PK97400: WITH IDENTITY ASSERTION, CORBA::TRANSACTION_ROLLEDBACK OCCURS WHEN 6.1 SERVER INVOKES EJB IN 6.0.2 SERVER UNDER A GLOBAL TRAN

Fixes are available

APAR status

Closed as program error.

Error description

When identity assertion is enabled, if a WebSphere for z/OS 6.1
application server invokes an EJB hosted by a WebSphere for z/OS
6.0.2 server, the 6.1 server receives an exception
CORBA::TRANSACTION_ROLLEDBACK with minor code C9C218C5.

The 6.0.2 server log shows an exception also
CORBA::OBJECT_NOT_EXIST with minor code C9C25758.

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server V6.1.0                               *
****************************************************************
* PROBLEM DESCRIPTION: For WebSphere Application Server for    *
*                      z/OS, when a V6.1 application server    *
*                      invokes an Enterpise Java Bean hosted   *
*                      in a V6.0.1 application server, the     *
*                      6.1 server receives a                   *
*                      CORBA::TRANSACTION_ROLLEDBACK with      *
*                      minor code C9C218C5.                    *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
For WebSphere Application Server for z/OS with security CSIv2
identity assertion enabled, the invocation from a V6.1 server
to an Enterprise Java Bean in a V6.0.1 server produces a
CORBA::TRANSACTION_ROLLEDBACK with minor code C9C218C5 error
in the V6.1 server. The error happens if there is a global
transaction.

The error is caused when, due to the global transaction, the
V6.0.1 server calls back to the 6.1 server in order to
register a resource. In the case that the servers are
configured to accept identity assertion and client
certificates, there are no tokens or basic authentication data
in the message layer. There is only an asserted identity in
the attribute layer. Since there is nothing in the message or
in the transport layer, identity assertion fails causing the
resource registration to fail and the transaction to rollback.

Problem conclusion

The code was modified to correctly read the authentication
data from the transport protocol layer and use it to validate
that the remote server has permission to assert the identity
in the attribute layer.

APAR PK97400 requires changes to documentation.

NOTE: Periodically, we refresh the documentation on our
Web site, so the changes might have been made before you
read this text. To access the latest on-line
documentation, go to the product library page at:

http://www.ibm.com/software/webservers/appserv/library

The following changes to the WebSphere Application Server
Version 6.1 Information Center will be made available in
May, 2010.

The following description of the
com.ibm.CSI.localCommDataForNonLocalOSEnabled custom
property will be added to the "Security custom properties"
topic:

com.ibm.CSI.localCommDataForNonLocalOSEnabled

This property allows local comm data to be used as
authentication material for the CSIv2 transport layer when
the user registry is not a LocalOS user registry.

When this property is set to true, the data retrieved from
the local comm transport corresponds to the ASID of the
local client connecting to a WebSphere Application Server
process. A user corresponding to the ASID must exist in the
user registry. When a CSIv2 Establish Message is received by
a WebSphere Application Server process and Identity Assertion
is requested, the data retrieved from the local comm
transport can be used to validate that the client has
permission to assert the user specified in the Identity Token
in the Attribute Layer. If the user represented by the
received ASID is in the Trusted Identities list on the CSIv2
Inbound Authentication page in the administrative console,
then that ID is able to assert the Identity Token.

Default  false

APAR PK97400 is currently targeted for inclusion in Service
Level (Fix Pack) 6.1.0.31 of WebSphere Application Server V6.1.

Please refer to URL:
//www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
for Fix Pack availability.

Temporary fix

Comments

APAR Information

APAR number
PK97400
Reported component name
WEBSPHERE FOR Z
Reported component ID
5655I3500
Reported release
610
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2009-09-29
Closed date
2010-02-05
Last modified date
2010-06-03

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

PK97402

Fix information

Fixed component name
WEBSPHERE FOR Z
Fixed component ID
5655I3500

Applicable component levels

R610 PSY UK56378
UP10/05/08 P F005

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
29 December 2021

Tips

PK97400: WITH IDENTITY ASSERTION, CORBA::TRANSACTION_ROLLEDBACK OCCURS WHEN 6.1 SERVER INVOKES EJB IN 6.0.2 SERVER UNDER A GLOBAL TRAN

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R610 PSY UK56378

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

Document Information

Share your feedback

Need support?