PI50825: Access is denied with a WebSphereRuntimePermission for getSSLCon fig in CSIv2 during a naming lookup.

8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• For a Liberty profile server, a
  java.security.AccessControlException is issued in FFDC as
  follows for a naming lookup,
  
  Exception = java.security.AccessControlException
  Source =
  com.ibm.ws.transport.iiop.internal.NamingServiceAdapterActiv
  ator
  probeid = 63
  Stack Dump = java.security.AccessControlException: Access
  denied
  ("com.ibm.websphere.security.WebSphereRuntimePermission"
  "getSSLConfig")
  at
  java.security.AccessController.throwACE(AccessController.jav
  a:121)
  at
  java.security.AccessController.checkPermission(AccessControl
  ler.java:194)
  at
  java.lang.SecurityManager.checkPermission(SecurityManager.ja
  va:563)
  at
  com.ibm.websphere.ssl.JSSEHelper.getProperties(JSSEHelper.ja
  va:402)
  at
  com.ibm.ws.security.csiv2.config.ssl.SSLConfig.getAssociatio
  nOptions(SSLConfig.java:109)
  at
  com.ibm.ws.security.csiv2.server.config.tss.ServerConfigHelp
  er.extractSSLTransport(ServerConfigHelper.java:211)
  ...
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty Profile - Security           *
  ****************************************************************
  * PROBLEM DESCRIPTION: Access is denied with a                 *
  *                      WebSphereRuntimePermission for          *
  *                      getSSLConfig in CSIv2 during a naming   *
  *                      lookup.                                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  For a Liberty profile server, a
  java.security.AccessControlException is issued in FFDC as
  follows for a naming lookup,
  
  Exception = java.security.AccessControlException
  Source =
  com.ibm.ws.transport.iiop.internal.NamingServiceAdapterActivator
  probeid = 63
  Stack Dump = java.security.AccessControlException: Access denied
  ("com.ibm.websphere.security.WebSphereRuntimePermission"
  "getSSLConfig")
  	at
  java.security.AccessController.throwACE(AccessController.java:12
  1)
  	at
  java.security.AccessController.checkPermission(AccessController.
  java:194)
  	at
  java.lang.SecurityManager.checkPermission(SecurityManager.java:5
  63)
  	at
  com.ibm.websphere.ssl.JSSEHelper.getProperties(JSSEHelper.java:4
  02)
  	at
  com.ibm.ws.security.csiv2.config.ssl.SSLConfig.getAssociationOpt
  ions(SSLConfig.java:109)
  	at
  com.ibm.ws.security.csiv2.server.config.tss.ServerConfigHelper.e
  xtractSSLTransport(ServerConfigHelper.java:211)
  ...
  

Problem conclusion

• The CSIv2 code was modified to prevent a
  java.security.AccessControlException from happening during a
  naming lookup.
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 8.5.5.8.  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS LIBERTY COR

• Fixed component ID

  5725L2900

Applicable component levels

• R855 PSY

     UP