Explanation | An unexpected error occurred during security initialization. |
Action |
This is a general error. Look for previous messages that might be related to the failure or to a configuration problem. Enabling security debug trace for components com.ibm.ws.security.* and com.ibm.ejs.security.* might yield additional information. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An error occurred while initializing the Secure Association Service, which is part of the ORB security. |
Action | Verify that the property file, usually sas.server.props, is present and has read permission. |
Explanation | Informational. |
Action | A security configuration change has caused a SAS Property to be updated. |
Explanation | The URL used to specify Secure Association Service properties is missing or malformed. |
Action |
The URL is usually specified as a property name when starting WebSphere from the command line with the -D argument. For example: -Dcom.ibm.CORBA.ConfigURL=file:/C:/wastd/AppServer/properties/sas.server.props. Verify that the property and URL is specified and refers to a valid file and the file has the read permission. |
Explanation |
The path or file specified in the property might be not valid or there could be a file permission problem. |
Action | Verify that the path and file specified by the property is valid and the file has read permission. |
Explanation |
An unexpected RemoteException, OpException or IOException occurred during server startup. There could be problems with loading or writing of security configuration URL property files. |
Action |
Verify that the file associated with security configuration URL property file (typically sas.server.props) has read permission and is writable. |
Explanation |
An unexpected RemoteException, OpException or IOException occurred during server shutdown. There could be problems with loading or writing of security configuration URL property files. |
Action |
Verify that the file associated with security configuration URL property file (typically sas.server.props) has read permission and is writable. |
Explanation | A loadProperties() operation probably failed. |
Action |
Verify that the file associated with security configuration URL property file (typically sas.server.props) has read permission and is writable. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
The user does not have the necessary permission to access the resource. This failure might be expected if the user should not be granted access. If this error is unexpected, then there are several possible causes. The user has not been mapped to one the roles protecting the resource if the user requires access to the protected resource. The user is not a member of one of the groups that might have been mapped to one of the roles. If WebSphere security is configured to use LDAP as the user registry, the WebSphere security LDAP user and group search filter configuration might not match what the LDAP directory expects. |
Action |
If the authorization failure is unexpected, verify the user, or a group that the user is a member of, is mapped to the role protecting the resource. Verify that the WebSphere security LDAP user and group filters configuration match what the LDAP directory expects. If the authorization decision was made by the user-defined Java Authorization Contract for Containers (JACC) provider, verify the role mapping configuration through the JACC provider. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
The user could not be authenticated. The user id or password might have been entered incorrectly. The user might not exist in the user registry that WebSphere is configured to authenticate to. If WebSphere security is configured to use LDAP as the user registry, the WebSphere security LDAP user and group search filter configuration might not match what the LDAP directory expects. |
Action |
Verify that the user id and password are entered correctly and exist in the user registry. If LDAP is configured as the security user registry, verify the WebSphere security LDAP user and group filters configuration match what the LDAP directory expects. Consult with the administrator of the user registry that WebSphere is configured to use if the problem persist. |
Explanation | Authentication failed with the specified reason. |
Action |
Verify that the user id and password are entered correctly. Consult with the administrator of the user registry if the problem persist. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This is an internal error probably due to LTPAServer initialization problems. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The wrong constructor was used when trying to create an instance of LTPAServerBean. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This is an internal error. The ejbRemove() operation failed on the LTPAConfigBean. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This is an internal error. Cannot get accessID from credential. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
The credential mapping can fail for a number of reasons: The credential token is not an instance of a supported CredentialToken type for a mapping. The principal identified in the credential cannot be mapped to an entry or found in the user registry. A user registry exception occurs if the user registry has been stopped. |
Action |
Verify that the user registry is operational. Also verify that the principal exists in the target user registry if appropriate. The exception reported with this error message might help to diagnose the problem. |
Explanation | This is an internal error. An UnsupportedEncodingException occurred when the LTPAServer tried to encode the token value. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
The credential mapping can fail for a number of reasons: The credential token is not an instance of a supported CredentialToken type for a mapping. The principal identified in the credential cannot be mapped to an entry or found in the user registry. A user registry exception occurs or if the user registry has been stopped. |
Action |
Verify that the user registry is operational. Also verify that the principal exists in the target user registry if appropriate. The exception reported with this error message might help to diagnose the problem. |
Explanation | An unexpected exception occurred when configuring for LDAP. |
Action |
Verify that the WebSphere LDAP configuration settings such as the provider URL are correct in the Security Center GUI. If using SSL, make sure that the SSL configuration is correct. |
Explanation |
Cannot find a name for the specified SID in the Windows user registry.This can occur if a network time-out prevents the function from finding the name. It also occurs for SIDs that have no corresponding account name, such as a logon SID that identifies a logon session |
Action |
WebSphere might still have a reference to the user in the authorization table but, that user might have been removed from the Windows user registry. If you know the user, remove it from any resource protection permissions in WebSphere. If the user is still valid, then it needs to be recreated in the Windows user registry and then reassigned to proper resource permissions in WebSphere. |
Explanation |
Unable to find a SID for the specified user in the Windows user registry. The user might not exist in the user registry. |
Action | If appropriate create the user in the user registry. |
Explanation | |
Action | Verify that the pattern is correct and not malformed. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An unexpected exception occurred when trying to load or create the user registry. |
Action |
Verify that the CLASSPATH used to start WebSphere is correct and that the jar files have at least the read permission and exist. |
Explanation | This is an internal error. A registry of the specified type could not be looked up. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This is an internal error. Unable to create the home for the registry. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
Unable to lookup RegistryHome in name space or narrow failed. The class for the user registry was not registered in the name space correctly or the class file for the user registry cannot be found. |
Action | Verify that the class path is correct and that the required classes exist. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An error internal occurred while initializing the security attributes of a Web Application. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The HttpServletResponse indicates an Internal Server Error has occurred. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The encoded password cannot be decoded because it is missing or malformed. |
Action |
Verify that the passwords in the security configuration URL are not corrupted or missing. Reset the affected password through the WebSphere Admin console if possible. If all else fails, reset the password to its plain text value in the security configuration URL (which is usually sas.server.props). |
Explanation | The password cannot be encoded because it is missing or malformed. |
Action |
Verify that the passwords in the security configuration URL are not corrupted or missing. Reset the affected password through the WebSphere Admin console if possible. If all else fails, reset the password to its plain text value in the security configuration URL (which is usually sas.server.props). |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action |
If this message is from a warning, then it is a temporary problem which is usually recovered from automatically. If it is not a warning, then check the file permissions for the file to ensure that they are readable. If the file is missing, restore it. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | Verify that the user registry has been configured in WebSphere properly. |
Explanation |
The security configuration URL is being recovered from the future version. This might happen if the security configuration URL is missing or has been deleted. |
Action | None |
Explanation | A loadProperties() operation probably failed. |
Action |
Verify that the file permissions associated with security configuration URL property file (typically sas.server.props) are read and writable. |
Explanation | The run-as-bindings size is zero for this application. |
Action | Verify that the run-as bindings are specified for the application if necessary. |
Explanation | No security constraints or roles have been defined for this application. |
Action |
If security is not necessary for this application, ignore this message. Otherwise, review the security requirements of this application. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The credential might be malformed or corrupted. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The credential is possibly malformed or corrupted. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The credential is possibly malformed or corrupted. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
The user could not be authenticated by the FormLogin Servlet. The user id or password might have been entered incorrectly. The user might not exist in the user registry that WebSphere is configured to authenticate to. |
Action |
Verify that the user id and password are entered correctly. Consult with the administrator of the user registry if the problem persists. |
Explanation | An authentication error occurred during authentication. This could be due to a user name and password that is not valid. |
Action | Verify that the user name and password specified are valid. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Reports the number of Trust Association interceptors that have been added. |
Action | None, informational only. |
Explanation | Self Explanatory. |
Action | None, informational only. |
Explanation | Reports the signature of the Trust Association interceptor. |
Action | None, informational only. |
Explanation | getClassLoader() operation returned null. |
Action | Verify that the appropriate Trust Association classes are installed and the class path is correct. |
Explanation | The interceptor class file specified in trustedservers.properties cannot be found. |
Action |
Verify that the appropriate Trust Association classes are installed and the class path is correct. Also verify that the class specified in the trustedservers.properties file is correct and that the file has at least read permission. |
Explanation | A ClassNotFoundException occurred when trying to load the subject class. |
Action | Verify that the appropriate Trust Association classes are installed and the class path is correct. |
Explanation |
When the appropriate interceptor is found for a given request, that interceptor then validates its trust with the reverse proxy server. This error message suggests that the validation has failed and therefore the reverse proxy cannot be trusted. For example, an incorrect or expired password might have been provided. |
Action |
In a production environment, the user might be alerted to check if there is an intruder in the system. In a development environment in which testing is underway, verify if the expected inputs from the reverse proxy server is in fact being passed to the interceptor correctly. The nature of these inputs really depends on how trust association is being established. For example, the simplest method would be to pass a user name/password through the Basic Authentication header. |
Explanation |
When the WebAuthenticator invoked an interceptor to return the authenticate user name, no such user name was returned. |
Action |
Verify that the reverse proxy server is inserting the correct user name in the HTTP request before it sends the request to WebSphere. |
Explanation |
This refers to all other exceptions that can be possibly created by an interceptor, when validating trust with the reverse proxy server and when getting the authenticated user name, aside from WebTrustAssociationFailedException and WebTrustAssociationUserException. |
Action |
Debug the problem from the stack trace that is printed together with this error message. You can also turn on the debug trace to get more information about the nature of the exception. |
Explanation | The user does not have the necessary permission to access the resource. |
Action |
Contact your WebSphere security administrator if this is unexpected. Your user must be mapped to one the roles protecting the resource if access to the protected resource is required. If the authorization decision was made by the user-defined Java Authorization Contract for Containers (JACC) provider, verify the role mapping configuration through the JACC provider. |
Explanation |
When using WebSealTrustAssociationInterceptor, the "via" HTTP header in the HTTP Request object is examined. This message appears when the value for this header is not valid or corrupted. |
Action | Make sure that WebSeal, the HTTP Server or both are properly working. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Java 2 Security Manager is installed. |
Action | None, informational only. |
Explanation | An illegal Permission was attempted. Only the main thread can set the security manager. |
Action |
Verify that the code that is trying to set the security manager is not trying to subvert the WebSphere security manager. |
Explanation | The Java Security Manager checkPermission() threw a SecurityException on the subject Permission. |
Action | Verify that the attempted operation is permitted. |
Explanation | Only the main thread is allowed to exit the Java VM |
Action |
Verify that the code attempting the system exit is not trying to subvert the WebSphere security manager. |
Explanation | Reports the Custom User Registry implementation that is being used. |
Action | None, informational only. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The Certificate mapping filter specified by the user in the global security settings is missing or malformed. |
Action |
Review the certificate mapping filter configuration in the LDAP Advanced properties in the Security Center and verify it is present and correct. |
Explanation |
More than one user entry in LDAP matched the certificate mapping filter specified in the global security settings. It is not possible to map a subjectDN in a certificate to more than one user in an LDAP user registry. The mapping filter results in an ambiguous condition that cannot be supported. |
Action |
Specify a certificate mapping filter in the LDAP Advanced properties in the Security Center. |
Explanation | A naming exception occurred when searching LDAP. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | No entry in LDAP can be found with the subject DN in the certificate or found with the filter. |
Action |
This might be the expected result depending on the subject DN in the certificate and filter. If the response is unexpected, review the certificate mapping filter defined in the LDAP advanced properties in the Security Center. |
Explanation |
The DN in the certificate was successfully mapped to an entry in LDAP but, an unexpected exception occurred when trying to create a credential for the mapped entry. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
Using user ID that is not valid or the user ID is not a directory entry. The directory administration ID (root DN) is not a directory entry on most LDAP servers. |
Action | Verify that the user ID is a valid directory entry. |
Explanation |
When LTPA is the authentication mechanism SSO must also be enabled if any web applications use FORM login. |
Action | Enable SSO in the global security settings and restart WebSphere |
Explanation |
A security role reference in the specified EJB"s ejb-jar.xml file has not been mapped to a security role. This is a configuration error. |
Action |
The security-role-ref in the EJB"s ejb-jar.xml deployment descriptor should be mapped to a security role. |
Explanation | The WebSphere security code couldn"t find, load, or had problems loading the user registry class. |
Action |
The exception mentioned in the message should provide additional clues including the class or file that could not be found or loaded. Verify that the mentioned file exists in the correct directory and PATH. |
Explanation | The vendor specified Authorization Table is loaded successfully. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The Vendor specified Authorization Table could not be loaded successfully. The WebSphere provided authorization table will be used. |
Action | Make sure that the vendor"s implementation of Authorization Table is in the CLASSPATH and that it could be loaded. |
Explanation | The Vendor specified Authorization Table class could not be found in the CLASSPATH. |
Action | Make sure that the vendor"s implementation of Authorization Table as specified in the sas.server.props file is in the CLASSPATH. |
Explanation | The vendor specified Authorization Table class could not be instantiated. |
Action | Make sure that the vendor"s implementation of Authorization Table as specified in the sas.server.props file could be loaded and instantiated. |
Explanation | The vendor specified Authorization Table failed during authorization check. |
Action | Refer to the vendor"s specific exception for details. If vendor"s specific exception is not present, contact your service representative with the exception stack trace information present in the error log. |
Explanation | This indicates the vendor"s specific error. Example:- Server not started, Network failure, Server failed. |
Action | Depends on the error. |
Explanation | Unknown error from Vendor"s authorization table |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | An error was returned by the operating system API |
Action | Depending on the API being called, check the operating system specific documentation |
Explanation | An expand exception occurred while expanding the permission in the application policy file. |
Action | Check the permission entry syntax in the application policy file (app.policy or was.policy). To identify which policy file has a problem, enable security trace for the component com.ibm.ws.security.policy.*. The trace.log file will contain the policy name. |
Explanation | An expand exception occurred while expanding the grant entry in the pplication policy file. |
Action | Check the grant entry syntax in your application policy file (app.policy or was.policy). To identify which policy file has a problem, enable security trace for the component com.ibm.ws.security.policy.*. The trace.log file will contain the policy name. |
Explanation | While expanding the permission entry in filter.policy file, caught an expand exception |
Action | Check the permission entry syntax in filter policy file. |
Explanation | Keystore of the above type is not supported. |
Action | Use the supported type of keystores. |
Explanation | While expanding the permission, caught an expand exception |
Action | Check the permission entry syntax in your policy file. To identify which policy file has a problem, enable security trace for the component com.ibm.ws.security.policy.*. The trace.log file will show the policy file name. |
Explanation | While expanding the grant entry, caught an expand exception |
Action | Check the grant entry syntax in your policy file. To identify which policy file has a problem, enable security trace for the component com.ibm.ws.security.policy.*. The trace.log file will show the policy file name. |
Explanation | An expand exception occurred while expanding the signedby entry. |
Action | Check the signedby entry syntax in your policy file. To identify which policy file has a problem, enable security trace for the component com.ibm.ws.security.policy.*. The trace.log file will show the policy file name. |
Explanation | While encoding the FilePath, there was an error. |
Action | Check the specified syntax. To identify which policy file has a problem, enable security trace for the component com.ibm.ws.security.policy.*. trace.log will show the policy file name. |
Explanation | In the system extension policy files, the grant entries should not specify codebase and signedby values |
Action | Remove the codebase and signedby values from the grant entry in the system extension policy file. (spi.policy or library.policy) |
Explanation | In the system extension policy files, the permission entries with signatures are not supported in the current version. |
Action | Remove the signature values from the permission entry in the system extension policy file. (spi.policy or library.policy) |
Explanation | The data stored for the keyword "type" in the hashmap is incorrect |
Action | This is an internal error. However, it could be caused by an incorrect xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not retrieve the policy template of the above type. |
Action | This is an internal error. However, it could be caused by an incorrect xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not convert the above class path to a URL |
Action | Check the class path. Usually, this path was picked up from xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not retrieve the resource adaptor policy file from the hashmap passed to setupPolicy(). |
