PK69441: CANNOT CREATE ACCESS CONTROL ROLES FOR LIBRARY RESOURCE

6.1.0.1 Download: WebSphere Portal and Web Content Management V6.1, fix pack 1
6.1.0.2 Download: WebSphere Portal and Web Content Management V6.1, fix pack 2
6.1.0.3 Download: WebSphere Portal and WCM V6.1 fix pack 3, 6.1.5 feature pack
6.1.0.4 Download: WebSphere Portal and WCM V6.1.0 fix pack 4 & 6.1.5 fix pack 1
6.1.0.5 Download: WebSphere Portal and WCM V6.1.0 fix pack 5
6.1.0.6 Download: WebSphere Portal and WCM V6.1.0 fix pack 6
6.0.1.7 Download: WebSphere Portal and Web Content Manager V6.0.1, fix pack 7
6.0.1.5 Download: WebSphere Portal and Web Content Management V6.0.1 fix pack 5

APAR status

• Closed as program error.

Error description

• Access Control Roles cannot be assigned to resources from the
  JCR domain, e.g.
  - Resource Policies
  - Composite Application Templates
  - Document or Web Content Libraries
  - WCM or PDM contents
  
  Roles can be set through the admin UI, but are not correctly
  persisted.
  

Local fix

• as a workaround, delete the invalid role-mappings for
  your portal server database:
  
  1) Stop your WebSphere Portal Server
  2) Make a backup of all WPS database tables
  3) Run this query (adjust your DB schema if necessary) to
  verify
  that there are really invalid role-mappings
  
  SELECT * FROM JCR.LNK_USER_ROLE where
  JCR.LNK_USER_ROLE.USER_DESC_UID
  not in (SELECT RELEASE.USER_DESC.UNIQUE_ID FROM
  RELEASE.USER_DESC WHERE
  1=1)
  
  4) Only if the query shows at least 1 invalid role-mapping, run
  this
  SQL script (don't forget to adjust your DB schema) to delete
  the
  invalid role-mappings:
  
  DELETE FROM JCR.LNK_USER_ROLE where
  JCR.LNK_USER_ROLE.USER_DESC_UID
  not in (SELECT RELEASE.USER_DESC.UNIQUE_ID FROM
  RELEASE.USER_DESC WHERE
  1=1)
  
  5) Restart your WebSphere Portal Server and try to assign and
  save new
  role-mappings.
  

Problem summary

• Access Control Roles cannot be assigned to resources from the
  JCR domain, e.g.
     - Resource Policies
     - Composite Application Templates
     - Document or Web Content Libraries
     - WCM or PDM contents
  
  Roles can be set through the admin UI, but are not correctly
  persisted.
  

Problem conclusion

• Exception was thrown when invalid role mappings exist in DB.
  Now exception is caught and a warning msg is written to the log.
  
  Failing Module(s):
     Portal Access Control
  
  Affected Users:
     All Users
  
  Version Information:
      Portal Version(s): 6.0.1.3
       Pre-Requisite(s):
        Co-Requisite(s): ---
  
  Platform Specific:
     This fix applies to all platforms.
  
  A fix is available from Fix Central:
  
  http://www.ibm.com/eserver/support/fixes/fixcentral/swgquickorde
  r?apar=PK69441&productid=WebSphere%20Portal&brandid=5
  
  You may need to type or paste the complete address into your Web
  browser.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE PORTA

• Fixed component ID

  5724E7600

Applicable component levels

• R60G PSY

     UP