PI45557: REMOTE EJB CALL TO CLUSTERED WEBSPHERE Z/OS SERVER FAILS DUE TO MISSING SECURITY CONTEXT

8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• In the customer case a remote EJB call is made from a WebSphere
  server on Solaris 10 to a clustered WebSphere server on z/OS.
  When the z/OS server runs with one servant address space, the
  call completes normally. In the case where there are multiple
  servants the call fails, with security context data being lost.
  
  This problem will be externalized by messages like:
  --
  Unauthenticated or missing subject/credentials.;
  java.lang.Exception: Unauthenticated or missing
  subject/credentials.
  
   at
  com.ibm.ws.security.role.RoleBasedAuthorizerImpl.getEffective
   Credentials(RoleBasedAuthorizerImpl.java:779)
  Tracing of the ORB, Communication and Security components on
  shows the security context is lost during processing of
  locate interceptors which are used to handle multiple security
  domains.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server for z/OS V8.0 and V8.5               *
  ****************************************************************
  * PROBLEM DESCRIPTION: Remote EJB call to clustered            *
  *                      Websphere z/OS server fails due to      *
  *                      missing security context                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  In the customer case a remote EJB call is made from a WebSphere
  server to a clustered WebSphere server on z/OS.
  When the z/OS server runs with one servant address space, the
  call completes normally. In the case where there are multiple
  servants, the call fails, with security context data being
  lost.
  This problem will be externalized by messages like:
  --
  Unauthenticated or missing subject/credentials.;
  java.lang.Exception: Unauthenticated or missing
  subject/credentials.
  at
  com.ibm.ws.security.role.RoleBasedAuthorizerImpl.getEffective
  Credentials(RoleBasedAuthorizerImpl.java:779)
  Tracing of the ORB, Communication and Security components
  shows the security context is lost during processing of
  locate interceptors which are used to handle multiple security
  domains.
  

Problem conclusion

• Code has been modified so that the security context will not
  be lost when processing locate interceptors.
  
  APAR PI45557 is currently targeted for inclusion in Fix Packs
  8.0.0.13 and 8.5.5.9 of WebSphere Application Server for z/OS.
  
  Please refer to the Recommended Updates page for delivery
  information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  
  In addition, please refer to URL:
  http://www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
  for Fix Pack PTF information.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE FOR Z

• Fixed component ID

  5655I3500

Applicable component levels

• R800 PSY

     UP