IBM Support

IC75857: INCONSISTENT AUTHORITY CHECKING WHEN RUNNING SELECT AND QUERY COMMANDS AS AN ADMINISTRATOR

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • Tivoli Storage Manager server maps some "select commands"
    internally to "query commands" to return desired results.
    A few query commands indeed can only be used by administrators
    with higher privileges, for instance QUERY SERVERGROUP requires
    system privilege. For each query command invoked, Tivoli Storage
    Manager checks the appropriate administrator privileges.
    When an administrator, without any privileges, is used to run
    select statements, Tivoli Storage Manager does not check whether
    the administrator has sufficient
    privileges or not. The missing privileges are detected during
    the internal query invocation.
    
    Development will fix the inconsistent authority check.
    
    Customer/L2 Diagnostics:
    For example, following can be seen in the ACTLOG:
    ...
    ANR2017I Administrator ADMINWITHOUTAUTH issued  command: select
    * from tsmdb1.server_group
    ANR2035E QUERY SERVERGROUP: Administrator  ADMINWITHOUTAUTH is
    not authorized to issue this command.
    ANR2034E SELECT: No match found using this criteria.
    
    
    Tivoli Storage Manager Versions Affected: 6.1, 6.2
    
    Initial Impact:
    Low
    
    Additional Keywords:
    TSM, zz61, zz62, select, authorization, query, servergroup,
    server_group
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED: All Tivoli Storage Manager server users.     *
    ****************************************************************
    * PROBLEM DESCRIPTION: See error description.                  *
    ****************************************************************
    * RECOMMENDATION: Apply fixing level when available. This      *
    *                 problem is currently projected to be fixed   *
    *                 in level 6.2.4. Note that this is *
    *                                                              *
    *                 subject to change at the discretion of IBM.  *
    ****************************************************************
    *
    

Problem conclusion

  • This problem was fixed.
    After this fix is applied the QUERY SERVERGROUP command will
    no longer require system authority.  The manuals will be
    updated in a future version of the product.
    
    Affected platforms:  AIX, HP-UX, Solaris, Linux, and Windows.
    

Temporary fix

Comments

APAR Information

  • APAR number

    IC75857

  • Reported component name

    TSM SERVER

  • Reported component ID

    5698ISMSV

  • Reported release

    62L

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2011-04-19

  • Closed date

    2011-08-25

  • Last modified date

    2013-08-21

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    TSM SERVER

  • Fixed component ID

    5698ISMSV

Applicable component levels

  • R61A PSY

       UP

  • R61H PSY

       UP

  • R61L PSY

       UP

  • R61S PSY

       UP

  • R61W PSY

       UP

  • R62A PSY

       UP

  • R62H PSY

       UP

  • R62L PSY

       UP

  • R62S PSY

       UP

  • R62W PSY

       UP

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSGSG7","label":"Tivoli Storage Manager"},"Component":"","ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"62L","Edition":"","Line of Business":{"code":"LOB26","label":"Storage"}}]

Document Information

Modified date:
21 August 2013