Action | Check the data stored in the hashmap for the resource adaptor keyword. It could be caused by incorrect xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not get the absolute filepath of the resource adaptor policy file. |
Action | Check the filepath specified in resource.xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not retrieve the deployed application policy file from the hashmap passed to setupPolicy(). |
Action | This is an internal error. However, it could be caused by incorrect data in xml file. Check the type of the policy file and the hashmap being passed to setupPolicy(). Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not get the resource adaptor module"s absolute filepath. |
Action | It could be caused by incorrect data in resources.xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not get the Canonical path for the specified file |
Action | Check the specified file name passed to security. It could be caused by incorrect data in xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not convert the specified filepath to URL. |
Action | Check the specified filepath. It could be caused by incorrect data in xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not get the absolute path for the resource adaptor in removePolicy(). |
Action | Check the specified path. It could be caused by incorrect data in xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | Could not get the absolute path for the module in removePolicy(). |
Action | Check the specified path. It could be caused by incorrect data in xml file. Enable security trace with com.ibm.ws.security.policy.* to get more detailed information. |
Explanation | IOException occurred when creating the system extension template in the hashmap of all the templates. |
Action | Check the IOException to see the cause for not being able to create the system extension template in the hashmap. |
Explanation | ParserException occurred when creating the system extension template in the hashmap of all the templates. |
Action | Check the ParserException data. Check the specified policy file. |
Explanation | IOException occurred when creating the application policy template in the hashmap of all the templates. |
Action | Check the specified policy file. |
Explanation | ParserException occurred when creating the application policy template in the hashmap of all the templates. |
Action | Check the ParserException data. Check the specified policy file. |
Explanation | IOException occurred when putting the was.policy template in the hashmap of all the templates. |
Action | Check the specified was.policy file. |
Explanation | ParserException occurred when putting the was.policy template in the hashmap of all the templates. |
Action | Check the ParserException data. Check the specified was.policy file. |
Explanation | IOException occurred when creating the resource adaptor template in the hashmap of all the templates. |
Action | Check the specified ra.xml file"s permission specification. |
Explanation | ParserException occurred when putting the resource adaptor template in the hashmap of all the templates. |
Action | Check the ParserException data. Check the ra.xml"s permission specification. |
Explanation | IOException occurred when adding permission to the set of filtered permissions. |
Action | Check the filter.policy file. |
Explanation | ParserException occurred when adding permission to the set of filtered permissions. |
Action | Check the ParserException data. |
Explanation | Custom permission is being used in an application policy file. |
Action | Make sure that it is all right to use a custom permission in an application policy file. |
Explanation | Invocation TargetException occurred while constructing the permission object. |
Action | Check the exception. |
Explanation | An Exception occurred while constructing the permission object. |
Action | Check the exception. |
Explanation | An IOException occurred while adding the grant entry to the policy template of the resource adaptor. |
Action | Check the specified ra.xml file. |
Explanation | A ParserException occurred while adding the grant entry to the policy template of the resource adaptor. |
Action | Check the syntax of permission specification in the specified ra.xml |
Explanation | The above error number was returned by the above API. |
Action | Depending on the API being called, check the operating system documentation for the API. |
Explanation | The Admin application initialized successfully |
Action | None. Informational only. |
Explanation | The Naming application initialized successfully |
Action | None. Informational only. |
Explanation | The Rolebased authorizer initialized successfully |
Action | None. Informational only. |
Explanation | The Security Admin mBean registered successfully |
Action | None. Informational only. |
Explanation | An unexpected exception occurred when trying to create or register an mBean. |
Action | There might be a problem with the configuration. The exception might include details. |
Explanation | The specified resource could not be loaded due to an exception. |
Action | The failure might be related to a configuration problem related to the resource. |
Explanation | The userId and password specified for the server"s identity when configuring global security could not be used to authenticate the server. |
Action | Verify that the userId and password are valid and meet the requirements for the user registry or authentication mechanism. |
Explanation | The WCCM JAAS login configuration information could not be pushed to the JAAS configuration object. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Reports current security enabled or disabled status. |
Action | None. Informational only |
Explanation | An unexpected error occurred. It could be that the Cell Manager or Node Agent are not started. |
Action | If a remote security server was specified when enabling global security, verify that the Node Agent and Cell Manager are running. |
Explanation | The WCCM JAAS login configuration information was pushed to the JAAS configuration object. |
Action | None. Informational only. |
Explanation |
WebSphere provides an implementation of javax.security.auth.login.Configuration and dynamically installs this class at server startup. Either some application code has installed a different login provider class or a problem occurred when WebSphere tried to dynamically install the class. |
Action | Check for other server startup warning or error messages. |
Explanation |
WebSphere provides an implementation of javax.security.auth.login.Configuration and dynamically installs this class at server startup. Either some application code has installed a different login provider class or a problem occurred when WebSphere tried to dynamically install the class. |
Action | Check for other server startup warning or error messages. |
Explanation | WebSphere provides an implementation of the javax.security.auth.login.Configuration class. This class was successfully set at server startup. |
Action | None. Informational only. |
Explanation | WebSphere provides an implementation of the javax.security.auth.login.Configuration class. This class could not be set at server startup. |
Action | Configuration.class might not be present. This is an internal error. |
Explanation | A duplicate JAAS LoginModule alias name exist either in a JAAS login URL or in the security.xml file. The duplicate will be replaced with the last one processed. |
Action | Verify no duplicate JAAS LoginModule aliases exist in the login URLs or in the security.xml file. |
Explanation | The Rolebased authorizer could not be retrieved due to an exception. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The application must be loaded for the role base authorizer can be used to enforce authorization. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The role based authorizer will load only once per module. |
Action | None, informational only. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | A JAAS LoginContext could not be created due to the unexpected exception. |
Action | The problem could be due to a configuration error. |
Explanation | The HTTP cookie that contains the originally requested page was not found. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | PD Authentication disabled. |
Action | None, informational only. |
Explanation | When the LocalOS server ID is equal to the LocalOS realm, the access ID returned by the operating system is the machine ID not the server ID. |
Action | Make sure that the server ID is different from the machine ID. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Object created by reflection is null. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Method returned by reflection is null. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Reflection method invocation failed. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Describes whether the Security component"s FFDC Diagnostic module was successfully registered. |
Action | None. Informational only. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | LTPA is the configurated authentication mechanism but it has not yet been properly configured. Keys or other LTPA configuration attributes are missing. |
Action | Disable WebSphere security, restart the application server and properly configure LTPA authentication. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Security service initialization started. |
Action | None. Informational only |
Explanation | Security service initialization started. |
Action | None. Informational only |
Explanation | Security service initialization started. |
Action | None. Informational only |
Explanation | Security service started. |
Action | None. Informational only |
Explanation | Security service started. |
Action | None. Informational only |
Explanation | Security service started. |
Action | None. Informational only |
Explanation | An error occurred that prevented the SecurityServer from being created. |
Action | The log should contain additional errors that might indicate the cause of the problem. |
Explanation | An unexpected exception occurred retrieving the ORB SSL settings. |
Action | Verify that the property file, usually sas.server.props contents. Contact your service representative if the problem persists. |
Explanation | ORB SSL Key File or Passwords settings were missing in server-cfg.xml |
Action | Verify that the server-cfg.xml file. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An unexpected exception occurred during the cleanup of the specified repository. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | javax.naming.NamingException occurred when getting Initial Naming Context. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Unexpected exception occurred when removing the specified principal during cleanup. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The Vendor specified Authorization Table could not be loaded successfully. Therefore, using WebSphere provided authorization table. |
Action | Check to make sure that the Vendor"s implementation of Authorization Table is in the CLASSPATH and could be loaded. |
Explanation | java.lang.reflect.InvocationTargetException occurred when trying to run getActualCredential() method. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Unexpected exception occurred when trying to run getActualCredential() method. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An unexpected exception occurred while restoring the original credentials. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | CredentialDestroyedException occurred while trying to get BasicAuthData. The credential was already destroyed. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | javax.security.auth.login.CredentialExpiredException occurred while trying to get BasicAuthData. |
Action | refresh the credential. |
Explanation | CredentialDestroyedException occurred while trying to get credential token. The credential was already destroyed. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | javax.security.auth.login.CredentialExpiredException occurred while trying to get token. |
Action | refresh the credential. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | javax.naming.NamingException occurred while getting the initial naming context. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | javax.naming.NamingException occurred while rebinding the user registry. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | javax.naming.NamingException occurred while finding the user registry. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Unexpected exception occurred when initializing security server component. |
Action | None. This is warning. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An unexpected exception occurred when updating the authorization table. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | A unexpected exception occurred when trying to call the removePolicy() method for the specified type. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | All subjects assigned to Special role DenyAllRole for the specified application are removed. |
Action | None. This is a warning. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An unexpected exception occurred when trying to retrieve the information of the Resource Adapter to call the setupPolicy() method. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An IOException occurred when setting properties to the specified file. |
Action | Verify that the property file exists, that it has read permission and is writable. |
Explanation | An IOException occurred when getting properties from the specified file. |
Action | Verify that the property file exists, and that it has read permission. |
Explanation | com.ibm.websphere.security.PasswordCheckFailedException occurred when checking the password for specified user. |
Action | Verify that the password for the specified user. |
Explanation | com.ibm.websphere.security.CustomRegitryException exception occurred when checking the password for specified user. |
Action | Verify that the password for the specified user. |
Explanation | Unknown exception occurred when checking the password for specified user. |
Action | Verify that the password for the specified user. |
Explanation | Failed to decode the specified file. The details is shown in the exception. |
Action | Verify that the policy files, xml files(resource.xml) to confirm the class path specified in them are correct. |
Explanation | The specified file or directory does not exist. |
Action | Verify that the policy files, xml files(resource.xml) to confirm the class path specified in them are correct. |
Explanation | MalformedURLException occurred when trying to convert the specified path to URL. |
Action | Verify that the policy files, xml files(resource.xml) to confirm the class path specified in them are correct. |
Explanation | This configuration does not have any alias name. |
Action | No action is required. This is a warning message. |
Explanation | Exception occurred when getting registry"s realm. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Unexpected exception occurred when getting user registry. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
The caller does not have the necessary permission, this problem can occur because no credential is found on the thread, the caller is not authenticated, or the accessId might be null. |
Action | If the failure is unexpected, verify that the caller has been granted the required role. |
Explanation |
No invocation or received credentials were established on this thread. This might cause the role based authorization check to fail. |
Action | The stack trace is obtained by a local throw catch block that might be useful for debugging the problem. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | JAVA2 security is enabled. |
Action | None, informational only. |
Explanation | Java 2 Security Manager is NOT installed. |
Action | None, informational only. |
Explanation | A ParserException occurred while adding the grant entry to the policy template. |
Action | Check the ParserException data. Check the specified policy file. |
Explanation | Could not get the module"s absolute filepath. |
Action | Check the filepath given to load the module. |
Explanation | Syntax error in the policy file. ${Application} phrase should not include ${was.module.path} keyword. This entry is ignored. |
Action | Check the application policy file. |
Explanation | This message provides the current value of the java.security.debug property which is used to enable various debug information related to Java 2 Security. |
Action | None, this is informational only. |
Explanation | The Java Security Manager checkPermission() threw a SecurityException on the subject Permission. A caller on the call stack does not have the required permission. This might not be a problem if the caller properly handles this exception. |
Action |
Verify that the attempted operation is permitted by examining all Java 2 security policy files and application code. Additional permissions might be required, a doPrivileged API might be needed in some code on the call stack, or the Security Manager properly prevented access to a resource the caller does not have permission to access. |
Explanation | The permission class specified in the application policy file(was.policy or app.policy) does not exist. |
Action | Fix the specified application policy file. |
Explanation | The permission class specified in the filter policy file does not exist. |
Action | Fix the filter policy file. |
Explanation | The permission class specified in the application policy is not be removed. However, it is a part of the permission specified in filter.policy. |
Action | If the permission should be filtered out, divide the permission specified in the application policy. |
Explanation | The permission specified in the application policy was removed because filer.policy has the same entry. |
Action | none. This is an informational message. |
Explanation | java.securityAllPermission was found in the application. |
Action | none. This is an informational message. |
Explanation | There is a syntax error in the policy file. |
Action | Use ${java.home}/jre/bin/policytool to verify the syntax or edit the policy file and correct the syntax error. |
Explanation |
The caller does not have the necessary permission, there was no credential on the thread, the caller is not authenticated, or the accessId could be null. |
Action | If the failure is unexpected, verify the caller has been granted the required role. |
Explanation | Required attribute CertificateFilter is missing. Certificate Filter is required when CertificateMapMode is CERTIFICATE_FILTER. |
Action | Set CertificateFilter in the advanced LDAP settings. |
Explanation |
Using invalid user/group ID or the user/group ID is not a directory entry. The directory administration ID (root DN) is not a directory entry on most LDAP servers. |
Action | Verify that the user/group ID is a valid directory entry. |
Explanation | An unexpected error occurred during Java 2 Security and Dynamic Policy initialization. |
Action |
This is a general error. Look for previous messages that might be related to the failure or a configuration problem. Enabling security debug trace for security component com.ibm.ws.security.* might yield additional information. |
Explanation | The permission class specified in the policy file was not loaded. |
Action | Confirm that the specified permission in then policy file is correct. If permission class is incorrect, this warning is issued. |
Explanation |
No invocation or received credentials were established on this thread. This might cause the role based authorization check to fail. |
Action | The stack trace is obtained by a local throw catch block that might be useful for debugging the problem. |
Explanation | Unexpected exception occurred when loading registry properties file. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Cannot locate the registry implementation file. |
Action |
If you are using a Custom Registry make sure that your provide the registry implementation file in the GUI or in the scripting (whichever is being used). If you are using WebSphere Application Server supplied registries contact your service representative if the problem persists. |
Explanation | This can happen when using custom registries and if they are not instances of UserRegistry or CustomRegistry. |
Action | Make sure you implement the UserRegistry interface for your custom registry. |
Explanation | This can happen when the specified custom registry cannot be loaded. |
Action | The custom registry implementation file should be in the class path as mentioned in the custom user registry section in the information center documentation. If this happens for WebSphere Application Server provided registries contact your service representative if the problem persists. |
Explanation | The specified custom registry implementation cannot be initialized. |
Action | Make sure all of the properties required for the custom registry initialization are passed through the GUI or scripting (whichever is being used). If this happens for WebSphere Application Server provided registries, contact your service representative if the problem persists. |
Explanation | The checkPassword method failed to return a user. |
Action | If you are using WebSphere Application Server provided registries, this problem should have been preceeded by other authentication related exception(s). Refere to those exceptions to fix the actual authentication problem. If a custom registry is used, make sure to return a valid userId after authentication is successful. |
Explanation | The mapCertificate method failed to return a user from the certificate chain. |
Action | Make sure that the certificate should contain a valid user in the registry. This problem should have preceeded with other exception(s). Looking into them would help in narrowing down the problem. In addition if a custom registry is being used make sure you return a valid userId after successfully mapping the certificate. |
Explanation | Internal Error. The user name provided to create the credential is null. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The registry failed to return a user after authentication. |
Action | This would happen if the authentication was not successful and the custom registry did not throw exceptions to indicate this. Make sure you are entering a current userID and password for authentication. This problem might have preceeded by other problems. Looking at those problems might narrow the problem down. |
Explanation | Authentication failed with the specified reason. |
Action |
Verify that the user id and password are entered correctly. Consult with the administrator of the user registry if the problem persist. |
Explanation | Internal Error. |
Action | Information purposes only. |
Explanation | Error getting display name of a group. |
Action | Make sure that the group is valid and has a display name. |
Explanation | Problem getting display name of a group. |
Action | Make sure that the group is valid and has a display name. |
Explanation | Problem getting uniqueId of a group. |
