PK91652: A USER NEWLY GRANTED THE ADMINISTRATOR ROLE DOES NOT HAVE THE THE SAME ROLE ON NODEAGENT UNTIL RESTARTING THE NODEAGENT.

Fixes are available

APAR status

Closed as program error.

Error description

Start application servers in administrative console fails with
authentication error when login to administrative console with
a user newly granted an administrator role. Following are steps
to recreate this problem:

1. Start dmgr
2. Start nodeagent
3. Login to administrative console with primary user "wasadmin"
4. Add user "abc" as Administrator via administrative console
5. syncNode from administrative console
6. Logout administrative console
7. Login to administrative console with user "abc"
8. Start server1 via administrative console

Following error message was displayed in administrative console;

-----
Information: XXXNode04/server1 server could not be started.
View JVM logs for further details.
-----

The user "abc" can start the server1 after restarting the
nodeagent. Dmgr can load admin-authz.xml dynamically, but
nodeagent process does not reload admin-authz.xml file before
restarting the process.

Local fix

Invoking 'refreshAll' operation on the AuthorizationGroupManager
MBean via wsadmin command on nodeagent can preven this problem.

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server with a deployment manager            *
*                  configuration adding users and groups to    *
*                  roles.                                      *
****************************************************************
* PROBLEM DESCRIPTION: When users or groups are added to       *
*                      roles, the node agents need to be       *
*                      restarted, or the refreshAll MBean      *
*                      must be issued.                         *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
When users or groups are added to roles, the node agents need
to be restarted, or the refreshAll MBean must be issued before
the new roles take effect.

Problem conclusion

A Refresh all button was added to the console to enable you
to issue the refreshAll mbean so that the node agents don't
need to be restarted for new user or group roles to take effect.

The fix for this APAR is currently targeted for inclusion in
fix packs 6.1.0.31 and 7.0.0.9.  Please refer to the
Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PK91652
Reported component name
WEBSPHERE APP S
Reported component ID
5724J0800
Reported release
61W
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2009-07-17
Closed date
2009-10-14
Last modified date
2009-10-14

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBSPHERE APP S
Fixed component ID
5724J0800

Applicable component levels

R61A PSY
UP
R61H PSY
UP
R61I PSY
UP
R61P PSY
UP
R61S PSY
UP
R61W PSY
UP
R61Z PSY
UP
R700 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
28 December 2021

Tips

PK91652: A USER NEWLY GRANTED THE ADMINISTRATOR ROLE DOES NOT HAVE THE THE SAME ROLE ON NODEAGENT UNTIL RESTARTING THE NODEAGENT.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R61A PSY

R61H PSY

R61I PSY

R61P PSY

R61S PSY

R61W PSY

R61Z PSY

R700 PSY

Document Information

Share your feedback

Need support?