PK64803: The administrative console users are not shown as active when logged on and with security enabled.

Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR10 Cumulative Fix for WebSphere Application Server
6.1.0.31: Java SDK 1.5 SR11 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.29: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• When they log into their Integrated Solutions Console, and click
  Security --> Secure administration, applications, and
  infrastructure --> Administrative User Roles,   they see their
  user ID listed as 'Inactive'
  However, when they disable security and do the same steps, they
  see the profile go to Active after they sign on.
  

Local fix

• On i5/OS the OS400Registry JAVA part seems to be upper casing  t
  he user name no matter if the user name is entered in          l
  ower case at the console.
  
    As a result of the above, the user's folder in the wstemp    f
  older is created based on a String hash obtained from the upperc
  asing                                                          o
  f the  user name.  Every thing is fine at this point.
  
   At the time the list of users is displayed, the               "
  ManageUsersController.java" ISC code (admin console struts     s
  pecific controller) uses                                       t
  he user name as entered when the user was created in the was   r
  epository.  ie, at the time of add user from ISC.
  
   In the customer or Dan's case, the user name was entered in   l
  ower case: "drheubler".
  
   The controller uses a hash of the lower case of the user name t
  o locate the wstemp work space folder and it does not find it. T
  he code is not smart enough to issue an exception or a message t
  hat user "user" was not found!!! It just says the user         i
  s not active. Probably it is a security precaution to give no  i
  nformation about a user existence (security is good when       n
  othing is known).
  
    As you might have guessed, a quick work around is to delete  u
  ser "user" in the admin console and recreate it using          "
  USER" or upper case it.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of WebSphere Application Server   *
  ****************************************************************
  * PROBLEM DESCRIPTION: LoginAction &                           *
  *                      ManageUsersController need to do        *
  *                      a check for i5/OS platforms when        *
  *                      looking up users in the .user file.     *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  On the i5/OS platform with the local OS registry scheme, after
  a user is logged on, a .user file is created based on a hash
  of the user ID in upper case.
  
  At the user roles panel, the same conversion is not performed
  when looking up the .user file.  As a result, users whose user
  IDs are in lower case gets the "Inactive" status.
  

Problem conclusion

• Code change has been made to resolve this problem.  The logged
  on user will see the correct status in the user roles panel of
  the administrative console.
  
  The fix for this APAR is currently targeted for inclusion in
  fixpack 6.1.0.19.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R61I PSY

     UP

• R61Z PSY

     UP