Action | Make sure that the group is valid in the registry and if it is a custom registry make sure it also has an uniqueId. |
Explanation | Problem getting uniqueId of a group. |
Action | Make sure that the group is valid in the registry and if it is a custom registry make sure it also has an uniqueId. |
Explanation | Internal Error. |
Action | Make sure that the groups matching the pattern exist in the registry. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the user is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the user is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the group is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the group is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the group is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the user is valid and has a display name. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the user is valid and has a display name. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the user is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the user is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the users matching the pattern exist in the registry. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the user is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the user is valid. Contact your service representative if the problem persists. |
Explanation | Internal Error. |
Action | Make sure that the group is valid. Contact your service representative if the problem persists. |
Explanation | Not able to get the host name of the Windows machine or the domain controller. |
Action | Make sure that the user who is running WebSphere Application Server has administrative and "act as part of operating system" privileges on the Windows machine and is also an administrator in the domain machine. Contact your service representative if the problem persists. |
Explanation | Registry cannot be initialized. Internal Error. |
Action | Make sure that the user who is running WebSphere Application Server has administrative and "act as part of operating system" privileges in the Windows machine and is also an administrator in the domain machine. Contact your service representative if the problem persists. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | An exception occurred when getting the uniqueId of a user or group. |
Action | Make sure that the user or group is valid in the registry. If the active user registry is a custom registry, make sure a uniqueIds exist for the user or group. |
Explanation | Authentication failed because multiple users were found in the registry with the same name. |
Action | When using LDAP, make sure that the user shortname is unique. For example, if "uid" is used as the shortname, make sure that the uid is unique in the registry. |
Explanation | Authentication failed because the user does not exist. |
Action | Make sure that the user is valid in the registry. Also, when using LDAP, make sure that the user is searchable. The admin id in some LDAP servers might not be searchable. |
Explanation | A user cannot be found to create the credential. |
Action | Make sure that the user is valid in the registry. Contact your service representative if the problem persists. |
Explanation | Cannot create credential. |
Action | Make sure that the user is valid in the registry. If this error is preceeded by other exceptions, check those also. Contact your service representative if the problem persists. |
Explanation | The LTPA server object cannot be initialized. |
Action |
In most cases, this error occurs because the LTPA keys cannot be decrypted using the LTPA password. The password that is used to encrypt the keys is not the same password that is saved in the repository. The server might not come up when this problem occurs. If this happens, disable security, start the server, and then enter a new password for LTPA. Save the password, generate the keys, and then save again. Finally, turn on security and then stop and restart the server. Contact your service representative if the problem persists. |
Explanation | The security object cannot be created from the repository. This is an internal error. |
Action | The security.xml might be corrupted or missing. Contact your service representative. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | SSO is required for FormBased logon to work in Web applications when LTPA is the authentication mechanism. |
Action | If this is the intended configuration then ignore this warning. If this is not the intended configuration, then the enabled attribute of Single Sign-on element in the security.xml must be set to the true value. |
Explanation | This is an internal error. A NoSuchAlgorithmException occurred when the LTPAServer tried to sign the token. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Authentication has failed when using LTPA. |
Action | There could be multiple reasons why this might have occurred. Most of the time this should have preceeded with other exceptions that will indicate what the exact problem is. This might occur if the userName, password or both are incorrect, if the setup of the registry is not valid. If problems persist contact your service representative. |
Explanation | Cannot validate the token since the token is null. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Cannot validate the token since the token has expired. |
Action | Once the token timeout is reached, the token is not validated and you must authenticate again. This is normal. Make sure that all the WebSphere nodes and cell(s) are synchronized with respect to time, date and time zone. You can change the token expiration time if necessary. |
Explanation | The LTPA keys might not be the correct ones needed to verify the signature of the token. |
Action | This error occurs if the keys used to encrypt the token are not the same as the keys used to decrypt. If a new set of keys has been generated, this is an expected error. Any tokens signed using the old keys will no longer work. Contact your service representative if the problem persists. |
Explanation | This is an internal Error. Cannot create a credential after the token is validated. |
Action | This error usually occurs due to an expired token or a token created with different LTPA keys.If the token is expired, you might need to increase the LTPA timeout. If the keys are not the same, make sure that one set of LTPA keys are used. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The realm in the token does not match the current realm. |
Action | This error can occur when a token is passed between one cell and another cell, and the realms do not match in these cells. If you are using LDAP, make sure that both cells use the same host name and port number. |
Explanation | Cannot import LTPA keys. |
Action | This error occurs when the password used to import the keys does not match the password that encrypted the keys. Make sure that the password is the same. If the problem persists, contact your service representative. |
Explanation | Cannot export LTPA keys. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The keystore or truststore type specified is not valid. |
Action | Modify the SSL configuration so that the keystore or truststore type is a valid type. You can check the keystore and truststore types by loading them in WebSphere"s IKeyMan tool. |
Explanation |
The com.ibm.websphere.java2secman.norethrow property, when it has a true value, instructs the Java 2 Security Manager to NOT rethrow AccessControl exceptions. This property is intented to assist developers when they are preparing their applications for Java 2 Security. When this property value is true, the Security Manager reports the AccessControl exception but does not rethrow or propagate the exception up the call stack. This might permit applications to access resources that would they would otherwise not have access to. This property should not be specified in a production environment, only in a debug or application development environment. |
Action |
If this message is unexpected or the application is running in a production environment, remove the com.ibm.ws.java2secman.norethrow property setting unless you understand the consequences. |
Explanation | Informational. |
Action |
During the server and the cell security object merging, if a same alias name exists in both, the alias is not copied to the cell configuration. This is as designed. Normally, this should not happen since the alias names are unique. However, if a removeNode operation has been performed prior to the addNode operation, you might see this message since the removeNode does not remove the existing aliases. Also, if the alias names in the security.xml file were manually changed, then this message appears if the aliases match. |
Explanation | Informational. |
Action | This message appears when the Application Server contains its own security configuration that must be merged with cell level configuration. |
Explanation | The initialization of this Trust Association implementation failed. |
Action |
Verify that the appropriate Trust Association properties required for the initialization are set up correctly. If you are using your own implementation, check your initilization method for any problems. If a single Trust Association implementation is used, this indicates that the Trust Association is not in effect. However, if multiple TrustAssociation implementations are used, Trust Association can be in effect if one of the implementations is successful. If you receive this error message in association with a trust association interceptor that you are not using, you can ignore this message. |
Explanation | Cannot find and load the FIPS approved IBM JSSE or JCE providers. This is a problem when the IBM FIPS approved JCE provider is missing. Websphere Application Server depends on it when a FIPS approved provider is required. However, a missing FIPS approved IBM JSSE provider might not be a problem provided that you have configured it to use your own FIPS approved JSSE provider. |
Action | Make sure that the missing provider jar, if needed, is in the JDK ext directory. |
Explanation | Authenticaton will be perfomed using Tivoli Access Manager. This requires that WebSphere is configured to use an external Tivoli Access Manager server. |
Action | None, informational only. |
Explanation | Could not get the JACC provider PolicyConfiguration object. This object is required to propagate the security constraints information to the provider. |
Action | Make sure that the JACC provider property javax.security.jacc.PolicyConfigurationFactory.provider is set correctly to the PolicyConfigurationFactory implementation class. The preferred way to set this property is to use the JACC configuration properties panel or wsadmin tool. Also make sure that the provider classes are in the class path of all the servers. |
Explanation | The policy configuration object status could not be determined. Access will not be granted to this module. |
Action | The module in question might be in the process of being deleted. If the problem persists, contact your service representative. |
Explanation | The policy context key cannot be obtained to make the access decision. |
Action | Make sure that the Policy Context Key in question is registered by the container. |
Explanation | Cannot determine the isCallerInRole because of the exception. Default is to return false. Make sure that the security role-ref information is correct. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The provider"s policy implementation cannot be loaded because of the exception. |
Action | Make sure that the JACC provider properties are set correctly and the provider classes are in the class path. If problem persists, contact your service representative. |
Explanation | Could not determine the dataconstraint requirements for this resource. The request will be denied. |
Action | Make sure that the dataconstraint requirements are correctly configured in the deployment descriptor. |
Explanation | Could not determine the isUserInRole requirements for this resource. The default value false will be returned |
Action | Make sure that the RoleRef information is correctly configured in the deployment descriptor. |
Explanation | The Trust Association Interceptor did not have the correct principal in the Subject. The principal must implement java.security.Principal. |
Action | Contact the provider of the Trust Association Interceptor to ensure this problem gets resolved. |
Explanation | A SecurityServer could not be located for login. |
Action |
In some cases it is necessary to specify a valid bootstrap host/port in the com.ibm.CSI.securityServerHost and com.ibm.CSI.securityServerPort properties in the ${WAS_INSTALL_ROOT}/profiles/profile_name/properties/sas.client.props file. See sas.client.props for details. |
Explanation | Cannot provide the security policy information to the JACC provider because of the exception. Without this information the authorization decisions, cannot be made correctly when security is enabled. |
Action | Make sure that the JACC provider is properly configured and can be accessed. After the problem is fixed, either re-install the application or run the propagatePolicyToJACCProvider tool to propagate the policy information to the JACC provider. For more information about this tool, search for propagatePolicyToJaccProvider in the information center documentation. |
Explanation | Cannot delete the security policy information from the JACC provider because of the exception. This problem creates redundant information in the JACC provider. |
Action | Make sure that the JACC provider is properly configured and can be accessed. The JACC provider might have tools to remove this information. |
Explanation | Cannot provide the security policy information to the JACC provider because of the exception. Without this information, the authorization decisions cannot be made correctly when security is enabled. |
Action | Make sure that the JACC provider is properly configured and can be accessed. After the problem is fixed, one can either re-install the application or run the propagatePolicyToJACCProvider tool to propagate the policy information to the JACC provider. For more information about this tool, search for propagatePolicyToJaccProvider in the information center documentation. If the modification involved removing any modules, you can delete the information in the JACC provider to avoid redundant data. |
Explanation | The appContextIDForSecurity atribute is required when using JACC as the authorization. |
Action | If JACC will not be used for authorization then this should not impact anything. If JACC will be used for authorization, contact your IBM representative if this problem persists. |
Explanation | Information only. |
Action | Information only. |
Explanation | This is an internal error. Without the meta data, the moduleName and applicationName cannot be obtained for access decisions. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Could not get the JACC provider RoleConfiguration object. This object is required to propagate the authorizationTable information to the provider. |
Action | If the authorizationTable information is required by the provider, make sure that the JACC provider properties related to the RoleConfigurationFactoryImplClass is set correctly. Also make sure that the implementation classes are in the class path of all the servers. |
Explanation | Could not get the JACC provider PolicyConfiguration object. This object is required to propagate the security constraints information to the provider. |
Action | Make sure that the JACC provider property javax.security.jacc.PolicyConfigurationFactory.provider is set correctly to the PolicyConfigurationFactory implementation class. The preferred way to set this property is to use the JACC configuration properties panel or wsadmin tool. Also make sure that the provider classes are in the class path of all the servers. |
Explanation | Could not get the object required for security policy propagation. |
Action | Make sure that the JACC provider properties are set correctly in the JACC configuration. Also make sure that all the provider classes are in the class path of all the servers. |
Explanation | Could not get the object required for security policy propagation. |
Action | Make sure that the JACC provider properties are set correctly in the JACC configuration. Also make sure that all the provider classes are in the class path of all the servers. |
Explanation | The earFile is required to get the security policy information for the application. The configuration repository might be corrupted. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The appname is required to propagate the security policy information to the provider. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Because of an exception, the security policy information might not have been removed completely from the provider during the application uninstallation. |
Action | Make sure that the provider is up and running and the JACC configuration is correct. One can use the tools provided by the provider to remove the security policy information manully from the provider"s repository. |
Explanation | Because of an exception, the security policy information might not have been propapated to the provider during the application installation. |
Action | Make sure that the provider is up and running and the JACC configuration is correct. Once the problem is fixed, one can also use the wsadmin tool to manually propagate the security policy information to the provider instead of reinstalling the application. See the information center documentation for more details on running this tool. If problem persists, contact your service representative. |
Explanation | Because of an exception, the security policy information might not have been updated to the provider during the application update. |
Action | Make sure that the provider is up and running and the JACC configuration is correct. Once the problem is fixed, one can also use the wsadmin tool to manually propagate the security policy information to the provider instead of reinstalling the application. See the information center documentation for more details on running this tool. If problem persists, contact your service representative. |
Explanation | Because of an exception, the security policy information might not have been updated to the provider. |
Action | Make sure that the provider is up and running and the JACC configuration is correct. Once the problem is fixed, one can also use the wsadmin tool to manually propagate the security policy information to the provider instead of reinstalling the application. See the information center documentation for more details on running this tool. If problem persists, contact your service representative. |
Explanation | The initialization implementation of the provider failed with an exception or a non-zero error code. |
Action | Verify that the JACC provider properties are correctly set and that the initialization classes are in the class path. Check the provider implementation for problems. An error code of zero (0) indicates success. |
Explanation | This message is provided for information purposes only. |
Action | No user action is required. |
Explanation | When the server is running in FIPS mode the IBMJCEFIPS provider should be in the java.security file. |
Action | The java.security file needs to be changed to include the IBMJCEFIPS provider in the provider list before the IBMJCE provider. |
Explanation | This message is provided for information purposes only. |
Action | No user action is required. |
Explanation | This message is provided for information purposes only. |
Action | No user action is required. |
Explanation | The server is running in FIPS mode, using the IBMJCEFIPS provider. |
Action | No user action is required. |
Explanation | Security is unable to connect to some target Lightweight Directory Access Protocol (LDAP) servers, which might prevent future failover. |
Action | If you need to bring up additional servers for failover, verify that the required LDAP server is running. |
Explanation | This name refers to the LDAP host name that is currently used by the WebSphere Application Server security registry. |
Action | No user action is required. |
Explanation | new bind information might be incorrect. |
Action | Verify bind DN and password are correct. |
Explanation | new LDAP bind information has been pushed to security run time. |
Action | No user action is required. |
Explanation | It"s likely the TrustStore named CellDefaultTrustStore or KeyStore named NodeDefaultKeyStore does not exist in the configuration. |
Action | The node"s signer certificates need to be added to the cell"s truststores. |
Explanation | It"s likely the TrustStore named NodeDefaultTrustStore or KeyStore named CellDefaultKeyStore does not exist in the configuration. |
Action | The cell"s signer certificates need to be added to the node"s truststores. |
Explanation | The creation of keystore and truststore with self-signed certificate failed. |
Action | The node agent did not have certificates created when it was federated into the cell. The attempt to create them during addNode failed. |
Explanation | Informational. |
Action |
No user action is required. During the server and the cell security object merging, if a custom property with the same name exists in both, the property will not be copied to the cell configuration. It is normal for the cell to have custom properties that match the server. |
Explanation | An earlier leveled node cannot be added to a dmgr whose configuration is using the internalServerId. |
Action | The dmgr configuration needs to be modified to use the serverID/password before an older version node can be added |
Explanation | An earlier leveled node cannot be added to a dmgr whose configuration is missing the server password |
Action | The dmgr configuration needs to be modified to specify the server password |
Explanation | The product cannot locate the HTTPS port value that is specified in the URL. The port value is not found in the list of virtual hosts. |
Action | Check that the HTTPS port value that is specified is in the virtualhosts.xml file for the cell. The virtualhosts.xml file is located in the profile_root/config/cells/cell_name directory. |
Explanation | When admin security is disabled we do not initialize user registry or other services needed to properly authenticate. Therfore, we will return an UNAUTHENTICATED Subject to ensure the runtime continues to operate. |
Action | If an authenticated JAAS Subject is desired, you must enable at least administrative security in the security configuration. |
Explanation | When the authentication cache maximum size is reached, some entries from the cache are evicted. This will cause some users to go back through the login modules which is a slower process. |
Action | To increase the max cache size for the authentication cache, set the following System property (com.ibm.websphere.security.util.authCacheMaxSize) for each process that needs it. The property default is 25000 entries. |
Explanation | Authentication had been already established. If you want to login with another user, you need to logout first. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation |
