PH01676: CREATEKRBCONFIGFILE COMMAND LEAVES PIPE CHARACTER IN KERBEROS CONFIG FILE FOR ENCRYPT TYPES

9.0.0.10: WebSphere Application Server traditional V9.0 Fix Pack 10
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
9.0.0.11: WebSphere Application Server traditional V9.0 Fix Pack 11
9.0.5.0: WebSphere Application Server traditional Version 9.0.5 Refresh Pack
9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• If multiple encryption types are specified in
  createKrbConfigFile, Kerberos config file ends up with invalid
  encryption type
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: createKrbConfigFile command leaves      *
  *                      pipe characters in                      *
  *                      krb5.ini/krb5.conf file if              *
  *                      multiple encryption types are           *
  *                      specified                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When createKrbConfigFile is called with multiple encryption
  types with pipe characters as a separator, the output kerberos
  configuration file still keep the pipe character where correct
  format is to separate encryption types with space.
  Example:
  When following command is issued:
  $AdminTask createKrbConfigFile {-krbPath
  "C:\test\krb5.conf" -realm AUSTIN.IBM.COM -kdcHost
  ram.austin.ibm.com -dns austin.ibm.com -encryption
  aes128-cts-hmac-sha1-96|aes256-cts-hmac-sha1-96 -keytabPath
  "c:\test\test.keytab"}
  Without this apar (pipe character "|" remains)
  [libdefaults]
  default_tkt_enctypes =
  aes128-cts-hmac-sha1-96|aes256-cts-hmac-sha1-96
  With this apar (encryption type is separated by space)
  [libdefaults]
  default_tkt_enctypes =
  aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha1-96
  

Problem conclusion

• The bug was fixed so encryption types are correctly set in the
  Kerberos configuration file
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.5.5.15 and 9.0.0.10.  Please refer to the
  Recommended
  Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

• After Kerberos Configuration file is created, manually remove
  pipe character
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP