PI46559: THE SETUPADM SCRIPT ON LINUX FAILS TO USE AN EXISTING GROUP WITHOUT THE -CREATE PARAMETER

8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• PCT tool GUI in 8.0.0.x runs setupadm with -create option for
  user and group directives in admin.conf.  If the user or group
  already exits then setupadm returns and logs a fail RC(58)
  which results in PCT reporting unsucessful run of PCT but in
  reality there is no problem because the user and group already
  existed.
  Setupadm just does a very primitive check against the contents
  of /etc/group only (vs. e.g. 'getent group') so it would not
  honor groups via NIS, LDAP, winbind, etc.
  In customer case the group was define via daemon called 'sssd'
  to maintain groups elsewhere.
  Note that 8.5.5.x PCT GUI provides a checkbox to enable/disable
  use of the -create option.
  

Local fix

• None - ignore the completion result understanding that the run
  of PCT was successful.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of IBM HTTP Server (IHS) on Linux     *
  *                  with                                        *
  *                  failures configuring the IHS Administration *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: On Linux, configuration of the IHS      *
  *                      Administration fails when an existing   *
  *                      group  defined outside of /etc/group is *
  *                      used.                                   *
  ****************************************************************
  * RECOMMENDATION:  Apply this fix if configuration of the IHS  *
  *                  Administration server fails with errors     *
  *                  about                                       *
  *                  an existing group on Linux.                 *
  ****************************************************************
  The Plugin Configuation Tool (PCT) calls a script, $IHSROOT?
  bin/setpadm, to setup the product files to be administered by
  the
  IHS Admin Server.  Part of this configuration can be to identify
  an existing OS group.  When the specified existing group is
  stored
  outside of /etc/groups, via /etc/nsswitch.conf configuration to
  specify something like "winbind" or "sssd", setupadm will
  mistakenly think the existing group does not exist and will
  return
  an error.
  

Problem conclusion

• bin/setupadm was updated to use the 'getent' utility instead of
  looking directly in /etc/group.  'getent' will use whatever back
  is specified in /etc/nsswitch.conf
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  IBM HTTP SERVER

• Fixed component ID

  5724J0801

Applicable component levels

• R700 PSY

     UP

• R800 PSY

     UP

• R850 PSY

     UP