PM09762: UNABLE TO CREATE J2C AUTHENTICATION DATA USING CONFIGURATOR ROLE USER

Fixes are available

APAR status

Closed as program error.

Error description

Problem:

Unable to create J2C authentication data using configurator role
user. Problem occurs only on v7.0


From console

From Resources -> JDBC Provider -> Oracle JDBC Thin Driver ->
additional properties -> Data Sources -> myDataSource -> Related
Items -> J2C Authentication Data Entries

We don't see new or delete button in J2C panel. It appears that
the call that security makes to create the config data in the
admin.jmx component is different in v6.1 and v7. The v7 code
makes a call to check the admin context, and since
configurator are not admin, this call is failing with
following error.


---------------------------------------------
SECJ0321E: Role based authorization is caller in role  failed
for security name
---------------------------------------------

Local fix

```
n/a
```

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application Server
****************************************************************
* PROBLEM DESCRIPTION: Users of WebSphere Application          *
*                      Server's configurator administrative    *
*                      role are unable to create or delete a   *
*                      J2C authentication data entry.          *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
WebSphere Application Server only checked for the
administrator role before allowing this action.

Problem conclusion

WebSphere Application Server has been modified to correctly
check both administrator and configurator roles before
allowing this action.

As a result of WebSphere Application Server's change in it's
behavior regarding access to security.xml, version 7 will only
allow an administrator to make changes to security.xml.
Because of this change, a custom property has been added to
allow backwards compatibility with v6.1. This property is
called com.ibm.ws.security.allowNonAdminToSecurityXML, with a
default value of false. When this property is set to true,
non-admin security roles are allowed the ability to modify
security.xml, as was the behavior in v6.1.

The fix for this APAR is currently targeted for inclusion in
fix pack 7.0.0.13.  Please refer to the Recommended Updates
page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

```
ZE Fix error, see PM30958  3/17/2011
```

Comments

APAR Information

APAR number
PM09762
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2010-03-12
Closed date
2010-05-11
Last modified date
2011-03-17

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R700 PSY
UP

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
24 October 2021

Tips

PM09762: UNABLE TO CREATE J2C AUTHENTICATION DATA USING CONFIGURATOR ROLE USER

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

Document Information

Share your feedback

Need support?