IT31188: ACTIVE DIRECTORY USER AUTHENTICATION FAILS IN IBM SPECTRUM CONTROL WITH ERROR CWIML4001E

IBM Spectrum Control 5.3.6 (February 2020)

APAR status

• Closed as program error.

Error description

• Active Directory Users included in an Active Directory Group
  labeled with a dash "-" fails authentication check when
  attempting to validate the domain group.
  
  Logon with Domain ID
  returns the following error in IBM Spectrum Control WEB
  UI.
  
  "Username or password are not valid"
  
  Review of wlp FFDC
  logs reveals similar to the following:
  
  ~wlp/usr/servers/webServ
  er/logs/ffdc/ffdc_yy.mm.dd_hh.ss.mm.x.log:
  Exception =
  javax.security.auth.login.CredentialException
  Source = com.ibm.w
  s.security.authentication.jaas.modules.UsernameAndPasswordLoginM
  odule
  probeid = 105
  Stack Dump =
  javax.security.auth.login.CredentialException: Unable to find
  the user for this accessId: user:TPCRealm/Domain\User_ID.
  CWIML4001E: The user registry operation could not be completed.
  The Domain\User_ID entity was not found. Specify the correct
  entity or create the missing entity.
  
  and...
  
  Stack Dump =
  com.ibm.wsspi.security.wim.exception.WIMApplicationException:
  com.ibm.ws.security.registry.EntryNotFoundException:
  <Domain>\<Group_ID ? Group_Name>
  

Local fix

• TBD
  
  Work Around: Move relevant user_id to a group that does
  not contain the dash "-"
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Control users with Windows Active Directory     *
  * configured for authentication                                *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * IBM Spectrum Control failed to properly authenticate         *
  * users in Windows Active Directory whose username             *
  * were included in an Active Directory Group labeled           *
  * with a dash "-"                                              *
  * It fails authentication check when attempting to             *
  * validate the domain group.                                   *
  *                                                              *
  * Logon with Domain ID returns the following error             *
  * in IBM Spectrum Control WEB UI.                              *
  *                                                              *
  * "Username or password are not valid"                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fix maintenance when available                         *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is targeted for the following release:
  
  IBM Spectrum Control 5.3.6   [ 5.3.6-IBM-SC ]
  
  ( release target February 2020 )
  
  http://www.ibm.com/support/docview.wss?&uid=swg21320822
  
  The target dates for future releases do not represent a formal
  commitment by IBM. The dates are subject to change without
  notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TPC ADVANCED

• Fixed component ID

  5608TPCA0

Applicable component levels