PM95128: CUSTOM REALM CHANGED TO PROTOCOL_IIOP_DAEMON_LISTENIPADDRESS INCORRECTLY 13/08/30 PTF PECHANGE

Fixes are available

APAR status

Closed as program error.

Error description

After upgrading to WAS7029 and if a Custom Realm is used, it is
noted that the realm value changes from the Custom Realm to the
protocol_iiop_daemon_listenIPAddress. It is also noted in
authorization errors:
com.ibm.websphere.security.auth.WSLoginFailedException: This
realm is
not the current realm, nor the admin realm, nor a trusted realm:
<protocol_iiop_daemon_listenIPAddress value>
com.ibm.websphere.security.auth.WSLoginFailedException: The user
is from a foreign realm, <protocol_iiop_daemon_listenIPAddress
value>, and this foreign realm
is not trusted. Current realm is <custom realm name>

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  All users of z/OS IBM WebSphere Application *
*                  Server V7.0, V8.0 and V8.5                  *
****************************************************************
* PROBLEM DESCRIPTION: realm mismatch causes                   *
*                      WSLoginFailedException after            *
*                      installing Fix Packs 7.0.0.29,          *
*                      8.0.0.6 and 8.5.0.2                     *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
Installing a fixpack containing PM76462 can cause a change in
the realm name used.

Prior to PM76462 when using the local OS the realm name was set
to the APPLDATA property set in profile SAFDFLT of the REALM
class. This occurred even if the REALM class was inactive.

Customer with an inactive REALM class may have configured
foreign realms to recognize this realm as being trusted. After
PM76462, with an inactive REALM class, the realm name is now
set to <protocol_iiop_daemon_listenIPAddress value> property.
This may cause the realm mismatch.

com.ibm.websphere.security.auth.WSLoginFailedException: This
realm is not the current realm, nor the admin realm, nor a
trusted realm: myhostname

Another symptom is if the customer has defined a custom realm,
PM76462 will result in the custom realm setting being ignored.

Problem conclusion

PM76462 changes will be removed, reverting back to behavior
pre-PM76462. Our infocenter documentation will be updated to
indicate that APPLDATA property will be used regardless of
whether REALM class is active or inactive.

The problem described in PM76462 will be addressed in the next
release of WebSphere Application Server, if there is a next
release.

APAR PM95128 requires changes to documentation.

NOTE: Periodically, we refresh the documentation on our Web
site, so the changes might have been made before you read this
text. To access the latest on-line documentation, go to the
product library page at:

http://www.ibm.com/software/webservers/appserv/library

The following update to the WebSphere Application Server
Version 7.0 Information Center will be made available in
January, 2014.

The sixth paragraph in the topic "System Authorization
Facility user registries" will be updated to read:

WebSphere for z/OS localOS User Registry (SAF User Registry)
implementation sets the registry realm name from the SAFDFLT
profile in the REALM class when the SAFDFLT profile is
defined, whether the REALM class is active or inactive. The
realm name is specified as the APPLDATA property of the
SAFDFLT profile. If the realm name cannot be obtained from the
OS security product (such as RACF), the value specified for
the protocol_iiop_daemon_listenIPAddress property is used as
the realm name. For example, the value
of protocol_iiop_daemon_listenIPAddress is used if the SAFDFLT
profile or APPLDATA property is not defined.

and the following Avoid Trouble will be added after the
preceding paragraph:

Avoid Trouble: Because of PE APAR, PM76462, in Version
7.0.0.29, WebSphere for z/OS localOS User Registry (SAF User
Registry) implementation described in the preceding paragraph
only occurs when the REALM class is active. This
implementation error was corrected in Version 7.0.0.31.

APAR PM95128 is currently targeted for inclusion in WebSphere
Application Server Fix Packs 7.0.0.31, 8.0.0.8, and 8.5.5.2 of
WebSphere Application Server.

Please refer to URL:
//www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
for Fix Pack availability.

Temporary fix

Comments

APAR Information

APAR number
PM95128
Reported component name
WEBSPHERE FOR Z
Reported component ID
5655I3500
Reported release
700
Status
CLOSED PER
PE
YesPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2013-08-14
Closed date
2013-11-18
Last modified date
2014-02-05

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBSPHERE FOR Z
Fixed component ID
5655I3500

Applicable component levels

R700 PSY UI13725
UP14/01/11 P F401 Ø

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
28 April 2022

Tips

PM95128: CUSTOM REALM CHANGED TO PROTOCOL_IIOP_DAEMON_LISTENIPADDRESS INCORRECTLY 13/08/30 PTF PECHANGE

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY UI13725

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

Document Information

Share your feedback

Need support?