Through the use of the FACILITY class and BBO.TRUSTEDAPPS class profile, trusted applications, as a general rule, are needed when using SAF as the local operating system user registry or when you plan to use SAF authorization. |
Action | You must enable the trusted applications by ensuring that the WebSphere Application Server has SAF access of READ to the RACF class of FACILITY and profile of BBO.TRUSTEDAPPS.<cell short name>.<cluster short name>. |
Explanation |
The role of the J2EE application must be defined as a profile in the EJBROLE class. Additionally, through the use of the FACILITY class and BBO.TRUSTEDAPPS class profile, trusted application, as a general rule, are needed when you plan to use SAF authorization. |
Action |
You must ensure the requesting user or group has READ access to the role in the EJBROLE class. You must enable the trusted applications by ensuring that the WebSphere Application Server has SAF access of READ to the FACILITY class and profile of BBO.TRUSTEDAPP.<cell short name>.<cluster short name>. |
Explanation | The Form-Logout service failed to successfully redirect to the page specfied on the logoutExitPage servlet parameter. The specified URL is either an invalidly formed URL or the hostname is not specified on the com.ibm.websphere.security.logoutExitPageDomainList property. |
Action | Correct the URL specified on the logoutExitPage parameter. |
Explanation | The WIMUserRegistry is currently configured as the active user registry. The realm name defined for the active user registry in the security.xml file is different than the realm name defined in the wimconfig.xml file. This may cause an increase CPU usage on logins, and a higher contention during lookups during authentication. |
Action | Validate that the realm name specified for the active user registry in the security.xml file is the same as the realm name specified in the wimconfig.xml file when the WIMUserRegistry is your active user registry. |
Explanation | Custom Property com.ibm.ws.security.ltpa.disableSECJ0371W blocks logging of message SECJ0371W. Some administrators found these messages to be a nuisance, cluttering the server logs. Under some cricumstances SECJ0371W may expose unexpected behavior that administrators may need to address. |
Action | None. Informational only. |
Explanation | The server refreshes the SSL configuration that is stored in memory. |
Action | No action is required. |
Explanation | The server did not refresh the SSL configuration that is stored in memory. |
Action | No action is required. |
Explanation | The SameSite security custom property cannot be set on the single sign-on cookie without a valid value. Valid SameSite custom property values are Lax, Strict, and None. |
Action | Set the SameSite security custom property to Lax, Strict, or None. |
Explanation | The maximum value for LTPA timeout cannot exceed 10 years or 5256000 minutes. |
Action | Set the LTPA timeout value to a value less than or equal to the maximum supported value of 10 years of 5256000 minutes. |
Explanation | JAAS Login exception occurred while refreshing the credential. |
Action | Confirm user id, password and realm information are correct. If you still see the problem, contact your service representative with exception stack trace information present in the error log. |
Explanation |
Authentication can fail for many reasons. The user or password might not have been entered correctly, misspelled for instance. The user account might not exist, might have expired, or be disabled. The password might have expired or require a change at first logon. If WebSphere security is configured to use LDAP as the user registry, the WebSphere security LDAP user and group search filter configuration might not match what the LDAP directory expects. |
Action |
Confirm that the user information (realm name, user name, password) is valid. Try authenticating the user directly to the configured user registry outside of WebSphere authentication to verify that the user and password are valid in the user registry. The WebSphere information center documents additional user account requirements for specific user registries. |
Explanation | Authentication failure occurred while invoking login() of realm/user since there is no CORBA credential. |
Action | Confirm if the user information(realm name, user name password) is valid. |
Explanation | JAAS Login failure occurred while invoking login() with token for LocalOS. |
Action | LocalOS does not support login with token. Make sure that the application program is valid. |
Explanation | JAAS Login failure occurred while invoking login() with token. |
Action | Check the user authenticate data is correct. Enabling security debug trace will provide the details.(com.ibm.ws.security.auth.* ) |
Explanation | JAAS Login returned null credential while invoking login() with token. There is no CORBA Credential. |
Action | login returned null Credential. Check the user application how it authenticate. Enabling security debug trace will provide the details.(com.ibm.ws.security.auth.* ) |
Explanation | Getting the JAAS subject from CORBA credential failed with exception. |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | WSLoginHelperImpl object instance should not be constructed. |
Action | Check the user application. WSLoginHelperImpl should not be directly constructed. |
Explanation | Some of the authentication data is missing. |
Action | Check the next message. It identifies what is missing. |
Explanation | User name, realm name or password is missing. |
Action | Confirm that the necessary authentication data is passed. Enabling security debug trace for component com.ibm.ws.security.auth.* might yield additional information. |
Explanation | Credential token is missing. |
Action | Confirm that the necessary authentication data is passed. |
Explanation | com.ibm.ejs.oa.EJSORB.getORBInstance() returns null |
Action | Make sure that the ORB is initialized correctly in the user application. |
Explanation | Getting security current caused an exception. |
Action | Make sure that the ORB is initialized correctly in the user application. |
Explanation | Exception occurred while processing callbacks |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | Unsupported Exception occurred while processing callbacks |
Action | Check the application. Contact your service representative with exception stack trace information present in the error log if the problem persists. |
Explanation | Exception occurred while committing LoginModule |
Action | Check the application. Contact your service representative with exception stack trace information present in the error log if the problem persists. |
Explanation | Exception occurred while removing the principal. |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | Exception occurred while removing the credential. |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | Exception occurred while removing CORBA credential. |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | Util object instance should not be constructed. |
Action | Check the user application. Util should not be directly constructed. |
Explanation | CORBA credential has attribute that is not valid. |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | CORBA credential has duplicate attributes. |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | CredentialsHelper object instance should not be constructed. |
Action | Check the user application. CredentialsHelper should not be directly constructed. |
Explanation | Failed to create a configuration instance |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | getAppConfigurationEntry() was called with null string. |
Action | Check the parameter if it is called from user application. If not, Contact your service representative. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | WSDefaultPrincipalMapping() should not be invoked. |
Action | This is warning. Check the user application. WSDefaultPrincipalMappingshould not be directly constructed. |
Explanation | Specified file did not exist. Use the default file. |
Action | This is a warning. Check the specified file name. |
Explanation | Unexpected exception occurred while creating a new URL. |
Action | Check the specified URL. Contact your service representative with exception stack trace information present in the error log. |
Explanation | Unexpected Exception occurred while opening an URL. |
Action | Check the specified URL. Contact your service representative with exception stack trace information present in the error log. |
Explanation | Unrecognizable Callback is passed. |
Action | Contact your service representative with information present in the error log. |
Explanation | Unexpected IOException was caught while processing callbacks. |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | Internal problem related to malformed or corrupted data storage. |
Action | Contact your service representative with exception stack trace information present in the error log. |
Explanation | The LoginModule did not create a Subject. There is a problem with the LoginModule |
Action | This problem could be due to a configuration error in security.xml or an internal error. |
Explanation | Token Authentication failure might be caused by an expired token, token that is not valid, or a date or time synchronization problem between WebSphere nodes. Web browsers often cache WebSphere SSO cookies which contain the token to validate. These tokens do expire. |
Action | Token validation failures are not always unexpected given that tokens can expire. might consider increasing timeout value or verifying that the system date and time between WebSphere nodes is synchronized. |
Explanation | Failed to get the specified property. |
Action | Check if you defined the specified property correctly. |
Explanation | Exception occurred trying to reflect on or invoke convertMapToString(). |
Action | Investigate the exception. Check class path. |
Explanation | MalformedURLException occurred trying to connect the specified URL. |
Action | Investigate the exception. Check the specified URL. |
Explanation | IOException occurred trying to connect the specified URL. |
Action | Investigate the exception. Check the specified URL. |
Explanation | IOException occurred trying to connect the specified URL. |
Action | Investigate the exception. Check the specified URL. |
Explanation | null or empty string was passed to update() method. |
Action | This is a warning. |
Explanation | Could not create or open the specified StringReader. |
Action | Investigate the exception. |
Explanation | IOException occurred trying to connect the specified stringreader. |
Action | Investigate the exception. Check the specified string. |
Explanation | Unexpected IOException occurred trying to close a stream. |
Action | This is a warning. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Exception occurred trying to reflect on or invoke convertMapToString(). |
Action | Investigate the exception. Check class path. |
Explanation | Duplicate login configuration name was specified in the configuration data. |
Action | Check the configuration data. |
Explanation | IOException occurred during parsing jaas application configuration. |
Action | Check the configuration file. Investigate the exception. |
Explanation | ParserException occurred during parsing jaas application configuration. |
Action | Investigate the exception. It has the information of syntax error in the configuration file. |
Explanation | Unexpected exception occurred while creating and initializing the user registry. |
Action | Check the application and the registry set up. Contact your service representative if the problem persist. |
Explanation | Unexpected exception occurred while restoring the credential. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | PrivilegedActionException occurred while restoring the credential. This exception is a wrapper of the exception created in doPrivileged block. |
Action | Investigate the real source of the exception. Contact your service representative if the problem persist. |
Explanation | InvalidCredentialType exception occurred while restoring the credential. |
Action | Investigate the SAS problem. Contact your service representative if the problem persist. |
Explanation | InvalidCredentialType exception occurred while restoring the credential. |
Action | Investigate the SAS problem. Contact your service representative if the problem persist. |
Explanation | InvalidCredentialType exception occurred while restoring the credential. |
Action | Investigate the SAS problem. Contact your service representative if the problem persist. |
Explanation | InvalidCredentialType exception occurred while restoring the credential. |
Action | Investigate the SAS problem. Contact your service representative if the problem persist. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | WSMappingCallbackHandlerFactory implementation class might be defined in security.xml to customize Mapping CallbackHandler. This is not an error condition. When the implementation class is not defined, a default WebSphere implementation will be used. |
Action | No action is required unless one wants to override the WebSphere default WSMappingCallbackHandlerFactory implementation. |
Explanation | WSDefaultPrincipalMapping initialization failed. The JCA container managed principal/credential mapping most likely will not work properly. |
Action | Examine the cause of the exception and correct the problem. The most likely cause for this error is that the WSMappingCallbackHandlerFactory implementation class was not configured properly. |
Explanation | WSDefaultPrincipalMapping initialization failed. The JCA container managed principal/credential mapping most likely will not work properly. |
Action | Examine the cause of the exception and correct the problem. The most likely cause for this error is that the WSMappingCallbackHandlerFactory implementation class was not configured properly. |
Explanation | Either the custom properties HashMap or the authentication data alias was not defined. |
Action | This might not be a problem depending on the particilar mapping LoginModules. |
Explanation | An exception was created by the WebSphere default principal/credential mapping function. |
Action | This is most likely caused by incorrect authentcaiton data configuration. |
Explanation | WebSphere default principal/credential mapping function could not find the specified credential information. |
Action | This is most likely caused by incorrect authentication data configuration. |
Explanation | Unexpected problem occured when processing a WebSphere Application Server V5 mapping callback type. |
Action | Contact your service representative with information present in the error log. |
Explanation | A Custom Login module must be provided and configured prior to this login module in the JAAS Login Configuration and should have provided trust information in shared state. |
Action | Check a Custom Login Module is provided and configured prior to this login module in the JAAS Login Configuration and make sure that the shared state information is set correctly based on the requirement. |
Explanation | Both a principal and X509Certificate are provided in the trust information, the principal has priority and will be used for the login. |
Action | If login with the X509Certificate is desired then the principal should not be passed in the trust information. |
Explanation | A Custom Login module must provide an identity to perform identity assertion. |
Action | Check a Custom Login module to make sure an idenity is provided to the perform identity assertion. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The object mentioned above probably does not implement the java.io.Serializable interface. |
Action | Ensure that the object implements the java.io.Serializable interface to ensure it gets propagated downstream. |
Explanation | The object failed to de-serialize at the target server. The likely cause is the implementation class is not present on the target server or the Java class version between the sending server and target server is different. |
Action | Ensure that the correct java class exists at the target server. |
Explanation | Cannot overwrite an existing PropagationToken. The existing one is returned, so use it to set new attributes given the proper permission. |
Action | Check the addPropagationToken SPI for the value returned. A null value indicates this is the first time the token is added. A non-null value indicates you are setting the token again which is not allowed. Use the returned value to add new attributes. |
Explanation | The com.ibm.wsspi.security.cred.uniqueId property has not been found during a properties login attempt. |
Action | Ensure that the java.util.Hashtable used for a properties login contains a valid property value for com.ibm.wsspi.security.cred.uniqueId. |
Explanation | The com.ibm.wsspi.security.cred.securityName property has not been found during a properties login attempt. |
Action | Ensure that the java.util.Hashtable used for a properties login contains a valid property value for com.ibm.wsspi.security.cred.securityName. |
Explanation | The com.ibm.wsspi.security.cred.longSecurityName property has not been found during a properties login attempt. |
Action | Ensure that the java.util.Hashtable used for a properties login contains a valid property value for com.ibm.wsspi.security.cred.longSecurityName. |
Explanation | The realm specified does not match the current security realm of this server. This could cause problems when trying to go downstream to another server on the same current realm. |
Action | If a different realm is desired, set the supportedTargetRealms field to include the new realm you are specifying in order to go outbound to servers in the current realm. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The LTPA TokenFactory implementation is likely not present in the class path. |
Action | Ensure that the LTPA TokenFactory implementation is located in the WebSphere class path. Typically these implementations are put in the ${WAS_INSTALL_ROOT}/classes directory. |
Explanation | The LTPA TokenFactory implementation is likely not present in the class path or it cannot be initialized. |
Action | Ensure that the LTPA TokenFactory implementation is located in the WebSphere class path. Typically these implementations are put in the ${WAS_INSTALL_ROOT}/classes directory. |
Explanation | The LTPA TokenFactory implementation had a problem in the createToken method or the keys used to create a token were not present. |
Action | Ensure that the LPTA keys are configured properly and check the createToken implementation on the TokenFactory interface. |
Explanation | This error most likely occurs when the Simple WebSphere Authentication Mechanism (SWAM) authentication mechanism is the active authentication mechanism. SWAM is meant for stand-alone servers and is not supported by WebSphere Process Server or by an environment that requires cross server (server-to-server) secure communications. |
Action | Ensure that the active authentication mechanism is LTPA. |
Explanation | This audit message indicates that the WebSphere Application Server Security Auditing service is enabled. |
Action | No action is required is this is the desired setting. |
Explanation | This audit message indicates that security auditing records are required. |
Action | No action is required if this is the desired setting. Note that the intention of this auditing policy is not to commit a business transaction unless the required security auditing records can be saved. |
Explanation | Failed to load the specified class which was defined in the global security custom properties. |
Action | Verify that the class name, class path, and class file are configured properly. |
Explanation | Indicate that the specified provider class was loaded. |
Action | No action is required. |
Explanation | This audit message indicates that the WebSphere Application Server Security Auditing service is disabled. |
Action | No action is required if this is the desired setting. |
Explanation | The provider configuration in global security custom properties was incorrect. |
Action | Check the specified properties and in particular the first missing parameter in the error message. |
Explanation | At least one AuditEventFactory and an AuditServiceProvider must be defined when the security auditing policy is set to REQUIRED. |
Action | Verify that the two properties com.ibm.websphere.security.audit.auditEventFactory and com.ibm.wsspi.security.audit.auditServiceProvider are defined proerly in the global security custom properties. |
Explanation | The specified properties was not defined properly in the global security customer properties. |
Action | Verified that the specified properties is defined properly in the global security custom properties. |
Explanation | Runtime exception occured most likely due to incorrect class definition, incorrect class path, or missing class files. |
Action | Examine the exception for the cause of the problem. |
Explanation | The getActive method in the spcified AuditEventFactory implementation failed. |
Action | Examine the exception for the cause of the problem. If the problem was not related to incorrect configuration, then you need to consult with the vendor of the AuditEventFactory implementation. |
Explanation | Extra AuditServiceProvider was defined and is discarded. |
Action | The com.ibm.wsspi.security.audit.auditServiceProvider properties contains extra information than necessary. Any information following the valid AuditServiceProvider definition is discarded. |
Explanation | The specified audit service provider was not defined in the global security custom properties. |
Action | Define the specified properties if security auditing service is required in your business environment. |
Explanation | This audit message indicates that security auditing records are optional. |
Action | No action is required if this is the desired setting. Note that the intention of this auditing policy is not to suspend a business transaction when security auditing records cannot be saved. |
Explanation | As a convention, an AuditEventFactory implementation that is configured under the J2EE name must implement the J2EEAuditEventFactory interface. |
Action | Examine the com.ibm.websphere.security.audit.AuditEventFactory properties in global security custom properties. |
Explanation | This message is intended to be used by the defaultAuditEventFactoryImpl sendAccessAuditEvent method only. |
Action | No action required. |
Explanation | This message is intended to be used by the defaultAuditServiceProviderImpl sendEvent method only. |
Action | No action required. |
Explanation | This message is intended to be used by the defaultAuditEventFactoryImpl sendAuthnAuditEvent method only. |
Action | No action required. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This message is intended to be used by the defaultAuditEventFactoryImpl sendAuthzAuditEvent method only. |
Action | No action required. |
