Policy Database Corruption in IBM Security Access Manager for Web 7.0

Content

The details of the APAR are below:

ABSTRACT:
POLICY DATABASE CORRUPTION WHEN ATTACHING AN ACL TO A LARGE NUMBER OF OBJECTS.

ERROR DESCRIPTION:
An ACL or POP is created which will be attached to 8000 objects. The ACL is successfully attached to some number of the objects, then the database becomes corrupt. This may also happen when doing other operations which involve large associations such as adding many ipauth network values to a POP.

Symptoms include but are not limited to,

1) Policy Server crash.
2) Missing objects, ACLs, and POPs.
3) The pdacld_dump command reports severe errors.

There is no way to repair the corruption.

LOCAL FIX / WORKAROUND:
Based on the use case which causes the corruption, it may be possible to implement the policy another way. For example, in a case where one ACL is attached to 8000 objects it is possible to create 20 ACLs which all implement the same policy and attach each one to only 400 objects.

A fix for this APAR is expected to be included in fixpack 7.0.0-ISS-SAM-FP0003. This is subject to change, so the APAR should be monitored to confirm in which fixpack it is released.

Exact thresholds are not known at this time. If there is a need to create policy which matches the above scenario it should not be created until the fixpack has been applied.

Regardless of this APAR, backups of the policy database should always be made, verified, and maintained. Until the fixpack has been released and applied more frequent backups of the policy database should be conducted and made available for restoration if needed.

Please see details of the pdbackup command in the Command Reference located at,

http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=%2Fcom.ibm.isam.doc_70%2Fameb_cmdref_guide%2Freference%2Fref_pdbackup.html

Information on database maintenance can be found in the Validating and maintaining policy databases section of the Troubleshooting guide located at,

http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=%2Fcom.ibm.isam.doc_70%2Fameb_problemdet_guide%2Fconcept%2Fcon_vld_maint_plcy_db.html