IV60232: JAAS LOGIN SHOULD TRY TO RETRIEVE SERVER CREDENTIAL FROM KEYTAB WHEN SERVICE NAME IS NULL

APAR status

• Closed as program error.

Error description

• Error Message: If JAAS login finds that the service name is null
  when it tries to do authentication for the server, it will throw
  an exception which will stop the authentication process and this
  in turn will produce a null server credential object and break
  the whole communication chain.
  .
  Stack Trace: org.ietf.jgss.GSSException, major code: 13, minor
  code: 0major string: Invalid credentialsminor string: Cannot get
  credential from JAAS Subject for principal: default serviceat
  com.ibm.security.jgss.i18n.I18NException.throwGSSException(I18NE
  xception.java:7)at
  com.ibm.security.jgss.mech.krb5.y.b(y.java:68)at
  com.ibm.security.jgss.mech.krb5.y.a(y.java:220)at
  com.ibm.security.jgss.mech.krb5.y.a(y.java:278)at
  com.ibm.security.jgss.mech.krb5.y.<init>(y.java:241)at
  com.ibm.security.jgss.mech.krb5.Krb5MechFactory.getCredentialEle
  ment(Krb5MechFactory.java:19)at
  com.ibm.security.jgss.GSSManagerImpl.createMechCredential(GSSMan
  agerImpl.java:75)at
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.a(SPNEGOContext.
  java:463)at
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.a(SPNEGOContext.
  java:42)at
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.a(SPNEGOContext.
  java:105)at
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.a(SPNEGOContext.
  java:592)at
  com.ibm.security.jgss.mech.spnego.SPNEGOContext.acceptSecContext
  (SPNEGOContext.java:607)at
  com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContext
  Impl.java:232)at
  com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContext
  Impl.java:419)at
  net.sourceforge.spnego.SpnegoAuthenticator.doSpnegoAuth(SpnegoAu
  thenticator.java:444)at
  net.sourceforge.spnego.SpnegoAuthenticator.authenticate(SpnegoAu
  thenticator.java:283)at
  com.lawson.security.authen.LawsonKerberosLoginProcedure.spnegoAu
  thenticate(LawsonKerberosLoginProcedure.java:299)at
  com.lawson.security.authen.LawsonKerberosLoginProcedure.authenti
  cate(LawsonKerberosLoginProcedure.java:141)at
  com.lawson.security.authen.LawsonLoginSchemeImpl.authenticate(La
  wsonLoginSchemeImpl.java:864)at
  com.lawson.security.authen.SSOServiceInteractor.processLoginActi
  on(SSOServiceInteractor.java:1526)at
  com.lawson.security.authen.PrimarySSOServiceInteractor._processR
  equest(PrimarySSOServiceInteractor.java:237)at
  com.lawson.security.authen.SSOServiceInteractor.processRequest(S
  SOServiceInteractor.java:158)at
  com.lawson.security.authen.SSOServlet.process(SSOServlet.java:44
  7)at
  com.lawson.security.authen.SSOServlet.doGet(SSOServlet.java:220)
  at
  javax.servlet.http.HttpServlet.service(HttpServlet.java:575)at
  javax.servlet.http.HttpServlet.service(HttpServlet.java:668)at
  com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWr
  apper.java:1230)at
  com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(Ser
  vletWrapper.java:779)at
  com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(Ser
  vletWrapper.java:478)at
  com.ibm.ws.webcontainer.servlet.ServletWrapperImpl.handleRequest
  (ServletWrapperImpl.java:178)at
  com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters
  (WebAppFilterManager.java:1071)at
  com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleReques
  t(CacheServletWrapper.java:87)at
  com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.
  java:909)at
  com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContai
  ner.java:1662)at
  com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLin
  k.java:200)at
  com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscr
  imination(HttpInboundLink.java:459)at
  com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRe
  quest(HttpInboundLink.java:526)at
  com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequ
  est(HttpInboundLink.java:312)at
  com.ibm.ws.http.channel.inbound.impl.HttpICLReadCallback.complet
  e(HttpICLReadCallback.java:88)at
  com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadComplet
  edCallback.complete(SSLReadServiceContext.java:1784)at
  com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureComp
  leted(AioReadCompletionListener.java:175)at
  com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyn
  cFuture.java:217)at
  com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncC
  hannelFuture.java:161)at
  com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)at
  com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)a
  t
  com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHand
  ler.java:775)at
  com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)at
  com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1862)
  .
  

Local fix

Problem summary

• JAAS login doesn't try to get server credential from keytab if
  service name is null
  

Problem conclusion

• This APAR will be fixed in the following Java Releases:
     7    SR7 FP1   (7.0.7.1)
     7 R1 SR1 FP1   (7.1.1.1)
  .
  A fix is made to JGSS provider to handle null service name
  properly while doing JAAS loginThe associated Hursley RTC
  Problem Report is 64986The associated Austin  CMVC defect is
  115461JVMs affected : Java 7.0, Java 727 and Java 8.0The fix was
  delivered for Java 7.0 SR7 FP1, Java 7.1 SR1 FP1 and Java 8. The
  affected jar is "ibmjgssprovider.jar". The build level of this j
  ar for the affected releases is "20140430"
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R260 PSY

     UP