "SAFRunAs" in     *
    *                 their configuration with unexpected 401      *
    *                 responses.                                   *
    *                                                              *
    ****************************************************************
    * PROBLEM DESCRIPTION: mod_auth_saf does not properly log a    *
    *                      failure message when it fails to        *
    *                      assume the identity of the target user. *
    *                                                              *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    Errors on z/OS system calls to switch userid are communicated
    only via a generic 401 HTTP status code, and the errno value is
    not logged for the administrator
    

Problem conclusion

  • mod_auth_saf was updated to log a meaningful message when the
    switch of userid fails, including the name of the failing
    system call and the errno value at the time of failure.
    
    Additionally, two common sources of errors for SAFRunAs are
    added to the documentation:
    
    To use SAFRunAs, the IBM HTTP Server userid must be permitted
    to the BPX.SERVER FACILITY class profile in RACF and the
    target userid must have an OMVS segment."
    
    APAR PM12095 is currently targeted for inclusion in Service
    Level (Fix Pack) 6.1.0.31 of WebSphere Application Server V6.1.
    
    Please refer to URL:
    //www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
    for Fix Pack availability.
    

Temporary fix

Comments

APAR Information

  • APAR number

    PM12095

  • Reported component name

    WEBSPHERE FOR Z

  • Reported component ID

    5655I3500

  • Reported release

    610

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2010-04-12

  • Closed date

    2010-04-22

  • Last modified date

    2010-06-03

  • APAR is sysrouted FROM one or more of the following:

    PM01714

  • APAR is sysrouted TO one or more of the following:

Modules/Macros

  • BBGUBINF BBOUBINF
    

Fix information

  • Fixed component name

    WEBSPHERE FOR Z

  • Fixed component ID

    5655I3500

Applicable component levels

  • R610 PSY UK56378

       UP10/05/08 P F005

Fix is available

  • Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
10 February 2022