PH64559: A javax.crypto.BadPaddingException is reported with securityUtility encoded passwords containing special characters.

APAR status

• Closed as unreproducible in next release.

Error description

• The following error is reported when the Liberty provided
  securityUtility is used the encode passwords which contain
  special characters:
  CWWKE0701E: bundle com.ibm.zosconnect:2.0.9.20230612-0757 (161)
     com.ibm.zosconnect.internal.security.AuthDataImpl(642)
     The activate method has thrown an exception
      IBMJCEHybridException: Failover exhausted, all registered
      providers attempted and failed.
      Exception#0 javax.crypto.BadPaddingException: Given final
       block not properly padded
  Stack Trace:
          at com.ibm.crypto.hdwrCCA.provider.AESCipher.
                                 engineDoFinal(AESCipher.java:924)
  Exception#1 javax.crypto.BadPaddingException: Given final block
                                              not properly padded
  Stack Trace:
          at com.ibm.crypto.provider.AbstractBufferingCipher.
           a(Unknown Source)
  Exception#2 javax.crypto.BadPaddingException: Given final block
                                             not properly padded
  Stack Trace:
          at com.ibm.crypto.plus.provider.AESCipher.engineDoFinal
                                              (AESCipher.java:275)
  
  Additional search words: BadPaddingException
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All users of z/OS Connect V3.0.              *
  ****************************************************************
  * PROBLEM DESCRIPTION: A javax.crypto.BadPaddingException is   *
  *                      reported with securityUtility encoded   *
  *                      passwords containing special            *
  *                      characters.                             *
  ****************************************************************
  The value for file.encoding in the zosconnect start script
  was set to to UTF-8, which does not match the value of
  ISO8859-1 which Liberty use in their server script. The
  zosconnect script should use the same file.encoding as Liberty
  does.
  

Problem conclusion

Temporary fix

Comments

• z/OS Connect has been changed so that the zosconnect start
  script specifies the Java file.encoding ISO8859-1, preventing
  the reported error with securityUtility encoded passwords.
  
  The fix for this APAR is expected to be delivered by the PTF for
  z/OS Connect V3.0.92.0 (PH65640).
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  Z/OS CONNECT EE

• Fixed component ID

  5655CE300

Applicable component levels