IC92438: LOGIN TO STANDALONE GUI WITH A DOMAIN USER THAT BELONGS TO A LOCAL GROUP FAILS

APAR status

• Closed as Permanent restriction.

Error description

• On member machine if you try to login to standalone GUI with a
  domain account that belongs to a
  local group that is mapped to Productivity Center Administrator
  role or any other role, login fails
  with message "Login failed for domain\domainUser. The User ID
  entered is not a member of an
  operating system group that is mapped to an IBM Tivoli Storage
  Productivity Center role."
  
  As a workaround add the domain user to a domain group and map
  the domain group to the Productivity
  Center Administrator role.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Users who want to login to standalone GUI with domain        *
  * accounts that belong to a local group.                       *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * On a domain member machine, login to standalone GUI with a   *
  * domain account which belongs to a local group that is mapped *
  * to Productivity Center Administrator role or any other role, *
  * fails with message "Login failed for domain\domainUser. The  *
  * User ID entered is not a member of an operating system group *
  * that is mapped to an IBM Tivoli Storage Productivity Center  *
  * role."                                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Add the domain user to a domain group and map the domain     *
  * group to the Productivity Center Administrator role or any   *
  * other role.                                                  *
  ****************************************************************
  

Problem conclusion

• The TPC 5.1.x Limitations and Known Issues documents have been
  updated with the following text about this restriction.
  
  Unable to log on to the stand-alone GUI by using a Windows
  domain user name ( APAR IC92438)
  
  If a Windows domain user name belongs to a local group that is
  mapped to a Tivoli Storage Productivity Center role, you cannot
  use this user name to log in to Tivoli Storage Productivity
  Center. To log in to Tivoli Storage Productivity Center, the
  domain user name must belong to a domain group that is mapped to
  a Tivoli Storage Productivity Center role.
  
  TPC 5.1.1 Limitations and Known Issues
  https://www-304.ibm.com/support/docview.wss?uid=swg21609438
  
  TPC 5.1.0 Limitations and Known Issues
  http://www-01.ibm.com/support/docview.wss?uid=swg21576205
  

Temporary fix

• Add the domain user to a domain group and map the domain group
  to the Productivity Center Administrator role or any other role.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• GUI
  

Fix information

Applicable component levels