PI21421: APPLICATION DEPLOYMENT FAILS ON Z/OS WITH SECJ0305I

8.5.5.4: WebSphere Application Server V8.5.5 Fix Pack 4
8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16

APAR status

• Closed as program error.

Error description

• Deployment of application fails on WAS z/OS V8.5 if user has EJB
  role DEPLOYER only and deployment is done via wsadmin script
  connecting from WINDOWS platform to WAS z/OS.
  .
  Deployment fails with following error:
  ---
  SECJ0305I: The role-based authorization check failed for
  admin-authz operation ConfigRepositoryProxy:update:
  ?Lcom.ibm.websphere.management.repository.DocumentContentSource;
  Lcom.ibm.websphere.management.repository.DocumentContentSource;
  
  Lcom.ibm.websphere.management.repository.Document;:
  com.ibm.ws.management.repository.RepositoryLockToken.
  The user ABCD (unique ID: user:abc.x.y.z/abcd) was
  not granted any of the following required roles:
  administrator, operator.
  ---
  It is correct that user abcd does NOT have EJB roles
  administrator or operator. But customer does not want to give
  his developers more rights than EJB role DEPLOYER .
  .
  Note:
  If deployment is done via AdminConsole then deployment
  works fine.
  If deployment is done on another WIN platform (and also
  connectiong via wsadmin) deployment works fine as well.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server V8.5                                 *
  ****************************************************************
  * PROBLEM DESCRIPTION: Deployer role failed to deploy an       *
  *                      application on z/OS environment.        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Deployer role failed to deploy an application with error below:
  SECJ0305I: The role-based authorization
  check failed for
  admin-authz operation
  ConfigRepositoryProxy:update:
  ?Lcom.ibm.websphere.management.repository.DocumentContentSource;
  Lcom.ibm.websphere.management.repository.DocumentContentSource;
  Lcom.ibm.websphere.management.repository.Document;:
  com.ibm.ws.management.repository.RepositoryLockToken.
  The user ABCD (unique ID:
  user:abc.x.y.z/abcd) was
  not granted any of the following required roles:
  administrator, operator.
  

Problem conclusion

• Problem is fixed so deployer role able to deploy an
  application on z/OS environment.
  
  APAR PI21421 is currently targeted for inclusion in Fix Pack
  8.5.5.4 of WebSphere Application Server V8.5.
  
  Please refer to the Recommended Updates page for delivery
  information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  
  In addition, please refer to URL:
  http://www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
  for Fix Pack PTF information.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE FOR Z

• Fixed component ID

  5655I3500

Applicable component levels

• R850 PSY

     UP