IV13097: UNABLE TO LOGIN TO TEPS VIA BROWSER WHEN IP.SPIPE ENABLED

IBM Tivoli Monitoring 6.2.2 Fix Pack 8 (6.2.2-TIV-ITM-FP0008)
IBM Tivoli Monitoring 6.2.2 Fix Pack 9 (6.2.2-TIV-ITM-FP0009)

APAR status

• Closed as program error.

Error description

• Environment:
  ITM 6.2.2
  
  Problem Description:
    In customer's 6.2.2 environment, when IP.SPIPE was enabled and
  FIPS, it failed to access the TEPS via browser client, The
  desktop client worked fine with "com.ibm.TEPS.FIPSMODE" option.
  
  Detailed Recreation Procedure:
  
  - configure TEMS and TEPS to use IP.SPIPE
  - set "KFW_FIPS_ENFORCED=Y" in kfwenv file
  - restart TEPS
  - try to login and get ""KFWITM393E User ID or password is
  invalid."
  - If "com.ibm.TEPS.FIPSMODE" set in desktop client, it works
  fine, but browser client doesn't work.
  

Local fix

• use the desktop client
  

Problem summary

• Unable to login to Portal Server by browser portal client when
  IP.SPIPE is enabled
  
  When IP.SPIPE is enabled for the monitoring server and portal
  server, the user is unable to login to the portal server with
  the browser portal client receiving the error "KFWITM393E User
  ID or password is invalid."  The desktop portal client works
  with the "com.ibm.TEPS.FIPSMODE" variable.
  
  Once the fix is installed, the following steps are needed to be
  done for the Browser client and Webstart client:
  
  Browser client:
  -  Windows portal server:  Select 'reconfigure' of browser
  client, select 'com.ibm.TEPS.FIPSMODE',set it as 'true' and
  select 'In Use' checkbox.  From client machine, clear the cache
  and connect to the portal server.
  
  -  AIX/Linux portal server: The 'applet.html' file needs to be
  update manually.  Open the $CANDLEHOME/<arch>/cw/applet.html
  file and add 'com.ibm.TEPS.FIPSMODE' as below and save the file.
  Then from the client machine, clear the cache and connect to
  portal server.
  ================================================================
  document.writeln( '<PARAM NAME= "com.ibm.TEPS.FIPSMODE"
  VALUE="true">' );
  ================================================================
  
  
  Webstart client:
  Update the file %CANDLEHOME%\CNB\tep.jnlp  (on Windows) or
  $CANDLEHOME/<arch>/cw/tep.jnlp (on AIX or Linux) and add
  'com.ibm.TEPS.FIPSMODE' as below. Then from the client machine
  clear the cache and connect to the portal server.
  ================================================================
  <property name="com.ibm.TEPS.FIPSMODE" value="true"/>
  ================================================================
  

Problem conclusion

• Code was modified to apply "com.ibm.TEPS.FIPSMODE" setting in
  the browser portal client.
  
  The fix for this APAR is contained in the following maintenance
  packages:
  
      | fix pack | 6.2.2-TIV-ITM-FP0008
      | fix pack | 6.2.3-TIV-ITM-FP0002
  

Temporary fix

• With "com.ibm.TEPS.FIPSMODE" variable set, desktop portal client
  will work.  This problem only happens with browser portal
  client.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TEP

• Fixed component ID

  5724C04EP

Applicable component levels

• R622 PSY

     UP