Explanation | This message is intended to be used by the defaultAuditEventFactoryImpl sendMappingAuditEvent method only. |
Action | No action required. |
Explanation | This message is intended to be used by the defaultAuditServiceProviderImpl sendEvent method only. |
Action | No action required. |
Explanation | This message is intended to be used by the defaultAuditEventFactoryImpl sendLogoutAuditEvent method only. |
Action | No action required. |
Explanation | The configured AuditServiceProvider did not run the method in a reasonable time period while security auditing function is required. |
Action | Examine the exception for the cause of the problem. Typically the business transactions should have been aborted because no security auditing record can be logged. |
Explanation | Could not obtain a handle to the Audit context objects in order to be able to populate with event data. |
Action | Examine the exception for the cause of the problem. |
Explanation | A failure occurred in the auditing subsystem, preventing the event from being processed/logged. |
Action | Examine the exception for the cause of the problem. |
Explanation | A failure occurred during shared key generation. |
Action | Examine the exception for the cause of the problem. |
Explanation | Could not open the audit keystore. |
Action | Examine the exception for the cause of the problem. Ensure that the audit keystore exists. |
Explanation | A failure occurred while retrieving the audit signer certificate. |
Action | Examine the exception for the cause of the problem. Ensure that the signer certificate exists. |
Explanation | Certificate encoding error. |
Action | Examine the exception for the cause of the problem. |
Explanation | Encoding error. |
Action | Examine the exception for the cause of the problem. |
Explanation | Encryption error generated while trying to encrypt the audit record. |
Action | Examine the exception for the cause of the problem. |
Explanation | Signing error generated while trying to sign the audit record. |
Action | Examine the exception for the cause of the problem. |
Explanation | IO error writing the audit record to the binary log. |
Action | Verify the log exists. Examine the exception for the cause of the problem. |
Explanation | Initialization failure of encryption algorithm. |
Action | Examine the exception for the cause of the problem. |
Explanation | Failed to create the output Audit log. |
Action | Examine the exception for the cause of the problem. |
Explanation | Could not write the audit record to the Audit log. |
Action | Verify the log exists. Check the error logs for any possible IO exceptions. |
Explanation | Audit service was not initialized, which occurred most likely due to incorrect class definition, incorrect class path, or missing class files. |
Action | Examine the exception for the cause of the problem. |
Explanation | No Audit Event Factory implementations are found in the configuration. |
Action | Ensure that there is at least one audit event factory configured. |
Explanation | Cannot find keystore created by the Auditor. |
Action | Ensure that the keystore has been created containing the certificate generated by the Auditor. |
Explanation | No Audit Service Providerimplementations are found in the configuration. |
Action | Ensure that there is at least one audit service provider configured. |
Explanation | An error occurred while building the auditable record data. |
Action | Examine the exception for the cause of the problem. |
Explanation | An error occurred during the initialization of the Audit signing algorithm. |
Action | Examine the exception for the cause of the problem. |
Explanation | A data stream that was not valid was passed in to the signing algorithm. |
Action | Verify that a non-null byte stream of data is being passed in. |
Explanation | Message digest is null or not valid. |
Action | Verify that the message digest is not null or not valid. |
Explanation | A data stream that is not valid was passed into the encryption algorithm. |
Action | Verify that a non-null byte stream of data is being passed in. |
Explanation | A shared key that is not valid was detected. |
Action | Verify that a valid key is being used. Check the error logs for further information. |
Explanation | A data stream that is not valid was passed into the decryption algorithm. |
Action | Verify that a non-null byte stream of data is being passed in. |
Explanation | An unrecoverable error occurred in the audit subsystem. Auditing is discontinued. |
Action | Examine the error logs for the cause of the problem. |
Explanation | An error occurred while sending an audit notification. |
Action | Examine the error logs for the cause of the problem. |
Explanation | Audit system failure policy set to WARN or FATAL, but notification configuration is not properly configured. |
Action | Ensure audit notification is configured. |
Explanation | Audit Event Factory was not initialized, which occurred most likely due to incorrect class definition, incorrect class path, or missing class files. |
Action | Examine the exception for the cause of the problem. |
Explanation | Cannot assign a user who does not have the auditor role as the primary auditor. |
Action | Ensure the user specified is given the auditor role or select a user who already has the auditor role. |
Explanation | An error occurred accessing the workspace. |
Action | None |
Explanation | The server is in a quiesced state. The maximum number of audit logs has been reached and the wrapping behavior is set to not wrap the oldest log. |
Action | Determine whether the maximum number of audit logs needs to be increased. To get the audit service and server running again, archive all the audit logs to a safe repository, and restart the server. |
Explanation | Audit logging stopped: maximum number of audit logs has been reached and the wrapping behavior is set to SILENT_FAIL. |
Action | Determine whether the maximum number of audit logs needs to be increased. Archive all the saved audit logs to a safe repository and restart the server to restart the auditing service |
Explanation | A web request is rejected because it contains a URI name that is not valid. |
Action | Incorrect URI might be a simple user error or an indication of potential threat where malicious users explore the weakness of web applications. You might perform a correlation analysis of security auditing events. |
Explanation | A web request is rejected because no web access security context is configured. |
Action | The cause might be a simple user error or an indication of potential threat where malicious users explore the weakness of web applications. You might perform a correlation analysis of security auditing events. |
Explanation | Access to a web resource does not require access control because there is no servlet mapping. |
Action | The URI is not protected. No action is required is this is the desired configuration. Otherwise, proper security constraint should be added to the web application. |
Explanation | Access to a web resource does not require access control because there is no security constraint. |
Action | The URI is not protected. No action is required is this is the desired configuration. Otherwise, proper security constraint should be added to the web application. |
Explanation | Access to login page, error page, and form login page does not require access control. |
Action | The URI is not protected. No action is required. |
Explanation | According to Servlet V2.4 Spec, access to a web resource should be precluded if there is an auth constraint in the security constraint but there is no security role defined in the auth constraint. |
Action | Modify the security constraint if the current behavior does not fit your needs. |
Explanation | The requested resource has a Data Constraint and requires SSL connection to it. |
Action | No action is required. |
Explanation | WebSphee Application Server does not support the configured login method. |
Action | Modify the deployment descriptor to choose a supported login method. You might explore the Trust Association Interface and the UserRegistry interface and plug in your custom implementation to support the DIGEST login method. |
Explanation | According to Servlet V2.4 Spec, access to a web resource should be permitted if there is no auth constraint in the security constraint. |
Action | Modify the security constraint if the current behavior does not fit your needs. |
Explanation | Access to a web resource is granted to any user without requiring authentication when the Everyone Special Subject was mapped to at least one of the required security role. |
Action | Modify the security constraint if the current behavior does not fit your needs. |
Explanation | Authentication was successful. |
Action | No action is required. |
Explanation | Authentication failed due to internal failure. |
Action | Examine the cause of the exception and correct the problem. If the problem persists, contact your service representative. |
Explanation | Authentication failed because the SSO token has expired. |
Action | No action is required. |
Explanation | Authentication failed because the SSO token was not valid. |
Action | No action is required. |
Explanation | A Trust Association Interceptor engages in the authentication protocol and needs authentication information from the web client. |
Action | No action is required. |
Explanation | The authentication via the specified Trust Association Interceptor was successful. |
Action | No action is required. |
Explanation | The authentication via the specified Trust Association Interceptor failed because the asserted user name cannot be mapped to a valid WebSphere Application Server user. |
Action | If this problem persists, the mapping problem is likely to be caused either by incorrect TAI configuration or by TAI implementation. |
Explanation | Form based Authentication failed due to missing or incorrect user id or password. Typically a web user will be redirect to a login page to retry. |
Action | No action is required. |
Explanation | The authentication based on the X509 client certificate failed because the certificate user name cannot be mapped to a valid WebSphere Application Server user. |
Action | No action is required. |
Explanation | The authentication failed because the client certificate user name cannot be mapped to a valid WebSphere Application Server user. |
Action | The user might not be defined in the registry. Otherwise, verify the registry and mapping configuration. |
Explanation | The authentication failed because there is no active user registry defined to map the client certificate user name to a valid WebSphere Application Server user. |
Action | Verify that the registry and mapping configuration. |
Explanation | The authentication failed due to an unexpected runtime exception. |
Action | Report the problem to IBM. |
Explanation | The authentication failed due to an unexpected runtime exception. The web application configuration allows authentication using user id and password. Will try to see if there is user id and password information in the HTTP header. |
Action | No action is required. |
Explanation | The authentication failed because there is no authorization header in the HTTP header. WebSphere Application Server will send a 401 challenge to the web client. |
Action | No action is required. |
Explanation | The authentication failed because there is no user id and password information in the HTTP header. WebSphere Application Server will send a 401 challenge to the web client. |
Action | No action is required. |
Explanation | The authentication failed because there the user id and password information in the HTTP header was incorrect. WebSphere Application Server will send a 401 challenge to the web client. |
Action | No action is required. |
Explanation | Authentication using the user id and password in the HTTP header was successful. |
Action | No action is required. |
Explanation | Basic Authentication failed and a runtime exception was caught. |
Action | Report this problem to IBM. |
Explanation | Authentication failed and a runtime exception was caught. |
Action | Report this problem to IBM. |
Explanation | Access to the resource is allowed because WebSphere Application Server global security eas not enabled. |
Action | No action required if this is the configured behavior. |
Explanation | Access to the resource is allowed because the user or the groups the user is in have the required security role. |
Action | No action required if this is the desired behavior. |
Explanation | Access to the resource is denied because the user or the groups the user is in does not have any of the required security role. |
Action | No action required if this is the desired behavior. |
Explanation | Access to the resource is denied because the user or the groups the user is in does not have any of the required security role. |
Action | No action required if this is the desired behavior. |
Explanation | Access to the resource is denied because the user or the groups the user is in does not have any of the required security role. |
Action | No action required. |
Explanation | The client context id (= 0) in a MessageInContext message is not valid. |
Action | No action required. |
Explanation | The client context id is inconsistent with session state. |
Action | This problem should be analyzed to determine whether it was due to program or operational error or due to spoofing attempt. |
Explanation | The security token in the security context has expired. |
Action | Typically token has a finite expiration time and this condition might be normal. |
Explanation | The message type ASSOC_ACCEPT should not be received at the target server. This might occur due to an exception that occurred on the client which caused a mixup. |
Action | Check the client configuration to ensure that there"s nothing out of the ordinary that might be causing an exception to occur. |
Explanation | The client security context was re-established successfully using the client session context identifier. The message type ASSOC_ACCEPT should not be received at the target server. |
Action | No action is required. |
Explanation | Parsing the client authorization token failed. |
Action | Need to determine if this is caused by programming error. |
Explanation | GSS security context token contains OID number that is not valid or authentication mechanism that is not valid. |
Action | No action required. |
Explanation | Authentication failed due to internal error. |
Action | No action required. |
Explanation | The Identity token is not valid. |
Action | No action is required. |
Explanation | Could not validate Client Authentication Token or Client Certificates during Identity Assertion. |
Action | No action is required. |
Explanation | Failed to convert the client certificate. |
Action | No action is required. |
Explanation | Setting the credentials to unauthenticated because there is no valid identity token. |
Action | No action is required. |
Explanation | Message type is not EstablishContext and stateful=false. |
Action | No action is required. |
Explanation | Examine the exception for reason of failure. |
Action | No action is required. |
Explanation | The authentication was successful. |
Action | No action is required. |
Explanation | The J2EE Connection principal/credential mapping was successful. |
Action | No action is required. |
Explanation | The user has been granted to one or more of the required roles. |
Action | No action is required. |
Explanation | The user has not been granted any one of the required roles. |
Action | No action is required. |
Explanation | The HTTP session is cleaned up after form logout. |
Action | No action is required. |
Explanation | The web resource requires Form based authentication. Typically a web user will be redirected to a login page to enter user id and password. |
Action | No action is required. |
Explanation | Form based authentication was successful. |
Action | No action is required. |
Explanation | The Java Security Manager checkPermission() threw a SecurityException on the subject Permission. A caller on the call stack does not have the required permission. This might not be a problem if the caller properly handles this exception. |
Action | Verify that the attempted operation is permitted by examining all Java 2 security policy files and application code. Additional permissions might be required, an AccessController.doPrivileged call might be needed in some code on the call stack, or the Security Manager has properly prevented access to a resource that a caller does not have permission to access. |
Explanation | The Java Security Manager checkPermission() threw a SecurityException. A caller on the call stack does not have the required permission. |
Action | Verify that the attempted operation is permitted by examining all Java 2 security files and application code. Additional permissions might be required. |
Explanation | Applications running in this server are considered "trusted". When applications are trusted, the security infrastructure will allow the creation of MVS credentials without a password, passticket, or certificate as an authenticator. Trusted applications must be enabled in order to use the LTPA authentication mechanism, identity assertion, or a Trust Association Interceptor with a "Local OS" user registry on z/OS. Trusted applications must also be enabled to use SAF authorization. |
Action | No user action is required. |
Explanation | Applications running in this server are not considered "trusted". Since applications are not trusted, the security infrastructure has disallowed the creation of MVS credentials without a password, passticket, or certificate as an authenticator. Trusted applications must be enabled in order to use the LTPA authentication mechanism, identity assertion, or a Trust Association Interceptor with a "Local OS" user registry on z/OS. Trusted applications must also be enabled to use SAF authorization. |
Action | No user action is required. |
Explanation | The server has been configured to perform J2EE and operating system thread identity synchronization for applications that request it. |
Action | No user action is required. |
Explanation | The server has been configured to perform J2EE and operating system thread identity synchronization for applications that request it but the security product has not authorized the use of this support. |
Action | Contact your security product administrator to request authorization to use thread identity synchronization. |
Explanation | The server has been configured to perform J2EE and operating system thread identity synchronization for connectors that are able to exploit it. |
Action | No user action is required. |
Explanation | The server has been configured to perform J2EE and operating system thread identity synchronization for connectors that are able to exploit it but the security product has not authorized the use of this support. |
Action | Contact your security product administrator to request authorization to use thread identity synchronization. |
Explanation | WebSphere will not perform SURROGAT class authorization checks prior to creating native security environments. |
Action | No user action is required. |
Explanation | WebSphere for z/OS has been configured to use the z/OS security product for authorization. The authorization policies for WebSphere must be defined in the EJBROLE class of the z/OS security product. Authorization policies embedded in the applications will be ignored. |
Action | No user action is required. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The APPLDATA associated with the profile representing the J2EE role will be used to determine the id of a user that is in the role. An invocation Subject will be built with a credential for that user. |
Action | No user action is required. |
Explanation | The security service was unable to create a delegation credential. This failure is usually due to incorrect or missing APPLDATA associated with the EJBROLE profile associated with the application role. |
Action | Verify that the EJBROLE profile exists and is defined correctly. If the profile is correct, use the information about the SAF service, and SAF service return codes to determine the cause of the failure. If the problem persists, contact the IBM support center. |
Explanation | An earlier error prevented WebSphere from creating a subject that was in the required role. The target method will be dispatched without a change the current security environment. This might result in authorization errors as the caller might not be in the required role. |
Action | Examine the previous messages to determine the initial cause of th error. |
Explanation | WebSphere was unable to authenticate the user with the password that was presented. It is likely that the user ID or password were not valid. |
Action | Verify that the user ID is valid. If the user is valid, use the provided SAF serivce information to get more information about the cause of the failure. |
Explanation | WebSphere was unable to map the certificate that was presented to a valid user. It is likely that the issuer of the certificate is not trusted or that the mapping rules do not account for issuer and subject distinguished names. |
Action | Verify that the certificate chain is trusted. If the chain is valid and trusted, use the provided SAF service information to get more information about the cause of the failure. |
Explanation | An authorized service used to create a native z/OS credential has failed. The credential cannot be used by the caller. |
Action | Use the provided SAF service information to determine the cause of the failure. If the problem persists, contact the IBM support center. |
Explanation | The z/OS security product did not authorize the creation of a security environment for the specified user. The security environment associated with the current address space will be used. |
Action | Contact your security product administrator to authorize the creation of a security environment for the specified user if required by your application. |
Explanation | An authorized service used to perform thread identity synchronization has failed. The thread security environment might not have been associated with the current thread of execution. |
Action | User the provided SAF service information to determine the cause of the failure. If the problem persists, contact the IBM support center. |
Explanation | A custom SAF role to profile mapper has been configured, loaded, and initialized. |
Action | No user action is required. |
Explanation | WebSphere was unable to load and and instantiate the configured class. This is generally due to an incorrect class name. |
Action | Verify that the specified class name is correct and that it can be loaded by the WebSphere class loader. |
Explanation | The BPX1TLS service does cannot be called from the initial pthread task (IPT). If this service is called on the IPT, future calls to perform connection management or application thread identity synchronization will fail. |
Action | No action is required. |
Explanation | WebSphere was unable to map the kerberos prinicpal that was presented to a valid RACF user. |
Action | Verify that the kerberos principal is set to the KERBNAME value in the KERB segment of a valid RACF user. |
