IC75857: INCONSISTENT AUTHORITY CHECKING WHEN RUNNING SELECT AND QUERY COMMANDS AS AN ADMINISTRATOR

APAR status

• Closed as program error.

Error description

• Tivoli Storage Manager server maps some "select commands"
  internally to "query commands" to return desired results.
  A few query commands indeed can only be used by administrators
  with higher privileges, for instance QUERY SERVERGROUP requires
  system privilege. For each query command invoked, Tivoli Storage
  Manager checks the appropriate administrator privileges.
  When an administrator, without any privileges, is used to run
  select statements, Tivoli Storage Manager does not check whether
  the administrator has sufficient
  privileges or not. The missing privileges are detected during
  the internal query invocation.
  
  Development will fix the inconsistent authority check.
  
  Customer/L2 Diagnostics:
  For example, following can be seen in the ACTLOG:
  ...
  ANR2017I Administrator ADMINWITHOUTAUTH issued  command: select
  * from tsmdb1.server_group
  ANR2035E QUERY SERVERGROUP: Administrator  ADMINWITHOUTAUTH is
  not authorized to issue this command.
  ANR2034E SELECT: No match found using this criteria.
  
  
  Tivoli Storage Manager Versions Affected: 6.1, 6.2
  
  Initial Impact:
  Low
  
  Additional Keywords:
  TSM, zz61, zz62, select, authorization, query, servergroup,
  server_group
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All Tivoli Storage Manager server users.     *
  ****************************************************************
  * PROBLEM DESCRIPTION: See error description.                  *
  ****************************************************************
  * RECOMMENDATION: Apply fixing level when available. This      *
  *                 problem is currently projected to be fixed   *
  *                 in level 6.2.4. Note that this is *
  *                                                              *
  *                 subject to change at the discretion of IBM.  *
  ****************************************************************
  *
  

Problem conclusion

• This problem was fixed.
  After this fix is applied the QUERY SERVERGROUP command will
  no longer require system authority.  The manuals will be
  updated in a future version of the product.
  
  Affected platforms:  AIX, HP-UX, Solaris, Linux, and Windows.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TSM SERVER

• Fixed component ID

  5698ISMSV

Applicable component levels

• R61A PSY

     UP

• R61H PSY

     UP

• R61L PSY

     UP

• R61S PSY

     UP

• R61W PSY

     UP

• R62A PSY

     UP

• R62H PSY

     UP

• R62L PSY

     UP

• R62S PSY

     UP

• R62W PSY

     UP