PK71800: NEED TO BE ABLE TO ALLOW FILE TRANSFER CLIENT TO USE BASIC AUTHENTICATION

Fixes are available

APAR status

Closed as program error.

Error description

AdminClient on one cell is attempting to run the AppManagement
MBean redeployApplication on another cell. It fails because an
LTPA token is generated after a user login to the  web interface
of the tool.  This LTPAtoken is propagated to the REMOTE_CELL
File Transfer Services  and used for authentication. Since
ADMIN_CELL and REMOTE_CELL are not in the same SSO domain, the
authentication fails and therefore the deployment fails.
 -
The Admin Server shows:
 SystemErr     R
 Caused by: com.ibm.websphere.management.filetransfer.client.
  TransferFailedException: 401 Unauthorized
 (for: C:\Program Files\IBM\xxx70\runtimes\base_v61\
  installableApps\DefaultApplication.ear).
 -
The Target DM shows:
 FileDocument  E
  ADMR0104E: The system is unable to read document
  cells/CELLNAME/filter.policy.backup:
  java.io.FileNotFoundException:
  /opt/WebSphere/V61/DM/AppServer/profiles/DM/config/cells/
   CELLNAME/filter.policy.backup
  (The file access permissions do not allow the specified
  action.)
 -

Local fix

None
 -
KEYWORDS: authenication SSO security LTPAtoken

Problem summary

****************************************************************
* USERS AFFECTED:  WebSphere Application Server V6.1 and V7.0  *
*                  users who wish to use filetransfer          *
*                  function between servers using basic        *
*                  authentication rather than LTPA.            *
****************************************************************
* PROBLEM DESCRIPTION: The filetransfer client cannot do       *
*                      basic authentication when running in    *
*                      a server process.                       *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
The filetransfer client was originally coded to always use
LTPA (and never use basic authentication) when running in a
server environment.

Therefore, any application running on an application server
that attempts to connect to another server process using basic
authentication will find it impossible if they are using
functions that rely on the filetransfer client (for example,
the redeployApplication operation and wsadmin AdminTask
operations).

One example where this problem might be encountered is if two
servers are not in a single SSO domain and do not share LTPA
tokens, and secure filetransfer is being used, and an attempt
is made to deploy an application from one server to another.
The application deployment code uses filetransfer, and will
fail because it will attempt to use LTPA to authenticate
between the servers. In this situation, there is no way to
force basic authentication to be used, except by applying this
APAR.

Problem conclusion

The code has been modified to allow filetransfer client to
perform basic authentication in a server process and to obtain
a username and password from the AdminClient. For Application
Server V70, this behavior is the default. For Application
Server version 6.1, a custom property must be set in order to
enable this behavior. Details for each version are provided
below

FOR VERSION 70:

With this APAR fix applied, the filetransfer client will
perform basic authentication when running in a server process.

In order for basic authentication to succeed, the filetransfer
client must be initialized with an AdminClient that contains a
valid username and password. If the filetransfer client cannot
find an AdminClient, or the AdminClient does not have a valid
username and password, then the filetransfer client will
attempt to use LTPA.

FOR VERSION 6.1:

With this APAR fix applied, the filetransfer client will
perform basic authentication when running in a server process
if the following Java system property is set to "true" (case
insensitive)

com.ibm.websphere.management.filetransfer.serverBasicAuth=true

If this system property is not set, or is set to anything but
"true" (case insensitive), the code will work exactly as if
this APAR were not applied, and will always use LTPA when the
filetransfer client is running on a server process.

In addition to setting the system property, in order for basic
authentication to succeed, the filetransfer client must be
initialized with an AdminClient that contains a valid username
and password. If the filetransfer client cannot find an
AdminClient, or the AdminClient does not have a valid username
and password, then the filetransfer client will attempt to use
LTPA.

The behavior of the filetransfer client when running in a
CLIENT process is not changed by this fix.

To set the custom property from the admin console, do the
following:

1. Select a server:

Dmgr: On the left pane, select System Administration and then
Deployment Manager

Node agent: On the left pane, select System Administration and
then Node agents. Select the desired node agent from the list
in the right window.

Application server: On the left pane, select Servers and then
Application servers. Select the desired server from the list
in the right window.

2. Under the heading Server Infrastructure, select Java and
Process Management and then Process Definition

3. Under the heading Additional Properties, select Java
Virtual Machine

4. Under the heading Additional Properties, select Custom
Properties

5. Select New, enter property Name
(com.ibm.websphere.management.filetransfer.serverBasicAuth)
enter property Value (true), select OK

6. IMPORTANT: after clicking OK, select the link to save
directly to the master configuration.

7. Restart the server where the custom property was just set.

The fix for this APAR is currently targeted for inclusion in
fixpacks 6.1.0.23 and 7.0.0.7. Please refer to the Recommended
Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PK71800
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
61W
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2008-09-09
Closed date
2008-11-06
Last modified date
2009-07-23

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R61A PSY
UP
R61H PSY
UP
R61I PSY
UP
R61P PSY
UP
R61S PSY
UP
R61W PSY
UP
R61Z PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
29 December 2021

Tips

PK71800: NEED TO BE ABLE TO ALLOW FILE TRANSFER CLIENT TO USE BASIC AUTHENTICATION

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R61A PSY

R61H PSY

R61I PSY

R61P PSY

R61S PSY

R61W PSY

R61Z PSY

Document Information

Share your feedback

Need support?