Explanation | The distributed user name is null and will not be mapped not a SAF user. |
Action | Specify a valid distributed user name. |
Explanation | The distributed realm name is null and will not be mapped not a SAF user. |
Action | Specify a valid distributed realm name. |
Explanation | The distributed user name exceeds the maximum allowable length. |
Action | Specify a valid distributed user name. |
Explanation | The distributed realm name exceeds the maximum allowable length. |
Action | Specify a valid distributed realm name. |
Explanation | The distributed user could not be mapped to a SAF user, most likely because there was no match for the distributed user name and realm name in the RACMAP profiles of the SAF database. |
Action | Verify that a RACMAP profile exists in the SAF database for the distributed user name and realm name. |
Explanation | The version of the SAF product is displayed. |
Action | No user action is required. |
Explanation | The SAF feature for distributed identity mapping is in effect. Distributed users will be mapped to SAF users using the filters defined in the SAF RACMAP profiles. |
Action | No user action is required. |
Explanation | The SAF feature for distributed identity mapping is not in effect. |
Action | No user action is required. |
Explanation | Authorization failed for the user. The exception has information on why the authorization failed. |
Action | Examine the message in the exception for more information. |
Explanation | Authorization failed for the user. |
Action | Consult with the SAF administrator for granting the necessary access in the SAF database. |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | In order to use keytab, the keytab filename must be specified and the Kerberos credential cache (ccache) filename must not be specified. |
Action | None |
Explanation | Admin user id could not be added to virtual member manager file-based registry |
Action | Validate virtual member manager has been configured |
Explanation | Found other virtual member manager repository configurations but only file-based is supported in the wizard |
Action | None |
Explanation | An error occuring accessing the Workspace |
Action | None |
Explanation | Error occurred updating the admin-authz.xml file with the new admin user |
Action | None |
Explanation | Exception raised when accessing the Security object in the workspace |
Action | None |
Explanation | Valid user registry types are: LDAPUserRegistry, LocalOSUserRegistry, CustomUserRegistry, WIMUserRegistry |
Action | Ensure user registry type is a valid type |
Explanation | LDAP registry type was not a valid type |
Action | Ensure user registry type is a valid type |
Explanation | Exception raised while verifying at least one admin id in the admin-authz.xml exists in the user registry |
Action | None |
Explanation | Could not auto-generate an LTPA password |
Action | None |
Explanation | Could not auto-generate a Server Id |
Action | None |
Explanation | Admin name does not exist in the specified user registry |
Action | Ensure that the admin name exists in the user registry prior to executing command |
Explanation | Caught exception while applying wizard security settings |
Action | None |
Explanation | Caught exception while getting wizard security settings |
Action | None |
Explanation | Caught exception while getting Application Security setting |
Action | None |
Explanation | Caught exception while getting Global Security setting |
Action | None |
Explanation | Caught exception while setting Global Security setting |
Action | None |
Explanation | Caught exception while validating admin name |
Action | None |
Explanation | Exception raised connecting to the LDAP server |
Action | Verify input parameters are correct |
Explanation | Exception raised while setting useRegistryServerId in the user registry object |
Action | None |
Explanation | Failed to validate user password in federated respositories |
Action | None |
Explanation | Exception raised while adding adminId to user registry |
Action | None |
Explanation | Failed to add the adminID to the user registry object |
Action | None |
Explanation | The audit system failure action type provided is not supported. Supported types are: WARN, NOWARN, and FATAL |
Action | Verify the audit system failure action type is correctly specified |
Explanation | Error detected in the audit configuration |
Action | Verify that the audit configuration is correctly specified in the audit.xml |
Explanation | The auditor identity is a required field. |
Action | Verify that a value has been specified for the auditor identity |
Explanation | The auditor password is a required field. |
Action | Verify that a value has been specified for the auditor password |
Explanation | The keystore reference is a required field. |
Action | Verify that a valid reference has been specified for the keystore |
Explanation | The uniqueName reference is a required field. |
Action | Verify that a valid reference has been specified for the uniqueName |
Explanation | The className reference is a required field. |
Action | Verify that a valid reference has been specified for the className |
Explanation | The eventFormatterClassName reference is a required field. |
Action | Verify that a valid reference has been specified for the eventFormatterClassName |
Explanation | The fileLocation reference is a required field. |
Action | Verify that a valid reference has been specified for the fileLocation |
Explanation | The auditFilters reference is a required field. |
Action | Verify that a valid reference has been specified for the auditFilters |
Explanation | Failure occurred trying to create a configuration object. |
Action | None |
Explanation | The eventType field is required. |
Action | Verify that a valid reference has been specified for the event type |
Explanation | The outcome field is required. |
Action | Verify that a valid reference has been specified for the audit outcome |
Explanation | The provider field is required. |
Action | Verify that a valid reference has been specified for the audit service provider |
Explanation | The audit specification reference field is required. |
Action | Verify that a valid value has been specified for the audit specification reference |
Explanation | The eventFactory field is required. |
Action | Verify that a valid reference has been specified for the audit event factory implementation |
Explanation | Failure while retrieving the audit specifications. |
Action | None |
Explanation | Reference must be to a Binary File audit service provider implementation. |
Action | Verify that a valid reference has been specified to a Binary File implementation |
Explanation | Audit Notification Monitor has already been configured. |
Action | None |
Explanation | Non valid name for audit notification monitor specified. |
Action | Verify that a valid name has been specified for the audit notification monitor |
Explanation | Non valid reference for audit notification specified. |
Action | Verify that a valid reference has been specified for the audit notification |
Explanation | Admin task does not support deletion of a subset of a multi-set defined filter. |
Action | None |
Explanation | No attributes were specified on the modify command. |
Action | Supply attribute(s) to modify on the audit object |
Explanation | No attributes were specified on the delete command. |
Action | Supply attribute(s) to delete the specified object |
Explanation | Audit service provider is in use by an audit event factory implementation and cannot be deleted. |
Action | None |
Explanation | Audit Notification Monitor is not configured. |
Action | None |
Explanation | Non valid reference for audit notification monitor specified. |
Action | Verify that a valid reference has been specified for the audit notification monitor |
Explanation | Non valid name for audit notification specified. |
Action | Verify that a valid name has been specified for the audit notification |
Explanation | Must enter an email list when send email is true. |
Action | Supply an email list |
Explanation | Must either specify "html" or "text". |
Action | Supply a valid email format |
Explanation | Audit notification already exists. |
Action | None |
Explanation | Audit notification is in use and cannot be deleted. |
Action | None |
Explanation | Valid values are WARN, NOWARN, and FATAL. |
Action | Specify a valid audit policy value |
Explanation | Cannot configure an audit event factory with the same unique name as one that is already configured. |
Action | Specify a unique name for the new audit event factory |
Explanation | Cannot configure an audit service provider implementation with the same unique name as one that is already configured. |
Action | Specify a unique name for the new audit service provider implementation |
Explanation | Custom properties must be specified as name-value pairs, separated by a comma, semicolon or space. |
Action | Enter a valid syntax for the custom properties |
Explanation | The referenced service provider is not the default IBM Binary service provider implementation. |
Action | Enter a valid reference to a IBM Binary service provider implementation |
Explanation | The referenced audit specification does not exist in the audit.xml. |
Action | None |
Explanation | The email list specified is not valid, null or empty. |
Action | Supply a valid email list |
Explanation | The maximum number of audit logs needs to a number greater than 0. |
Action | Supply a valid value for maximum number of audit logs |
Explanation | The maximum size of and audit log needs to a value greater than 0. |
Action | Supply a valid value for maximum number of audit logs |
Explanation | An exception occurred validating or creating the file path location for the audit logs. |
Action | None |
Explanation | No password was supplied for the audit encryption key store. |
Action | Supply a password for the audit encryption key store |
Explanation | Encryption key store password and the confirm password values do not match. |
Action | Confirm the audit encryption key store password |
Explanation | When creating a key store object with an existing key store file the file must exist and a valid password and key store type must be supplied. |
Action | Make sure the key store file exists with a valid password and key store type. Then rerun the command. |
Explanation | When creating a hardware key store object the file in the path specified should already exist. |
Action | Rerun the command with a specifying a file that already exists. |
Explanation | The specified object already exists. Unable to create another one. |
Action | Create the object with a unique name |
Explanation | The values for auto-generating a certificate and importing a certificate matched. Must specify true for one or the other. |
Action | Specify either auto-generating a certificate or importing a certificate. |
Explanation | No value was specified for the new certificate alias name. |
Action | Supply a value for the certificate alias name. |
Explanation | When selecting to import an existing certificate, a key file name for the certificate must be entered. |
Action | Supply a key file name for the certificate to import |
Explanation | When selecting to import an existing certificate, a key file path for the certificate must be entered. |
Action | Supply a key file path for the certificate to import |
Explanation | When selecting to import an existing certificate, a key file type for the certificate must be entered. |
Action | Supply a key file type for the certificate to import |
Explanation | When selecting to import an existing certificate, a key file password for the certificate must be entered. |
Action | Supply a key file password for the certificate to import |
Explanation | When selecting to import an existing certificate, a certificate aliase for the certificate must be entered. |
Action | Supply a certificate alias name for the certificate to import |
Explanation | Must specify a name for the audit key store |
Action | Supply a name for the audit key store |
Explanation | Must specify a key store location for the audit key store |
Action | Supply a key store location for the audit key store |
Explanation | Must specify a key store type for the audit key store |
Action | Supply a key store type for the audit key store |
Explanation | Must specify a key store password for the audit key store |
Action | Supply a key store password for the audit key store |
Explanation | Must specify a confirmation key store password to for the audit key store |
Action | Supply a confirmation key store password for the audit key store |
Explanation | Failed to create the audit keystore ObjectName |
Action | None |
Explanation | Failed to create the audit keystore |
Action | None |
Explanation | Failed to create the self signed certificate for audit encryption |
Action | None |
Explanation | Failed to import the self signed certificate for audit encryption |
Action | None |
Explanation | A certificate with the same alias name already exists in the keystore. Cannot add. |
Action | None |
Explanation | The alias is either not in the key store or it is not a personal certificate in the key store. |
Action | Rerun the command with a personal certificate that is located in the key store. |
Explanation | Cannot select reusing encryption certificate for signing with autogenerating or importing. Options are mutually exclusive. |
Action | Select only one option: to reuse the certificate used for encrypting audit records, autogenerating a certificate to use to sign the audit records, or import a certificate. |
Explanation | No encryption keystore found: unable to reuse the same certificate for signing audit records. |
Action | None |
Explanation | Cannot find a keystore with the supplied unique name or reference id. |
Action | None |
Explanation | No audit.xml was found for this profile. Auditing is not configured. |
Action | Ensure auditing is configured properly. |
Explanation | When encryption is not enabled, cannot configure the encryption keystore. |
Action | Enable encryption before setting the encryption keystore. |
Explanation | Must specify a valid reference id for the audit key store |
Action | Supply a reference id for the audit key store |
Explanation | Could not list the certificate aliases in the referenced keystore. |
Action | Verify that at least one certificate alias exists in the keystore. |
Explanation | Certificate alias does not exist in the referenced keystore. |
Action | Make sure to specify a certificate alias that does exist in the referenced keystore. |
Explanation | A unique name was not specified for the audit specification. |
Action | Specify a unique name for the audit specification. |
Explanation | Encryption for audit cannot be configured when the enable value is false. Either use true for enable or, if the intention is to disable/delete encryption, use the appropriate disable/delete tasks. |
Action | Specify true as the enable value if the intention is to configure encryption for audit. |
Explanation | Signing for audit cannot be configured when the enable value is false. Either use true for enable or, if the intention is to disable/delete signing, use the appropriate disable/delete tasks. |
Action | Specify true as the enable value if the intention is to configure signing for audit. |
Explanation | The classname specified does not match the default audit event factory implementation classname. |
Action | Ensure that when specifying class name on the modify command and the implementation is the default audit event factory implementation, that it matches the default classname. |
Explanation | The classname specified does not match the default audit service provider implementation classname. |
Action | Ensure that when specifying class name on the modify command and the implementation is the default audit service provider implementation, that it matches the default classname. |
Explanation | The referenced service provider is not a third party service provider implementation. |
Action | Enter a valid reference to a third party service provider implementation |
Explanation | Auditing is enabled and requires an auditorId and auditorPwd. |
Action | Disable auditing before deleting the auditorId |
Explanation | Auditing is enabled and requires an auditorId and auditorPwd. |
Action | Disable auditing before deleting the auditorPwd |
Explanation | Encryption is enabled or is being enabled. The encryption keystore is in use and cannot be deleted |
Action | Disable encryption before deleting the encryption keystore. |
Explanation | Audit notification is enabled or is being enabled. The notification reference may be in use and cannot be deleted. |
Action | Disable audit notification before deleteing the audit notification reference. |
Explanation | Audit encryption is enabled or is being enabled. The certificate alias is in use and cannot be deleted. |
Action | Disable audit encryption before deleteing the certificate alias. |
Explanation | Signing is enabled or is being enabled. The signing keystore is in use and cannot be deleted |
Action | Disable encryption before deleting the signing keystore. |
Explanation | Non valid value was specified for the scope name. An empty value is not valid. |
Action | Specify a valid value for the scope name |
Explanation | Encryption is enabled or is being enabled. The encryption certificate is in use and cannot be deleted |
Action | Disable encryption before deleting the encryption certificate. |
Explanation | The reference ID for the audit encryption certificate has not been specified correctly |
Action | Specify a valid value for the audit encryption certificate reference. |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | None |
Action | None |
Explanation | Could not open or read the Binary Audit Log. |
Action | Check the pathname specified for the location of the Binary Audit Log. |
Explanation | The expected fully qualified filename for the Binary Audit Log was specified incorrectly. |
Action | Check the pathname specified for the location of the Binary Audit Log. |
Explanation | A non valid value was specified for the report mode. |
Action | Specify a non-empty or valid value for the report mode. |
Explanation | A non valid value was specified for the sequence set of audit records to report |
Action | Specify a non-empty or valid value for the sequence set. |
Explanation | The expected fully qualified file location for the output html report was specified incorrectly. |
Action | Specify a non-empty valid name for the file location of the output html report. |
Explanation | A non valid value was specified for the sequence set of audit records to report |
Action | Make sure that the starting sequence number is less than the ending sequence number. |
Explanation | When specifying a report mode of custom, one or more data points must be specified. |
Action | Specify one or more data points when electing to generate a custom report. |
Explanation | Event type, sequence number, and outcome may not be specified under the -dataPoints parameter. All three of these pieces of data will always be reported. |
Action | Do not specify event type, sequence number and outcome as values for the -dataPoints parameter. |
Explanation | The Binary Audit Log specified has not been encrypted. |
Action | none |
Explanation | A non valid value was specified for the timestamp set of audit records to report |
Action | Specify a non-empty or valid value for the timestap set. |
Explanation | A non valid value was specified for the timestamps of audit records to report |
Action | Make sure that the starting timestamp is less than the ending timestamp. |
Explanation | A non valid value was specified for timestamp of audit records to report |
Action | Specify a non-empty or valid value for the timestamp. |
Explanation | A non valid value was specified for the sequence number associated with an audit records to report |
Action | Specify a non-empty or valid value for the sequence number. |
Explanation | The output file specified was not in HTML format. |
Action | Specify an HTML file as the output file location. |
Explanation | An exception was raised while attempting to obtain the host name of the machine on which the Audit Reader is running. |
Action | none |
Explanation | An instance of the keystore could not be obtained. |
Action | Verify that the encryption keystore does exist. |
Explanation | No such provider exists for this keystore. |
Action | Verify that the provider is valid and that the keystore does exist. |
Explanation | The keystore location url is malformed. |
Action | Verify that the keystore location is valid and that the keystore does exist. |
Explanation | The keystore could not be loaded due to a certificate exception. |
Action | none |
Explanation | The crypto algorithm associated with this keystore is not available. |
Action | Ensure the crypto algorithm is available. |
Explanation | Could not open or read the file. |
Action | Specify a valid filename. |
Explanation | Could not open the keystore. |
Action | Verify that the password was correctly specified and verify the keystore exists. |
Explanation | The user must be included in all the required roles needed to run the task. |
Action | Ensure the acting user has been given the proper role(s). |
Explanation | An invalid value was specified for the binary audit log wrapping behavior. Valid values are: WRAP, NOWRAP or SILENT_FAIL. |
Action | Specify a valid value for the binary audit log wrapping behavior. |
Explanation | Admin repository save changes will not be audited if checkpointing is not enabled. |
Action | Verify that checkpointing is enabled. |
Explanation | An invalid value was specified for the LDAP bind password or an invalid cryptographic algorithm was used. |
Action | If you are using a WebSphere Application Server assigned algorithm, ensure that your password does not contain a bracket character. The bracket character conflicts with the cryptographic algorithm WebSphere Application Server assigns. If you are using custom password encryption, verify you have assigned a valid algorithm. |
Explanation | An unexpected error was encountered while checking the federated repositories for unsupported hashing algorithms. |
Action | Examine the associated exception to determine the cause |
Explanation | The requested action cannot be completed because it prevents the identified nodes from authenticating users from the specified repositories and security domain. |
Action | Upgrade the specified node(s) to a WebSphere Application Server version that supports the configured hashing algorithm or configure the repositories to use a different hashing algorithm and try again. |
Explanation | Administrative Security is not being used, therefore this option is not being used |
Action | None |
Explanation | An exception occured while parsing a configuration document. |
Action | Check the error logs for more information into the failure. |
Explanation | Unable to fine the specified file or directory. |
Action | Ensure that the file or directory reported exists and is not corrupted before continuing. |
Explanation | The class could not be loaded. Check exception message for details |
