PK73293: INCORRECT PUBSUB MESSAGE ACCESS WHEN SENDER ROLE DEFINED AND BUS SECURITY ENABLED. POSSIBLE NPE AT ME RESTART.

Fixes are available

APAR status

Closed as program error.

Error description

A messaging engine failed to start when security was enabled
and a topicspace had been configured. The following FFDC was
generated:

java.lang.NullPointerException at
com.ibm.ws.sib.security.auth.policy.
BusAUthorizationPolicyFactory.loadTopicPermissions
(BusAuthorizationPolicyFactory.java:915)
...

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  Users of the default messaging provider in  *
*                  WebSphere Application Server V7.0 who use   *
*                  Pub Sub messaging with bus security enabled.*
****************************************************************
* PROBLEM DESCRIPTION: Firstly, if a topic is configured with  *
*                      users and groups in receiver roles,     *
*                      but none in sender roles the            *
*                      messaging engine fails to start.        *
*                                                              *
*                      Secondly, if a user or group is in a    *
*                      sender role it will also be given the   *
*                      permissions of a receive role.          *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
There are 2 problems covered by this APAR:

Firstly, if a topic is configured with receiver roles,
but not with sender roles the messaging engine fails to
start with the following exception:

CWSIP0002E: An internal messaging error occurred in
com.ibm.ws.sib.processor.impl.MessageProcessor, 1:1391:1.443,
java.lang.NullPointerException
  at
com.ibm.ws.sib.security.auth.policy.BusAuthorizationPolicyFactor
y.loadTopicsPermissions(BusAuthorizationPolicyFactory.java:915)
  at
com.ibm.ws.sib.security.auth.policy.BusAuthorizationPolicyFactor
y.loadTopicSpacePermissions(BusAuthorizationPolicyFactory.java:8
72)
  at
com.ibm.ws.sib.security.auth.policy.BusAuthorizationPolicyFactor
y.getBusSecurityPolicy(BusAuthorizationPolicyFactory.java:385)
  at
com.ibm.ws.sib.security.auth.LocalAccessControl.initAuthDataPriv
ileged(LocalAccessControl.java:458)
  at
com.ibm.ws.sib.security.auth.LocalAccessControl.access$100(Local
AccessControl.java:75)
  at
com.ibm.ws.sib.security.auth.LocalAccessControl$1.run(LocalAcces
sControl.java:436)
  at
com.ibm.ws.sib.security.auth.LocalAccessControl$1.run(LocalAcces
sControl.java:431)
  at
java.security.AccessController.doPrivileged(AccessController.jav
a:202)
  at
com.ibm.ws.sib.security.auth.LocalAccessControl.initAuthData(Loc
alAccessControl.java:430)
  at
com.ibm.ws.sib.security.auth.LocalAccessControl.<init>(LocalAcce
ssControl.java:177)
  at
com.ibm.ws.sib.security.auth.SIBAccessControlImpl.<init>(SIBAcce
ssControlImpl.java:132)
  at
com.ibm.ws.sib.security.auth.SIBAccessControlFactoryImpl.getSIBA
ccessControl(SIBAccessControlFactoryImpl.java:82)
  at
com.ibm.ws.sib.processor.impl.MessageProcessor.startInternal(Mes
sageProcessor.java:1524)
  at
com.ibm.ws.sib.processor.impl.MessageProcessor.start(MessageProc
essor.java:1342)
  at
com.ibm.ws.sib.admin.impl.JsMessagingEngineImpl.start(JsMessagin
gEngineImpl.java:609)
  at
com.ibm.ws.sib.admin.impl.HAManagerMessagingEngineImpl.activate(
HAManagerMessagingEngineImpl.java:995)
  at
com.ibm.ws.sib.admin.impl.JsActivationThread.run(JsActivationThr
ead.java:92)

Secondly, if a topic is configured with both sender and
receiver roles then the users and groups in the sender role
will also, incorrectly, be given the receiver role.  While the
users and groups in the receiver roles will not be given
receiver access to the topic.

Problem conclusion

The fix updates the parsing code which incorrectly uses the
sender role when loading the receiver permissions for topics.

Temporary fix

Comments

APAR Information

APAR number
PK73293
Reported component name
PLAT MSG COM
Reported component ID
620800101
Reported release
300
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2008-10-06
Closed date
2008-11-20
Last modified date
2008-11-20

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
PLAT MSG COM
Fixed component ID
620800101

Applicable component levels

R300 PSY
UP

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
23 October 2021

Tips

PK73293: INCORRECT PUBSUB MESSAGE ACCESS WHEN SENDER ROLE DEFINED AND BUS SECURITY ENABLED. POSSIBLE NPE AT ME RESTART.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R300 PSY

Document Information

Share your feedback

Need support?