PK77288: NEED TO SUPPRESS JACC PROVIDER SECURITY EXCEPTIONS THAT GET THROWN DURING SYNCNODE OPERATION .

Fixes are available

APAR status

Closed as program error.

Error description

The following errors logged in syncNode.log file :

[9/26/08 12:10:47:296 GMT-08:00] 0000000b JaccInstallTa E
SECJ0409E:
An exception occurred when propagating the security policy
information for application ACS_server.ear to the JACC
provider. The exception is java.lang.ClassNotFoundException:
com.ascential.acs.security.jacc.ASBPolicy
 at java.lang.Class.forName(Class.java:164)
 at
com.ibm.ws.security.authorize.AppInstallNotify.getLocalPolicy(Ap
pInstall Notify.java:1350)
 at
com.ibm.ws.security.authorize.AppInstallNotify.appInstall(AppIns
tallNoti fy.java:177)


These exceptions indeed do not cause any further problems at
runtime.  Everything works fine from a functional point of
view. However we think that they might be confusing for
end-users if they decide to take a look at the syncNode.log
file.

The underlying problem is well understood . We have
customized many security aspects of WAS, in particular the JACC
provider to better control the authorization mechanism. The
ASBPolicy class shown in the call stack below is in fact one of
our JACC extension classes (it
extends the JACC Policy interface) that we store under the '
classes' directory of each WAS ND profile, including the custom
profiles.
This class, among others, is needed by every managed node in
order to properly start which is why we ask our end-users to
run the syncNode command every time they create a new managed
node: the syncNode command will basically propagate our
security classes, including the JACC extension classes and the
ASBPolicy class, to the new managed node, at which point we can
safely start the node agent on the new managed node.

The exception below occurs because the syncNode tool is
attempting to propagate the JACC security information to the
JACC provider (which btw we've configured to reside on each
managed node as well as the dmgr under
<profileName>/config/cells/<cellName>/jacc.config) but the
ASBPolicy class, which is needed to propagate the JACC security
information, has not been propagated yet.
We would basically like the syncNode tool to not throw these
exceptions (or maybe not perform a propagation of the JACC
security information in cases like ours)
as they might lead our end-users to think that something went
wrong during the syncNode operation when in reality everything
went fine.

Local fix

```
Safely ignore the messages.
```

Problem summary

****************************************************************
* USERS AFFECTED:  All users of WebSphere Application Server   *
*                  who installed an application that utilizes  *
*                  Java Authorization Contract for Containers  *
*                  (JACC)                                      *
****************************************************************
* PROBLEM DESCRIPTION: SECJ0409E error during NodeSync         *
*                      operation due to ClassNotFoundException *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
Durning the node synchronization, JACC
install/modify/uninstall Tasks are kicked off where it is not
necessary to run.   The tasks are expecting to find JACC
related files that is not on nodeagent and throws
ClassNotFoundException. This error comes back every syncNode
operation but is harmless.

Problem conclusion

Code is updated to turn off JACC tasks in the context of
NodeSync and AddNode operation since the tasks should not be
started. The fix for this APAR is currently targeted for
inclusion in fixpack 6.1.0.25 and 7.0.0.5.  Please refer to the
Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PK77288
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
61W
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2008-12-10
Closed date
2009-02-23
Last modified date
2009-05-12

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R61A PSY
UP
R61H PSY
UP
R61I PSY
UP
R61P PSY
UP
R61S PSY
UP
R61W PSY
UP
R61Z PSY
UP
R700 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
28 December 2021

Tips

PK77288: NEED TO SUPPRESS JACC PROVIDER SECURITY EXCEPTIONS THAT GET THROWN DURING SYNCNODE OPERATION .

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R61A PSY

R61H PSY

R61I PSY

R61P PSY

R61S PSY

R61W PSY

R61Z PSY

R700 PSY

Document Information

Share your feedback

Need support?