Action | Check that the class name exists and the class has been added to the plugin.xml. Check the exception message for details |
Explanation | A security check threw an unexpected exception |
Action | Examine the associated exception to determine the cause |
Explanation | Multiple Administrative user IDs are configured. When WebSphere Application Server security is enabled, a single security ID under the Administrator role is initially configured as the Security Server ID. Configuring multiple administrative user ids as Administrator can protect this server ID and enable more effective audit logging |
Action | None |
Explanation | Multiple Administrative user IDs are not configured. When WebSphere Application Server security is enabled, a single security ID the Administrator role is initially configured as the Security Server ID. Configuring multiple administrative user ids as Administrator can protect this server ID and enable more effective audit logging |
Action | None |
Explanation | Multiple Administrative User Roles are configured. A number of administrative roles are defined to provide degrees of authority that are needed to perform certain administrative functions from either the Web-based administrative console or the system management scripting interface. The authorization policy is only enforced when administrative security is enabled. |
Action | None |
Explanation | Multiple Administrative User Roles are not configured. A number of administrative roles are defined to provide degrees of authority that are needed to perform certain administrative functions from either the Web-based administrative console or the system management scripting interface. The authorization policy is only enforced when administrative security is enabled. |
Action | None |
Explanation | This message is for informational purposes only. |
Action | None |
Explanation |
Administrative Security is disabled. Note that other important security features listed might be reported as enabled, but they will not take effect until administrative security is activated. The settings include the authentication of users, the use of Secure Sockets Layer (SSL), and the choice of user account repository. In particular, application security, including authentication and role-based authorization, is not enforced unless administrative security is active. |
Action | None |
Explanation | Application security is enabled. Application security enables security for the applications in your environment. This type of security provides application isolation and requirements for authenticating application users. |
Action | None |
Explanation | Application security is disabled. Application security enables security for the applications in your environment. This type of security provides application isolation and requirements for authenticating application users. |
Action | Enable application security if applicable. |
Explanation | CORBA Naming roles are configured |
Action | None |
Explanation | The CORBA Namespace can be modified by All Authenticated users. Any authenticated user can alter the JNDI namespace. The default naming security policy is to grant all users read access to the CosNaming space and to grant any authenticated user the privilege to modify the contents of the CosNaming space. You can restrict user access to the CosNaming space. |
Action | Restrict user access to the CosNaming space if applicable. |
Explanation | The CORBA Namespace can be modified by Everyone. Anyone can alter the JNDI namespace. The default naming security policy is to grant all users read access to the CosNaming space and to grant any authenticated user the privilege to modify the contents of the CosNaming space. You can restrict user access to the CosNaming space. |
Action | Restrict user access to the CosNaming space if applicable. |
Explanation | Encryption is enabled on Distributed Replication Service(DRS). This ensures that the data shared among WebSphere Application servers is encrypted. |
Action | None |
Explanation | Data Replication Service(DRS) is not being used to exchange data among WebSphere Application servers |
Action | None |
Explanation | Encryption is disabled on Distributed Replication Service(DRS). The data shared among WebSphere Application servers is not encrypted. |
Action | Enable Distributed Replication Service encryption if needed. |
Explanation | Java 2 security is enabled. Java 2 security provides a policy-based, fine-grain access control mechanism that increases overall system integrity by checking for permissions before allowing access to certain protected system resources. Java 2 security guards access to system resources such as file I/O, sockets, and properties. |
Action | None |
Explanation | Java 2 security is disabled. Java 2 security provides a policy-based, fine-grain access control mechanism that increases overall system integrity by checking for permissions before allowing access to certain protected system resources. Java 2 security guards access to system resources such as file I/O, sockets, and properties. |
Action | Enable Java 2 security if applicable. |
Explanation | User Registry is LDAP. SSL between WebSphere Application Server and LDAP is enabled. This ensures that the communication between WebSphere Application Server and LDAP is encrypted |
Action | None |
Explanation | User registry being used is not LDAP |
Action | None |
Explanation | User Registry is LDAP. SSL between WebSphere Application Server and LDAP server is disabled. The communication between WebSphere Application Server and LDAP is not encrypted |
Action | Enable SSL between the WebSphere Application Server and LDAP server if needed. |
Explanation | WebSphere Application Server Sample Applications are not installed. WebSphere Application Server ships with examples to demonstrate various parts of WebSphere Application Server. These samples might be installed by default and are not intended for use in a production environment. Some of these samples can provide an intruder with information about your system. |
Action | None |
Explanation | WebSphere Application Server Sample Applications are installed. WebSphere Application Server ships with examples to demonstrate various parts of WebSphere Application Server. These samples might be installed by default and are not intended for use in a production environment. Some of these samples can provide an intruder with information about your system. |
Action | Un-install sample application if not needed. |
Explanation | A special subject is configured for the Administrator role. It is not recommended to have Everyone and AllAuthenticatedUsers specified for the Administrator role. |
Action | refer to the infoCenter to determine if a more secure configuration is more suitable. |
Explanation | A special subject is configured for one of the administrative roles. It is not recommended to have Everyone specified for any of the administrative user roles. |
Action | Remove the Everyone subject from any of the administrative user roles if applicable. |
Explanation | A special subject is configured for one of the administrative roles. It is not recommended to have AllAuthenticatedUsers specified for any of the administrative user roles. |
Action | Remove the AllAuthenticatedUsers subject from any of the administrative user roles if applicable. |
Explanation | None |
Action | None |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | Check the file permissions for the file to ensure that they are readable. If the file is missing, create or restore it. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | The service name contains the slash character. The service name is the first component of the Kerberos service principal name. |
Explanation | Valid authentication mechanism types are: KRB5, LTPA |
Action | Ensure user authentication mechanism type is a valid type |
Explanation | Valid bind authentication mechanism types are: simple, GSSAPI. |
Action | Change the bind authentication mechanism to a valid type. |
Explanation | The parameter is required for configuring LDAP. |
Action | Add the parameter to configure LDAP. |
Explanation | Either the specified Kerberos principal is invalid, or the Kerberos credential cache (ccache) is invalid or expired. |
Action | Ensure a valid Kerberos principal is specified and the Kerberos credential cache (ccache) has not expired. |
Explanation | Either the specified Kerberos principal is invalid, or the Kerberos keytab is invalid. |
Action | Ensure a valid Kerberos principal is specified and a valid Kerberos keytab containing the Kerberos principal. |
Explanation | Either the specified Kerberos principal is invalid, or the default Kerberos credential cache (ccache) is invalid or expired. |
Action | Ensure a valid Kerberos principal is specified and the default Kerberos credential cache (ccache) has not expired. |
Explanation | Either the specified Kerberos principal is invalid, or the default Kerberos keytab is invalid. |
Action | Ensure a valid Kerberos principal is specified and the default Kerberos keytab is valid. |
Explanation | The node cannot be added because it cannot authenticate users from the specified repository and security domain. |
Action | Upgrade the node to a WebSphere Application Server version that supports the bind authentication mechanism, or configure the repository to use a supported authentication mechanism, and try again. |
Explanation | The specified action cannot be completed because it prevents the specified nodes from authenticating users from the targeted repository. |
Action | Upgrade the nodes to a WebSphere Application Server version that supports the bind authentication mechanism, or configure the repositories to use a supported authentication mechanism. |
Explanation | The security configuration does not exist. |
Action | Run the command with a pre-existing security configuration. |
Explanation | A scope can only be mapped in one security configuration at time. |
Action | Rerun the command using a scope that is not already mapped to a security configuration. |
Explanation | The user registry specified does not exist in the configuration. |
Action | Rerun the command using a user registry that exist in the configuration. |
Explanation | Valid login module types are: system, application. |
Action | Ensure that the login module type is a valid type. |
Explanation | Valid authentication strategy types are: REQUIRED, REQUISITE, SUFFICIENT, OTPIONAL. |
Action | Ensure that the authentication strategy type is a valid type. |
Explanation | Each login module provided must have a corresponding authentication strategy. |
Action | Ensure that there is an authenticatino startegy type for each login module. |
Explanation | The login module specified does not exist. |
Action | Ensure that the login module exists. |
Explanation | Valid authentication levels are: Never, Supported, Required. |
Action | Ensure that the authentication level is valid. |
Explanation | Valid authentication mechanisms are: KRB5, LTPA, Custom, BasicAuth. |
Action | Ensure that the authentication mechanisms is valid. |
Explanation | Valid ssl configuration not supplied. |
Action | Ensure that the ssl configuration is exists. |
Explanation | If user server identity is enabled a trusted identity and password should not be specified. |
Action | Specify either a trusted identity or enable user server identity. |
Explanation | When a server id is proviced then a password must be specified as well. |
Action | Ensure a server id and password are provided. |
Explanation | When automatic generation of the server id is enable then no server id and password should be provided. |
Action | Ensure no server id and password is provided when automatic generation of server id is enabled. |
Explanation | User name or password are unable to authenticate to the user registry. |
Action | Ensure a valid user name and password are specified. |
Explanation | The primary administrative id specified was not found the user registry. |
Action | Ensure a primary administrative id is provided. |
Explanation | At least one resource is still mapped to the security configuration. The security configuration cannot be removed until there are no scopes mapped to it. |
Action | Ensure that there no now scopes mapped to the security configuration before deleting it. |
Explanation | The resource name provided is not valid. |
Action | Ensure a valid resource name is provided. |
Explanation | The scope is not mapped to the security configuration. |
Action | Rerun the command using a scope that is mapped to the security configuration. |
Explanation | There is an attempt to enable global security when there is no active user registry defined. |
Action | Ensure an user registry is defined when enabling global security. |
Explanation | The authentication mechanism type is not valid it should be LTPA or KRB5. |
Action | Ensure the authentication mechanism type is valid. |
Explanation | Unable to find the authentication mechanism in the user registry. |
Action | Ensure a authentication mechanism is configured. |
Explanation | Unable to set the active user registry because the user registry provide is not configured. |
Action | Ensure the user registry is configured before setting it to the active user registry. |
Explanation | An error occurred trying to access the user registry. Unable to verify the registry is configured properly. |
Action | Ensure the user registry is configured correctly. |
Explanation | Unable to make this user registry the active user registry because it does not have realm name defined. |
Action | Ensure the user registry has a realm name. |
Explanation | A user registy cannot be unconfigured if it is the active user registry. |
Action | Change the active user registry in the global security setting then unconfigure the user registry. |
Explanation | The activeUserRegistry attribute must point to a user registry object when global security is enabled. |
Action | Ensure global security is not enables when changing unsetting the activeUserRegistry. |
Explanation | The LTPA authMechanism must contain a singleSignon attribute. |
Action | Ensure that the security.xml file contains an LTPA authMechanism with a singleSignon attribute. |
Explanation | An LTPA auth mechanism must be defined. |
Action | Ensure that an LTPA auth mechanism is defined. |
Explanation | An LTPA auth mechanism must contain a trust association. |
Action | Ensure that an LTPA auth mechanism contains a trust association. |
Explanation | The specified interceptor does not exist. |
Action | Either create the interceptor, or specify a different interceptor class name. |
Explanation | The specified auth data entry does not exist. |
Action | Either create the auth data entry, or specify a different auth data entry which does exist. |
Explanation | The specified realm does not exist. |
Action | Run the command with a realm that exists. |
Explanation | Valid certificate mode types are: EXACT_DN or CERTIFICATE_FILTER. |
Action | Ensure that the certificate mode type is a valid type. |
Explanation | The login object does not exist in the configuration. |
Action | Ensure that the login object exists. |
Explanation | The JAAS login entry does not exist in the configuration. |
Action | Ensure that the JAAS login entry exists. |
Explanation | The specified login module cannot be removed. Certian login module cannot be removed. |
Action | Run the command with a login module that can be removed. |
Explanation | The CSI object does not exist in the configuration. |
Action | Ensure that the CSI object exists. |
Explanation | The specified object already exists. Unable to create another one. |
Action | Create the object with a unique name. |
Explanation | A MalformedURLException was encountered parsing one of the specified URLs. |
Action | Verify the URL syntax is correct. |
Explanation | The specified filter rules are not valid. |
Action | Verify the filter rules conform to the syntax supported by the default HTTPHeaderFilter class. |
Explanation | Modify the dmgr security configuration to use the serverID/password with Kerberos authentication mechanism. |
Action | The Kerberos authentication cannot be configured with InternalServerId. |
Explanation | When a user specifies useServerIdentity is false then a trusted identity should be provided. |
Action | Run the command specifying a trusted id. |
Explanation | When configuring a custom user registry a class name must be provided. |
Action | Run the command providing custom registry class name. |
Explanation | When a key store object is provided a certificate alias must be provided. |
Action | Run the command providing a certificate alias. |
Explanation | If the nonce cache timeout is less than the token timeout, then the token could be used multiple times since the nonce value would have expired prior to the token becoming not valid. |
Action | Run the command specifying a nonce value greater than the token expiration. |
Explanation | A RSA key store must be used on a RSA authorization mechanism. |
Action | Run the command specifying a RSA key store. |
Explanation | A RSA trust store must be used on a RSA authorization mechanism. |
Action | Run the command specifying a RSA trust store. |
Explanation | When a certificate alias is specified a key store object must be specified. |
Action | Run the command providing a key store. |
Explanation | The certificate alias provided is not in the key store. |
Action | Run the command providing a certificate alias that is in the key store. |
Explanation | A security configuration does not have the required RSAToken authentication mechanism configured. |
Action | This may be a problem with a migrated configuration that needs correction. |
Explanation | The communication type specified is not valid. Either inbound or outbound needs to be specified. |
Action | Run the command specifying the correct communication type. |
Explanation | No realm name were provided to add the the trusted realm list. |
Action | Ensure a realm or realm list is provided when the command is run. |
Explanation | The realm name or resource name provided does not exist. |
Action | Ensure the realm name or resource name being used exists. |
Explanation | The trusted realm object does not exist. |
Action | Run the command on a security domain that has the trusted realm object defined. |
Explanation | The number of elements return by the task needs to be greater then 0. |
Action | Ensure the number is greater then 0. |
Explanation | There are no trusted realms for the realm, resource, or domain provided. |
Action | Run the command on realm, resourse, or domain that has trusted realms. |
Explanation | The users or groups are already assigned to this role. |
Action | Run the command by correcting the user, group or specialSubject list. |
Explanation | The users or groups are not assigned to this role and hence cannot be removed. |
Action | Run the command by correcting the user, group or specialSubject list. |
Explanation | The role name is not a valid role. |
Action | Use a valid role. |
Explanation | Only one parameter can be used at time either securityDomainName, resourceName, or securityRealmName. |
Action | Run the command and specify either securityDomainName, resourceName, or securityRealmName, |
Explanation | The registry object matching the domain, resource, or realm provide does not exist. |
Action | Run the command with a domain, resource, or realm that has a user registry associated with it. |
Explanation | When the certificateMapMode is set to CERTIFICATE_FILTER a filter must be provided. |
Action | Ensure a filter is provided when certificateMapMode is set to CERTIFICATE_FILTER. |
Explanation | The authorization configuration object does not exist in the configuration. |
Action | Ensure an authorization configuration object exists. |
Explanation | The value should be the minimum value specified. |
Action | Ensure the timeout value has the minimum value specified. |
Explanation | The specified authentication mechanism needs to be configured before it can be used. |
Action | Ensure that an authentication mechanism is configured. |
Explanation | The Kerberos service principal name format is malformed. |
Action | Verify the Kerberos service principal name (SPN) |
Explanation | The Kerberos realm name is not the same with default Kerberos realm in the Kerberos configuration file (krb5.ini/krb5.conf). |
Action | Verify the Kerberos realm name against the default Kerberos default realm in the Kerberos configuration file. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The entry is not found in the Kerberos configuration file. |
Action | Add the entry to the Kerberos configuration file. |
Explanation | The custom property string is not formatted correctly. The format needs to be a comma separated string of attribute=value pairs, each pair should be in quotes. |
Action | Ensure the custom property string is formatted correctly. |
Explanation | The login module proxy class name cannot be used when creating a new login module. |
Action | Ensure the login module proxy class is not used when creating a login module. |
Explanation | The server must be running a 7.0 or greater version to be mapped to a domain. |
Action | Ensure that servers are at the correct level. |
Explanation | The server must be running a 7.0 or greater version to be mapped to a domain. |
Action | Ensure that servers are at the correct level. |
Explanation | A test to check the users password on a particular realm was sucessful. |
Action | none. |
Explanation | A test to check the users password on a particular realm was failed. |
Action | none. |
Explanation | The Kerberos configuration file (krb5.ini/krb5.conf) for Kerberos authentication mechanism is not the same with the SPNEGO Web authentication. |
Action | Verify the krb5.ini/krb5.conf file for Kerberos authentication and SPNEGO Web authentication are the same one. |
Explanation | The Kerberos keytab for Kerberos authentication mechanism is not the same with the SPNEGO Web authentication. |
Action | Verify the Kerberos keytab file for Kerberos authentication and SPNEGO Web authentication are the same one. |
Explanation | Cannot enable SPNEGO Web authentication without defined any SPNEGO Web authentication filter. |
Action | Create at least one SPNEGO Web authentication filter before enabled the SPENGO Web Authentication. |
Explanation | Application cannot be installed accross multiple security domains. |
Action | Verify that user is not installing this application accorss multiple security domains. |
Explanation | The application is being installed across deployment targets that use different security domains. Depending on the security attributes defined in the security domains this can cause security problems. |
Action | Refer to the information center documentation for more information before you proceed with this installation to make sure that you would not run into any security related issues. |
Explanation | The security custom properties security.zOS.domainName and security.zOS.domainType are deprecated, but they are currently specified in the security configuration. For backwards compatibilty, the values of these old properties will override whatever is specified in the the new custom property com.ibm.security.SAF.profilePrefix. |
