PM03403: NOT ABLE TO SEARCH GROUPS WHEN TRUST ALL REALMS (INCLUDING THOSE EXTERNAL TO THIS CELL) IS SET.

Fixes are available

APAR status

Closed as program error.

Error description

Group search from the admin console is not possible when "Trust
all realms (including those external to this cell)" is set in
the following panel in the admin console.

Global security > Kerberos > CSIv2 inbound communications >
Trusted authentication realms - inbound

When this option is set and a group search is performed from the
console, the following error is logged

[12/14/09 13:03:29:140 EST] 00000038 GroupDetailAc W

listRegistryGroups: Command not successful:
com.ibm.websphere.management.cmdframework.CommandValidationExcep
tion:
SECJ7762E: Unable to find the registry object.

As a work around, the option can be set to ""Trust realms as
indicated below"" to make the group search work.  Once the
option is changed, the configuration needs to be saved and
synchronized with the nodes in the cell.

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application Server
****************************************************************
* PROBLEM DESCRIPTION: For WebSphere Application Server, it    *
*                      is not possible to search for groups    *
*                      from the "Adminstrative group roles >   *
*                      Group" panel when "Trust all realms"    *
*                      is selected in the "Global security >   *
*                      CSIv2 inbound communications >          *
*                      Trusted authentication realms -         *
*                      inbound" panel.                         *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
For WebSphere Application Server, the groups search from the
"Adminstrative group roles > Group" panel does not return the
groups in the realm when the "Trust all realms" is selected in
the "Global security > CSIv2 inbound communications > Trusted
authentication realms - inbound" panel. The error message
displayed is as follows,

"The selected realm cannot be accessed at this time. You may
need to start the server. Otherwise, you can use the following
fields to add users by their unique user IDs."

Problem conclusion

The code was modified to correctly retrieve the list of
trusted realms prior to searching for the groups.

The fix for this APAR is currently targeted for inclusion in
fix pack 7.0.0.13.  Please refer to the Recommended Updates
page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PM03403
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2009-12-14
Closed date
2010-04-26
Last modified date
2010-04-26

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R700 PSY
UP

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
24 October 2021

Tips

PM03403: NOT ABLE TO SEARCH GROUPS WHEN TRUST ALL REALMS (INCLUDING THOSE EXTERNAL TO THIS CELL) IS SET.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

Document Information

Share your feedback

Need support?