PI20582: APPLICATION ATTEMPT TO DO AUTHORIZATION WITH SAF FAILS W/ERROR CODE OF 03008XXX (IF SYNCTOOSTHREAD IS ENABLED)

8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• When SyncToOSThread is enabled, an application attempt to do
  authorization with SAF may fail with an internal error code of
  03008xxx.  The error code indicates the attempt was rejected by
  the WLP z/OS System Security Access Domain, which controls which
  SAF resources the WLP server is permitted to query.   Even
  though the server's ID is permitted to query the relevant SAF
  resources, the attempt fails when SyncToOSThread is enabled
  because the access domain incorrectly checks the sync'ed ID, not
  the server's ID.
       Internal error codes 03008208 or 03008408 are most likely
  and they will be in message very similar to this:  CWWKS2909E: A
  SAF authentication or authorization attempt was rejected because
  the server is not authorized to access the following SAF
  resource: CLASS SERVAUTH. Internal error code 0x03008408
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty Profile for z/OS             *
  ****************************************************************
  * PROBLEM DESCRIPTION: APPLICATION ATTEMPTING AUTHORIZATION    *
  *                      WITH SAF FAILS WITH REASON CODE         *
  *                      03008408, IF SYNCTOOSTHREAD IS          *
  *                      ENABLED.                                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When SyncToOSThread is enabled, an application attempting to do
  authorization with SAF may fail with an internal error code of
  03008xxx.
  The error code indicates the attempt was rejected by
  the WebSphere Application Server Liberty Profile for z/OS
  System Security Access Domain, which controls which
  SAF resources the WLP server is permitted to query.
  Even though the server's ID is permitted to query the relevant
  SAF
  resources, the attempt fails when SyncToOSThread is enabled
  because the access domain incorrectly checks the sync'd ID, not
  the server's ID.
  
  Internal error codes 03008208 or 03008408 are most likely
  and they will be in messages very similar to this:
  CWWKS2909E: A SAF authentication or authorization attempt was
  rejected because the server is not authorized to access the
  following SAF resource: CLASS SERVAUTH. Internal error code
  0x03008408
  

Problem conclusion

• The code has been updated to use the correct ID.
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 8.5.5.5.  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE FOR Z

• Fixed component ID

  5655I3500

Applicable component levels

• R800 PSY

     UP