PK96624: JSAS1477W WHEN CLIENT WEBSPHERE RMI-IIOP CALL WITH CSIV2 BASIC AUTH REQUIRED OUTBOUND, AND Z/OS BASIC AUTH REQUIRED INBOUND

Fixes are available

APAR status

Closed as program error.

Error description

A non-z/OS WebSphere client attempting to make an RMI-IIOP call
to a remote WebSphere z/OS server surfaces a JSAS1477W message
when non-z/OS WebSphere client has CSIv2 basic authentication
outbound set to required, and remote z/OS WebSphere server has
CSIv2 basic authentication inbound set to required.  Identity
assertion is enabled on both client and remote server.

Below is an example of a CSIv2 configuration that surfaces this
error.

Client non-z/OS WebSphere setup is:
-----
Secure administration, applications, and infrastructure > CSIv2
outbound authentication

Basic authentication = Required
Client certificate authentication = Never
Identity assertion = Checked
 Specify an alternative trusted identity
 User = USERID
Stateful sessions = checked
Custom outbound mapping = unchecked
Security attribute propagation = checked
----

Remote z/OS WebSphere setup is:
-----
Secure administration, applications, and infrastructure > CSIv2
inbound
authentication

Basic authentication = Required
Client certificate authentication = Never
Identity assertion = Checked
 Trusted identities
 User = USERID
Stateful sessions = checked
Security attribute propagation = checked
-----

The client fails resulting in following message to non-z/OS
WebSphere client SystemOut.log

JSAS1477W: SECURITY CLIENT/SERVER CONFIG MISMATCH:  The client
security configuration (sas.client.props or outbound settings in
GUI) does not support the server security configuration for the
following reasons:
ERROR 1: JSAS0612E: The client requires client authentication
(e.g., userid/password or token), but the server does not
support it.
ERROR 2: JSAS0614E: The authentication mechanism OID
supplied by the server is an unsupported OID for this WebSphere
release.

Local fix

If security requirements of client server allow for basic
authentication outbound supported, change required to supported.

In the administrative console:
-----
Secure administration, applications, and infrastructure > CSIv2
outbound authentication

Basic authentication = Supported
-----

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server V6.1.0                               *
****************************************************************
* PROBLEM DESCRIPTION: For WebSphere Application Server for    *
*                      z/OS, a client process attempting to    *
*                      locate a resource in a WebSphere        *
*                      Application Server for z/OS process     *
*                      is not able to obtain such resource     *
*                      when CSIv2 client authentication is     *
*                      required by the client.                 *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
For WebSphere Application Server for z/OS, the location daemon
does not support client authentication. A client that requires
client authentication fails to send the CSIv2 message and the
resource is not located. The client fails with an error
message as follows,

JSAS1477W: SECURITY CLIENT/SERVER CONFIG MISMATCH:  The client
security configuration (sas.client.props or outbound settings
in GUI)does not support the server security configuration for
the following reasons:
     ERROR 1: JSAS0612E: The client requires client
authentication (e.g., userid/password or token), but the
server does not support it.

     ERROR 2: JSAS0614E: The authentication mechanism OID
supplied by the server is an unsupported OID for this
WebSphere release.

Problem conclusion

The security code was modified to allow the client to send the
CSIv2 request to the location daemon when client
authentication is required by the client.

APAR PK96624 is currently targeted for inclusion in Service
Level (Fix Pack) 6.1.0.33 of WebSphere Application Server V6.1.

Please refer to URL:
//www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
for Fix Pack availability.

Temporary fix

Comments

APAR Information

APAR number
PK96624
Reported component name
WEBSPHERE FOR Z
Reported component ID
5655I3500
Reported release
610
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
YesSpecatt / CST
Submitted date
2009-09-18
Closed date
2010-05-06
Last modified date
2010-10-07

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

PM23577

Fix information

Fixed component name
WEBSPHERE FOR Z
Fixed component ID
5655I3500

Applicable component levels

R610 PSY UK59848
UP10/09/11 P F009

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
24 October 2021

Tips

PK96624: JSAS1477W WHEN CLIENT WEBSPHERE RMI-IIOP CALL WITH CSIV2 BASIC AUTH REQUIRED OUTBOUND, AND Z/OS BASIC AUTH REQUIRED INBOUND

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R610 PSY UK59848

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

Document Information

Share your feedback

Need support?