PH21097: USING DFHWS2LS TO PROCESS A WSDL AND XSD FILES RESULTS IN DFHPI9523E

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• DFHWS2LS is run and the WSDL input references other WSDL files
  that must be retrieved using HTTPS.  Despite importing the
  provider's certificates to RACF, a certificate chain error
  occurs when DFHWS2LS is run.
  
  DFHPI9523E An unexpected error occurred whilst processing file
  "Path name". The problem is: "WSDLException (at
  /wsdl:definitions/wsdl:types/xsd:schema/xs:schema):
  faultCode=OTHER_ERROR: An error occurred trying
  to resolve schema referenced at "URL name". Connection timed
  out.  (Connection timed out)".
  
  DFHPI9558E ERRORS have been generated processing file
  "Path name".
  
  To circumvent this problem either download the remote files and
  reference them locally or run DFHWS2LS with the property:
  
  -Djava.protocol.handler.pkgs=com.ibm.crypto.provider
  
  Keyword(s): KIXREVxxx keystore keyring truststore keystore
  

Local fix

• n/a
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: DFHPI9523E when DFHWS2LS is run and     *
  *                      a WSDL file references a remote XSD     *
  *                      file.                                   *
  ****************************************************************
  DFHWS2LS was run against WSDL input which referenced other
  remote XSD files which needed to be retrieved via HTTPS.
  Despite importing the vendor's root and intermediate
  certificates into RACF and adding them to a KEYRING, when
  DFHWS2LS was run it would fail with DFHPI9523E and DFHPI9558E.
  
  The problem occurred because DFHWS2LS does not set the correct
  Java properties to use a RACF (SAF) keyring.
  
  KEYWORDS:WS2LS MSGDFHPI9523E MSGDFHPI9558E PI9523E PI9558E
  

Problem conclusion

• DFHWS2LS has been updated to set the required Java properties
  in order to use a RACF (SAF) keyring.
  
    The CICS TS for z/OS 5.5 Web Services Guide will be updated to
  clarify the use of SSL-KEYSTORE and SSL-TRUSTSTORE for DFHWS2LS.
    In Chapter 6 "Creating the web services infrastructure", the
  entries for SSL-KEYSTORE, SSL-KEYPWD, SSL-TRUSTSTORE and
  SSL-TRUSTPWD will be removed from the WSRR branch of the "Input
  parameters for DFHWS2LS" railroad diagram,and added to the main
  line.
  
    The description for these values will be changed to read:
  
  SSL-KEYSTORE=value
  This optional parameter specifies the fully qualified location
  of the key store file.
  Use this parameter if you want the web services assistant to use
  secure sockets layer (SSL) encryption to communicate across a
  network.
  An example of the use of this input parameter for DFHWS2LS is:
  
  SSL-KEYSTORE=SAFKEYRING://USERID/Ring.name
  
  
  SSL-KEYPWD=value
  This optional parameter specifies the password for the java key
  store. There is no need to use this when using a SAF Keyring.
  
  Use this parameter if you want the web services assistant to use
  secure sockets layer (SSL) encryption to communicate across a
  network.
  
  
  SSL-TRUSTSTORE=value
  This optional parameter specifies the fully qualified location
  of the trust store file.
  Use this parameter if you want the web services assistant to use
  secure sockets layer (SSL) encryption to communicate across a
  network.
  An example of the use of this input parameter for DFHWS2LS is:
  
  SSL-TRUSTSTORE=SAFKEYRING://USERID/Ring.name
  
  
  SSL-TRUSTPWD=value
  This optional parameter specifies the password for the java
  trust store. There is no need to use this when using a SAF
  Keyring.
  
  Use this parameter if you want the web services assistant to use
  secure sockets layer (SSL) encryption to communicate across a
  network.
  
  The same changes will be made to the equivalent sections of
  Chapter 7 "Creating a SOAP web service", in the same places.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI69251

Modules/Macros

• DFJ@H176
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R200 PSY UI69251

     UP20/04/30 P F004

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.