Action | The deprecated properties should be deleted from the security configuration, unless the configuration is part of a mixed-version cell that has a member at 6.1 or previous. |
Explanation | The entry is not found in the Kerberos configuration file and the Kerberos authentication object. |
Action | Add the entry in the Kerberos configuration file or specify this entry. |
Explanation | A server from previous releases cannot be added to a cluster when the cluster is associated with a security domain either directly or indirectly. |
Action | Mixed clusters are not supported with security domains. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | A server that contains server lever security configuration is being associated with a domain. The server level security configuration is deprecated. |
Action | The offending server or a cluster member should not contain the server level security configuration if it needs to be mapped to a domain. |
Explanation | A server should contain the server level security configuration to be converted to a security domain. |
Action | Make sure that the server name is correct and it has a server level security configuration associated with it. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | The global security configuration realm is always trusted and can not be removed form the list of trusted realms. |
Action | Ensure the realm being removed is not the global security realm. |
Explanation | The security domain default realm is always trusted and can not be removed form the list of trusted realms. |
Action | Ensure the realm being removed is not domain default realm. |
Explanation | The resource provided is not a single server resource. |
Action | Ensure the resource provided is a single server resource. |
Explanation | The SPNEGO Web authentication is enabled, it requires at least one SPNEGO filter. |
Action | Disable SPNEGO Web authentication before delete the last SPNEGO filter. |
Explanation | The SPNEGO Web authentication is enabled, it requires at least one SPNEGO filter. |
Action | Disable SPNEGO Web authentication before delete all SPNEGO filters. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. |
Action | No action is required. |
Explanation | This message is for informational purposes only. It will list some of the security properties that are configured at the security domain level. |
Action | No action is required. |
Explanation | This message is for informational purposes only. It indicates that the security HTTPS protocol is not used when accessing the resource. |
Action | If the resource is implemented to be accessed using the non-secure HTTP protocol, no action is required. If this resource should only be accessed using HTTPS change the deployment descriptor to add appropriate data-constraints. |
Explanation | LTPA validation checks to make sure that the current realm matches the realm in the token for validation to work. |
Action | For successful validation make sure that the realm in the token is configured in the trusted inbound realms list for the current realm. |
Explanation | If a federated node contains a domain associated with the cell scope, it will be changed to the server scope for that node during the addNode operation so that current cell configuration is not impacted. |
Action | If the cell scope needs to be configured in the domain-security-map.xml file, you need to associate the cell resource after the node has been federated. |
Explanation | This special domain is created to associate previous version servers, clusters and SIBuses to this domain. |
Action | If any of the old servers, clusters and SIBuses need to use the cell wide domain instead of the special domain, they need to be removed from this special domain. This might impact the security configuration of the resources deployed in these processes based on the cell wide domain security configuration. |
Explanation | The cell is in mixed version setup. The special security domain can not be removed. |
Action | This operation can not be performed in the current configuration. |
Explanation | Security configuration operation can not be run on the special security domain. |
Action | This operation can not be performed on the security domain. |
Explanation | The security domain name being used is reserved for a special case securty domain and can not be created with the command. |
Action | Endure another security domain name is used when running the command. |
Explanation | The AccessId of needs to be in the form of user: or group: followed by the realm name slash uniqueId. |
Action | Endure the AccessId is in the correct format. |
Explanation | A duplicate alias name in the format alias or nodeName/alias already exists. |
Action | Input a unique alias name |
Explanation | This command is not supported in local mode |
Action | This command is not supported in local mode |
Explanation | The Federated Repository registry configuration should be consistent across all the security domains and should match the values at the global security configuration (security.xml). |
Action | Make sure that the parameter values for this task match the values at the global security configuration for this registry. |
Explanation | Since the registry configuration should be consistent across all security configurations the values from the global security configuration are copied to the configuration. |
Action | No action is required. |
Explanation | Since the registry configuration should be consistent across all security configurations the values from the global security configuration are copied to the configuration. |
Action | No action is required. |
Explanation | Once a resource is removed from the system, its association with any domain will also be removed. |
Action | No action is required. |
Explanation | The host name is unknown. |
Action | Ensure that a valid host name is specified. |
Explanation | The security configuration does not have this object. |
Action | Run the command with a pre-existing security configuration. |
Explanation | To use the certificate, it must be connected to both the servant and control region key rings. |
Action | Ensure that the certificate is connected to both the servant and control region key rings. |
Explanation | To obtain the pathname of a security domain belonging to a non-AdminAgent process, a security domain name must be specified. |
Action | Ensure a security domain name has been specified if the process is not an AdminAgent. |
Explanation | When a cluster is mapped to a security domain all members of that cluster have to be running on a version 7.0 or higner. |
Action | Ensure the node of the cluster member is version 7.0 or higher. |
Explanation | When configuring multiple LDAP hosts there needs to be a port number provided for each hostname in the list of LDAP hosts. |
Action | Ensure there is a port for each LDAP host in the list of LDAP hosts. |
Explanation | The global security domain was originally configured to use a federated repository as the user registry and one or more application security domains were configured to use the global federated repository. The user registry at the global security domain cannot be changed when application security domains are using the global federated repository option. |
Action | Before changing the user registry configuration for the global security domain to not use a federated repository, the following needs to be done: The application security domains which are using the global federated repository will have to be configured to use a different user registry. |
Explanation | The global security domain must be configured with a federated repository as the active user registry in order for any application security domain to be configured with the global federated repository option. |
Action | Either the global security domain should be configured with a federated repository as the active user registry or the application security domain should elect not to use the global federated repository option. |
Explanation | Changing the federated repository configuration at the global security domain may affect any application security domain configured with the global federated repository option. |
Action | Ensure that changing the existing federated repository configuration at the global security domain does not affect an application security domain configured to use the global federated repository option. |
Explanation | The global federated repository option has been enabled in the application security domain. The global security domain must be configured with a federated repository as the active user registry in order to make the federated repository the active repository of the application security domain. |
Action | Either the global security domain should be configured with a federated repository as the active user registry or the application security domain should elect not to use the global federated repository option. This should be done before attempting to set the active user registry to use the federated repository in the application security domain. |
Explanation | The name of each authentication provider must be unique. |
Action | Specify a unique name for the authentication provider. |
Explanation | An authentication provider with the specified name does not exist in the security configuration. |
Action | Specify the name of an existing authentication provider. Use the displayJaspiProviderNames command to list the names of defined authentication providers. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The class name of an authentication provider or module must not be empty. |
Action | Specify a non-empty class name for the authentication provider or module. |
Explanation | The name of each authentication provider must be unique. |
Action | Specify a unique name for the authentication provider. |
Explanation | An authentication provider with the specified name does not exist in the security configuration. |
Action | Specify the name of an existing authentication provider. Use the displayJaspiProviderNames command to list the names of defined authentication providers. |
Explanation | A security domain with the specified name does not exist. |
Action | Specify the name of an existing security domain. |
Explanation | The authentication cache timeout value must be less than or equal to the LTPA token timeout value. |
Action | Specify a timeout value that is less than or equal to the LTPA token timeout value. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | JASPI authentication only functions on version 8 and higher nodes. |
Action | Only use JASPI authentication on version 8 and higher nodes. |
Explanation | The named property must specify path and name of file where JASPI persistent registrations are stored. |
Action | Specify the path and name of a file where JASPI persistent registrations are stored. |
Explanation | JASPI bindings cannot be registered because a JASPI factory implementation is not defined. |
Action | Verify the fully qualified class name of the default JASPI factory implementation class is defined using the property authconfigprovider.factory in java.security. |
Explanation | The web module"s JASPI binding cannot be registered in AuthConfigFactory because the provider name is null. |
Action | Verify the provider name in the application"s or web module"s bindings is defined in the security configuration. |
Explanation | An application to be deployed contains JASPI bindings in ibm-application-bnd or in ibm-web-bnd files. |
Action | JASPI authentication is supported on version 8 and higher nodes. Verify JASPI bindings are not defined in the application"s bindings. |
Explanation | The named JASPI provider will perform authentication of web requests for the named application and web module. |
Action | none. |
Explanation | The JASPI factory implementation is not defined. The default JASPI factory implementation has been set in the server runtime. However, JASPI may not function for a client. |
Action | Set the fully qualified class name of the default JASPI factory implementation class as the value for the property authconfigprovider.factory in java.security. |
Explanation | The JASPI factory implementation defined is not the default JASPI factory implementation provided by WebSphere Application Server. |
Action | none. |
Explanation | The given parameter value has been defined in the SAML TAI configuration. |
Action | Verify the SAML TAI properties and specify a value that is not already used. If you do not use this option, a value is automatically selected. |
Explanation | The given parameter value is not defined in the SAML TAI configuration. |
Action | Verify the SAML TAI properties and specify a value that exists. |
Explanation | The parameter value must be non-negative. |
Action | Specify a non-negative value for the given parameter. |
Explanation | An element can only be added in one security configuration. |
Action | Rerun the command using an element that is not already defined in a SAML TAI configuration. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | Specify the given parameter. |
Action | Specify a valid parameter value. |
Explanation | You must specify the ssoId because the SAML TAI attributes have more than one SSO entry. |
Action | Specify a ssoId number that exists. |
Explanation | The SSO entry has no SP information. |
Action | Configure a service provider for this SSO before adding an IdP partner. |
Explanation | The SAML TAI custom property key format is invalid. |
Action | Verify the SAML TAI custom property key format. |
Explanation | The certificate is used by other IdP or SP. |
Action | Verify the certificate is not used by any other IdP or SP. |
Explanation | The certificate already exists in the trust store. You cannot assign a new alias to this certificate. The existing alias name is used. |
Action | Use the same alias for the same certificate that is already in the trust store. |
Explanation | The SAML TAI version in the IdP partner metadata file is not supported. |
Action | Use SAML version 2.0 in the IdP partner metadata file. |
Explanation | The given parameter file name is not a fully qualified pathname or null. |
Action | Specify a fully qualified pathname for the file in the given parameter. |
Explanation | There are no SP custom properties found for the given SSO in the SAML TAI. |
Action | Configure the SP custom properties for the given SAML TAI SSO before you export it. |
Explanation | There is a security domain, but SAML TAI is configured at the global level. |
Action | Configure the SAML TAI at the domain level. |
Explanation | The value of idMap is invalid. |
Action | Specify a valid idMap value. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | If the problem persists, additional information might be available if you search for the message ID on the following Web sites: WebSphere Application Server Support page: https://ibm.biz/BdztgV WebSphere Application Server for z/OS Support page: https://ibm.biz/Bdqd4J . |
Explanation | The signing certificate is missing from the IdP metadata file. |
Action | Verify the IdP metadata file. |
Explanation | The entityID is missing from the IdP metadata file. |
Action | Verify the IdP metadata file. |
Explanation | The SingleSignOnService binding for HTTP POST is missing from the IdP metadata file. |
Action | Verify the IdP metadata file. |
Explanation | The deny-uncovered-http-methods element is specified in the web.xml file for the servlet, and there are HTTP methods for a URL pattern that are unprotected. These unprotected methods will not be accessible. |
Action | Ensure that all HTTP methods at all constrained URL patterns have the intended security protections. |
Explanation | The deny-uncovered-http-methods element is specified in the web.xml file for the servlet, but all HTTP methods for a URL pattern are protected. |
Action | No action needed as all HTTP methods are protected. |
Explanation | The deny-uncovered-http-methods element is not specified in the web.xml file for the servlet, and there are HTTP methods for a URL pattern that are unprotected. These unprotected methods will be accessible. |
Action | Ensure that all HTTP methods at all constrained URL patterns have the intended security protections. |
Explanation | The deny-uncovered-http-methods element is specified in the web.xml file for the servlet, and there are HTTP methods for a URL pattern that are unprotected. These unprotected methods will not be accessible. |
Action | Ensure that all HTTP methods at all constrained URL patterns have the intended security protections. |
Explanation | The deny-uncovered-http-methods element is not specified in the web.xml file for the servlet, and there are HTTP methods for a URL pattern that are unprotected. These unprotected methods will be accessible. |
Action | Ensure that all HTTP methods at all constrained URL patterns have the intended security protections. |
Explanation | Cannot process the method because the S4U2self constrained delegation is not enabled. |
Action | Ensure that the com.ibm.websphere.security.krb.s4U2selfEnabled custom property is set to true. |
Explanation | Cannot process the method because the S4U2proxy constrained delegation is not enabled. |
Action | Ensure that the com.ibm.websphere.security.krb.s4U2proxyEnabled security custom property is set to true. |
Explanation | The constrained delegation feature, either S4U2self or S4U2proxy, requires Java 8 or later. |
Action | Ensure that Java 8 or later is used. |
Explanation | Cannot impersonate the user due to the unexpected exception. |
Action | Ensure the delegate service principal name (SPN) is enabled for the delegate and review the server logs for more information. |
Explanation | Cannot impersonate the user due to the unexpected exception. |
Action | Ensure that the com.ibm.websphere.security.krb.s4U2proxyEnabled security custom property is set to true, the delegate service SPN is enabled for the delegate in the Key Distribution Center (KDC), the client service ticket has a forwardable flag set to true, and the delegate service tickets have a forwardable flag set to true. Review the server logs for more information. |
Explanation | No kerberos credential was found in the JAAS Subject private credential set. |
Action | None. |
Explanation | There are multiple Kerberos credentials in the credential set of the subject. Authentication will continue using the first credential in the set. |
Action | None. |
Explanation | A GSS exception occurred while making a copy of a GSSCredential. |
Action | None. |
Explanation | Access to a destroyed credential has been attempted. |
Action | None. |
Explanation | Access to an expired credential has been attempted. |
Action | None. |
Explanation | An error was encountered accessing the user registry. |
Action | Check user registry configuration. |
Explanation | No GSS delegated credentials found after validate the Kerberos request. |
Action | Make sure client have a forwardable Kerberos ticket (TGT) and server is trusted for delegation. |
Explanation | GSS user name is null. |
Action | None. |
Explanation | The specified principal map file was not found or is inaccessible. |
Action | Ensure that the file exists and is accessible. |
Explanation | An error was encountered while reading the principal map file. |
Action | Correct the error in principal map file. |
Explanation | A duplicate default catch-all rule was found in the principal map file. |
Action | Correct the error in principal map file. |
Explanation | An input/output exception was encountered while reading the principal map file. |
Action | Make sure the file exists and is readable. |
Explanation | The required default catch-all rule was not found in the principal map file. |
Action | Ensure that there is a default catch-all rule in the map file. |
Explanation | Errors were encountered processing map file. |
Action | Correct the error in principal map file. |
Explanation | Each map rule must contain a colon character. |
Action | Correct the rule in the map file. |
Explanation | Map rule must specify a principal and realm on the left-hand-side of the colon character. |
Action | Correct the rule in the map file. |
Explanation | Map rule must specify a principal on the right-hand-side of the colon character. |
Action | Correct the rule in the map file. |
Explanation | Left-hand-side of principal map rule must be one of: "principal@realm", "*@realm", or "*". |
Action | Correct the rule in the map file. |
Explanation | Map rule must specify a principal on the left-hand-side of the colon character. |
Action | Correct the rule in the map file. |
Explanation | Map rule must specify a realm on the left-hand-side of the colon character. |
Action | Correct the rule in the map file. |
Explanation | The system property "server.root" is not set. |
Action | None. |
Explanation | The Kerberos realm name specified in the callback handler does not match the Kerberos realm name or the default realm name, but the login will proceed anyway. |
Action | None. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | Examine the associated exception to determine the cause. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | Examine the associated exception to determine the cause. |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | Examine the associated exception to determine the cause |
Explanation | This exception is unexpected. The cause is not immediately known. |
Action | None. |
Explanation | A login failed for the user. |
Action | None. |
Explanation | Validation of the Kerberos token threw an unexpected exception |
Action | Examine the associated exception to determine the cause. |
Explanation | doPrivileged method threw an unexpected exception. |
Action | Examine the associated exception to determine the cause. |
Explanation | Remove principal from subject threw an unexpected exception. |
Action | Examine the associated exception to determine the cause. |
Explanation | Remove public credential from subject threw an unexpected exception. |
Action | Examine the associated exception to determine the cause. |
Explanation | Destroy credential from subject threw an unexpected exception. |
Action | Examine the associated exception to determine the cause. |
Explanation | Create credential threw an unexpected exception. |
Action | Examine the associated exception to determine the cause. |
Explanation | Security context is not established. |
Action | Examine SystemErr.log to determine the cause. |
Explanation | Credential is not fowardable. |
Action | None. |
Explanation | Credential is null |
Action | None. |
Explanation | The token is null. |
Action | Examine the associated exception to determine the cause. |
Explanation | The complete initSecContext method is not called. |
Action | Examine the associated exception to determine the cause. |
Explanation | The system property for KRB5_KTNAME (Kerberos keytab file) does not allow to re-set. |
Action | none. |
Explanation | When this method is invoked on the client side, it is not possible to determine the Kerberos Service Principal Name, and therefore a null value is returned. |
Action | Do not invoke this method on the client side. |