IT42514: OPERATIONS CENTER (OC) 8.1.16 ADMINISTRATORS WITH MFA ENABLED GET LOCKED FROM OPERATIONS CENTER IN IRREGULAR INTERVALS

8.1.17.000-IBM-SPOC-WindowsX64
8.1.17.000-IBM-SPOC-Linuxx86_64
8.1.17.000-IBM-SPOC-Linuxs390x
8.1.17.000-IBM-SPOC-LinuxPPC64le
8.1.17.000-IBM-SPOC-AIX
8.1.17.000-IBM-SPSRV-WindowsX64
8.1.17.000-IBM-SPSRV-Linuxx86_64
8.1.17.000-IBM-SPSRV-Linuxs390x
8.1.17.000-IBM-SPSRV-Linuxppc64le
8.1.17.000-IBM-SPSRV-AIX

APAR status

• Closed as program error.

Error description

• Since IBM Spectrum Protect Operations Center version 8.1.16.000,
  the administrator accounts logged into Operations Center (OC)
  are unexpectedly locked if the Multi-factor authentication (MFA)
  for them is set to YES (MFAREQUIRED=YES).
  Here an example of the messages that can be seen in the server
  activity log when the administrator is locked:
  ...
  ANR0431W Session 12345 refused - administrator OCADMIN is
  locked.
  
  ANR0418W Session 12345 for administrator OCADMIN is refused
  because an incorrect password was submitted
  ANR2177I OCADMIN has 68 invalid sign-on attempts. The limit is
  5.
  
  ANR2178E OCADMIN has been locked. Invalid sign-on attempt limit
  (5) reached.
  
  
  
  IBM Spectrum Protect Versions Affected:
  
  IBM Spectrum Protect Operations Center 8.1.16.000 on all
  supported platforms
  |MDVREGR 8.1.16.000-5608E01UI |
  

Local fix

• As a workaround to administrators getting locked follow these
  steps:
  1. Log off the Operations Center (OC).
  2. If there are any sessions with the server for that
  Administrator ID, cancel them by CANCEL SESSION server command.
  3. Unlock the administrator using another administrator or the
  server console by UNLOCK ADMIN server command.
  4. Log back into the OC (obtaining new passcode in the process).
  
  5. Log off the OC when not actively using it.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All IBM Spectrum Protect Operation Center users.             *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See error description.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in level 8.1.17. Note that this is     *
  * subject to change at the discretion of IBM.                  *
  ****************************************************************
  

Problem conclusion

• This problem was fixed.
  Affected platforms for reported release:  AIX, Linux, and
  Windows.
  Platforms fixed:  AIX, Linux, and Windows.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TSM OPERATIONS

• Fixed component ID

  5608E01UI

Applicable component levels