IV22638: SUPPRESS ERRORS LOG ENTRIES FOR NULL VALUE

Tivoli Security Policy Manager Version 7.1, Fix Pack 4, 7.1.0-TIV-ITSPM-FP0004

APAR status

• Closed as program error.

Error description

• Problem Details
  
  .
  Product or Service: Tivoli Security Policy Manager Runtime
  Security
  Services 7.1.0
  Component ID: 5724S24SS
  .
  Operating System: Linux
  .
  Problem title
  Repeated Exceptions in Logs - Null value specified for Attribute
  parameter
  .
  Problem description
  We have been using RTSS combined with the securitysevices.xmi
  file as
  the PIP.
  
  In the logs we are getting so many exceptions with the same
  error
  message (Null value specified for Attribute) for different
  queries.
  These exceptions are harmless and do not impact how the
  application
  behaves. But these messages fill up our logs very quickly,
  mainly in
  production and when we do load testing. I have added our trace
  file for
  your review.
  
  I tried to tweak our database queries in the security
  services.xmi file
  (using the coalesce keyword) to avoid reading any null values
  from the
  database and replace them with the value of '0' . That did not
  help and
  issue happens anyway even after such changes. Please find the
  securityservices.xmi file as an attachment.
  
  "0/02/12 11:37:10:200 GMT] 000003fa Attribute E Attribute
  Attribute(
  String, String, Object ) CWRGS4183E Null value specified for
  Attribute
  parameter.
  [10/02/12 11:37:10:201 GMT] 000003fa JDBCComplexAt E
  JDBCComplexAttributeFinder getAttributes( RequestSection,
  String,
  String, String, String, RequestContext ) CWRGS4124E An error
  occurred
  while r
  etrieving AttributeId
  'db:product_version:restriction_severity_id' with
  Issuer 'Select max RESTRICTION_SEVERITY_ID from RESTRICTIONS,
  MEDIA_ASSET_ANNOTATION, PRODUCT_VERSION where product version
  UUID = uuid'.
  java.lang.IllegalArgumentException: CWRGS4183E Null value
  specified for
  Attribute parameter.
  at
  com.ibm.sec.authz.xacml.provider.Attribute.<init>(Attribute.java
  :54)
  at
  com.ibm.sec.authz.xacml.provider.finders.AbstractAttributeFinder
  .
  createAttribute(AbstractAttributeFinder.java:106)
  at
  com.ibm.sec.authz.xacml.provider.finders.JDBCComplexAttributeFin
  der.
  createAttribute(JDBCComplexAttributeFinder.java:933)
  at
  com.ibm.sec.authz.xacml.provider.finders.JDBCComplexAttributeFin
  der.
  getAttributes(JDBCComplexAttributeFinder.java:602)
  at
  com.ibm.sec.authz.xacml.provider.finders.JDBCComplexAttributeFin
  der.
  getResourceAttributes(JDBCComplexAttributeFinder.java:773)
  at com.ibm.sec.authz.xacml.provider.internal.
  RuntimeAttributeFinderManager.lookupAttributes
  (RuntimeAttributeFinderManager.java:162)
  at
  com.ibm.sec.authz.xacml.provider.internal.DefaultRequestContext.
  getResourceAttributes(DefaultRequestContext.java:223)
  at com.ibm.sec.authz.xacml.policy.internal.
  ResourceAttributeDesignatorImpl.evaluateExpression
  (ResourceAttributeDesignatorImpl.java:67)
  at com.ibm.sec.authz.xacml.policy.internal.functions.higherbag.
  AnyOfAnyFunction.performFunction(AnyOfAnyFunction.java:181)
  at
  com.ibm.sec.authz.xacml.policy.internal.ApplyImpl.evaluateExpres
  sion
  (ApplyImpl.java:191)
  at com.ibm.sec.authz.xacml.policy.internal.functions.logical.
  AndFunction.performFunction(AndFunction.java:75)
  at
  com.ibm.sec.authz.xacml.policy.internal.ApplyImpl.evaluateExpres
  sion
  (ApplyImpl.java:191)
  at com.ibm.sec.authz.xacml.policy.internal.ConditionImpl.
  evaluateCondition(ConditionImpl.java:113)
  at
  com.ibm.sec.authz.xacml.policy.internal.RuleImpl.evaluate(RuleIm
  pl.
  java:205)
  at
  com.ibm.sec.authz.xacml.provider.internal.normalize.NormalizedRu
  le.
  evaluate(NormalizedRule.java:132)
  at com.ibm.sec.authz.xacml.provider.internal.indexed.
  RuleStoreBackedEvaluationTargetList$EvalTargetRuleWrapper.evalua
  te
  (RuleStoreBackedEvaluationTargetList.java:267)
  at com.ibm.sec.authz.xacml.policy.internal.algorithms.
  PolicyCombiningFirstApplicable.evaluatePolicies
  (PolicyCombiningFirstApplicable.java:76)
  at com.ibm.sec.authz.xacml.provider.internal.indexed.
  IndexedXACMLProvider.evaluateRuleSubList(IndexedXACMLProvider.ja
  va:725)
  at com.ibm.sec.authz.xacml.provider.internal.indexed.
  IndexedXACMLProvider.evaluateRules(IndexedXACMLProvider.java:615
  )
  at com.ibm.sec.authz.xacml.provider.internal.indexed.
  IndexedXACMLProvider.doEvaluateRequest(IndexedXACMLProvider.java
  :358)
  at
  com.ibm.sec.authz.xacml.provider.internal.AbstractXACMLProviderI
  mpl.
  _evaluateRequest(AbstractXACMLProviderImpl.java:333)
  at
  com.ibm.sec.authz.xacml.provider.internal.AbstractXACMLProviderI
  mpl.
  evaluateRequest(AbstractXACMLProviderImpl.java:275)
  at com.ibm.tscc.rtss.authz.spif.AuthzRuntimeServiceImpl.evaluate
  (AuthzRuntimeServiceImpl.java:576)
  at
  com.ibm.tscc.pep.common.RTSSAuthzProvider.evaluate(RTSSAuthzProv
  ider.
  java:106)
  "
  

Local fix

Problem summary

• In IBM Common Authorization Component (aka. Argus) code NULL
  checking was required while searching for attributes.
  NULL checking in now added at appropriate places.
  

Problem conclusion

• This was a bug in IBM Common Authorization Component (aka.
  Argus) code and has been fixed.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  COMMON AUTH COM

• Fixed component ID

  TIVOCAC00

Applicable component levels

• R730 PSY

     UP