PM00811: SAF DELEGATION FIX using RACF UR BRIDGE

Fixes are available

APAR status

Closed as program error.

Error description

SAF Delegation must be active in some configurations but it
cannot be activated.

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server V6.1.0                               *
****************************************************************
* PROBLEM DESCRIPTION: For WebSphere Application Server for    *
*                      z/OS, System Authorization Facility     *
*                      (SAF) delegation cannot be enabled      *
*                      when the SAF bridge is used with the    *
*                      Federated Repository.                   *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
For WebSphere Application Server for z/OS it is not currently
possible to enable System Authorization Facility
(SAF) delegation when the SAF bridge feature of the Federated
Repository is used. This does not allow the APPLDATA of the
SAF profile be used for SAF delegation.

Problem conclusion

The security code was modified to allow forcing SAF delegation
even when SAF authorization is not enabled. This will
allow the Federated Repository with a SAF bridge to be able to
perform SAF delegation.

APAR PM00811 requires changes to documentation.

NOTE: Periodically, we refresh the documentation on our
Web site, so the changes might have been made before you
read this text. To access the latest on-line
documentation, go to the product library page at:

http://www.ibm.com/software/webservers/appserv/library

The following changes to the WebSphere Application Server
Version 6.1 Information Center will be made available in
May, 2010.

The following description of the
com.ibm.security.SAF.forceDelegation custom property will
be added to the "Security custom properties" topic:

com.ibm.security.SAF.forceDelegation

Determines whether System Authorization Facility (SAF)
delegation can be used independently of SAF authorization.
When this property is set to true, SAF delegation can be
used whenever the user registry is a Federated Repository
user registry, and is configured with a SAF user registry
bridge.

There is no default value for this property.

APAR PK00811 is currently targeted for inclusion in Service
Level (Fix Pack) 6.1.0.31 of WebSphere Application Server V6.1.

Please refer to URL:
//www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
for Fix Pack availability.

Temporary fix

Comments

APAR Information

APAR number
PM00811
Reported component name
WEBSPHERE FOR Z
Reported component ID
5655I3500
Reported release
610
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2009-11-09
Closed date
2010-02-20
Last modified date
2010-06-03

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

PM01207

Fix information

Fixed component name
WEBSPHERE FOR Z
Fixed component ID
5655I3500

Applicable component levels

R610 PSY UK56378
UP10/05/08 P F005

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
29 December 2021

Tips

PM00811: SAF DELEGATION FIX using RACF UR BRIDGE

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R610 PSY UK56378

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

Document Information

Share your feedback

Need support?