IBM Support

PI73345: DISTRIBUTED IDENTITY MAPPING NOT WORKING IN LIBERTY Z/OS

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • RACMAP facility used to map distributed to SAF userid,
    
    WebSphere does not correctly  use the distributed do SAF
    mapping and throws exception
    "com.ibm.ws.security.saf.SAFException: CWWKS2907E:
    SAF Service IRRSIA00_CREATE does not succeed because user
    null
    has insufficient authority to access  application.    SAF
    return code 0x00000008. RACF return code 0x00000008. RACF
    reason code 0x00000020 .
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  All users of IBM WebSphere Application      *
    *                  Server Liberty for z/OS - Security          *
    ****************************************************************
    * PROBLEM DESCRIPTION: When configuring the safRegistry        *
    *                      element in the server.xml file the      *
    *                      realm attribute may be ignored.         *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    When utilizing the safRegistry element in the server.xml file to
    configure SAF authentication or authorization a realm name is
    required. If the realm element is not present, defaults in SAF
    will be utilized. Here is an example of the safRegistry
    element:
    <safRegistry id="saf" realm="myrealm" />
    
    Here is the description of the realm attribute on the
    safRegistry element as found in our Knowledge Center:
    The realm associated with the SAF registry. If you do not
    specify a realm, the default is the plex name (ECVTSPLX). If the
    server is authorized to use the SAFCRED resources, then the
    default realm is read from the SAF product by extracting the
    APPLDATA field in the SAFDFLT profile under the REALM class. If
    that field is empty, then the default realm is used.
    
    If the realm attribute is specified, it should take precedence
    and we should not default to either the plex name or the
    APPLDATA. The problem is that if you actually specify the plex
    name on the realm attribute, we may incorrectly set/default the
    realm to the value found in the APPLDATA, instead of the value
    provided on the realm attribute.  Any value set in the realm
    attribute should always override any default value found in
    SAF.
    

Problem conclusion

  • Code has been changed to ensure the safRegisty realm attribute
    always takes precedence over default values found in SAF.
    
    The fix for this APAR is currently targeted for inclusion in fix
    pack 17.0.0.3.  Please refer to the Recommended Updates page for
    delivery information:
    http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PI73345

  • Reported component name

    LIBERTY PROF -

  • Reported component ID

    5655W6514

  • Reported release

    CD0

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-12-06

  • Closed date

    2017-06-06

  • Last modified date

    2017-06-06

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    LIBERTY PROF -

  • Fixed component ID

    5655W6514

Applicable component levels

  • RCD0 PSY

       UP

[{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SG19M"},"Platform":[{"code":"PF054","label":"z\/OS"}],"Version":"CD0"}]

Document Information

Modified date:
06 September 2021