IT23526: ERROR BPCUI0330E WHEN LOGGING TO IBM SPECTRUM CONTROL WEB GUI WITH AN USER BELONGING TO A DOMAIN LOCAL SECURITY GROUP.

IBM Spectrum Control 5.2.16 - Linux Server
IBM Spectrum Control 5.2.16 - Windows Server
IBM Spectrum Control 5.2.16 - AIX Server
IBM Spectrum Control V5.2.16 (March 2018)
IBM Spectrum Control V5.2.17 (May 2018)

APAR status

• Closed as program error.

Error description

• Receiving error: The user is not authorized to use the
  administration console when logging to IBM Spectrum Control Web
  GUI using a domain user belonging to a domain local security
  group defined on the domain controller.
  
  In the <TPC install dir>\web\log\traceWebServer_0.log:
  
  2017-11-23 17:07:16.719 [LargeThreadPool-thread-69]
  [RestRequestContext.buildTpcUserPrincipal] [INFO] User TPCRealm
  is in the groups [group:TPCRealm/<domain>\Domain Users]
  2017-11-23 17:07:16.719 [LargeThreadPool-thread-69]
  [SaaSFilter.doFilter] [INFO] Request :  /srm/gui
  
  2017-11-23 17:08:19.334 [LargeThreadPool-thread-69]
  [ServerUtil.pingDBServer] [INFO] Connection to db is ok
  2017-11-23 17:08:27.677 [LargeThreadPool-thread-69]
  [RoleFilter.doFilter] [ERROR] Unable to get role for
  <domain>\<username> for URI: /srm/gui
  com.ibm.tpc.internal.api.TPCInternalAPIException: BPCUI0330E
  ...
  2017-11-23 17:08:27.693 [LargeThreadPool-thread-69]
  [RoleFilter.doFilter] [ERROR] User  <domain>\<username>  does
  not have an assigned role in  null
  
  IBM Spectrum Control supports/works only users from a global
  security group.
  The code will be enhanced to support users belonging to the
  domain local security groups.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Control 5.2.x with authentication configured    *
  * with Windows domain local security groups on their domain    *
  * controller.                                                  *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * IBM Spectrum Control 5.2.x users may receive an              *
  * authorization error:                                         *
  * The user is not authorized to use the administration console *
  * when logging to IBM Spectrum Control Web GUI using a domain  *
  * user belonging to a domain local security group defined on   *
  * the domain controller.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fix maintenance when available                         *
  ****************************************************************
  IBM Spectrum Control previously supported only users from a
  global security group.  It has been enhanced to support users
  belonging to the domain local security groups.
  

Problem conclusion

• The fix for this APAR is contained in the following maintenance
  package:
  
  IBM Spectrum Control 5.2.16  |  refresh pack  |
  5.2-TIV-TPC-RP0016  |  March 2018
  
  http://www.ibm.com/support/docview.wss?&uid=swg21320822
  
  The target dates for future releases do not represent a formal
  commitment by IBM. The dates are subject to change without
  notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TPC ADVANCED

• Fixed component ID

  5608TPCA0

Applicable component levels