PM18010: SECJ0305I ROLE BASED AUTHORIZATION FAILURES AGAINST COSNAMING ROLES FOR CONSOLE ID THAT DOES NOT REQUIRE COSNAMING ACCESS.

Fixes are available

APAR status

Closed as program error.

Error description

Customer set up an admininstrative console userid to have only
deployer and operator access. After logging on with this userid
in the console and clicking on the different menu items in the
console the error 500 is received on the console. The controller
region shows this,

Trace: 2010/05/14 17:08:15.223 01 t=8C2A48 c=UNK key=S2
ThreadId: 0000000c
FunctionName: com.ibm.ws.security.role.RoleBasedAuthorizerImpl
SourceId: com.ibm.ws.security.role.RoleBasedAuthorizerImpl
Category: AUDIT
ExtendedMessage: BBOO0222I: SECJ0305I: The role-based
authorization check failed for naming-authz operation
NameServer:resolve_complete_info.  The user test1
(unique ID: user:test.ibm-ny.com/test1) was not granted
any of the following required roles: CosNamingWrite,
CosNamingRead, CosNamingDelete, CosNamingCreate.

After this there are problems with other user IDs in using the
console. They get error 500 as well. The console users do not
need to have access to the above CosNaming roles. This apar will
address this problem.

In the above description it can be any console user, not
necessarily a deployer or operator. That was used for example
purposes.

Local fix

Grant the ID cosnaming role access temporarily and recycle the
server.

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server V7.0 who disable COSNAMINGREAD for   *
*                  all users.                                  *
****************************************************************
* PROBLEM DESCRIPTION: Unable to view help panels from the     *
*                      admininstrative console.                *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
All users had to have COSNAMINGREAD privledges in order to
view admininstrative console help portletes.

Problem conclusion

Change admininstrative console code so that it could always
load console extensions to enable viewing of console help.

APAR PM18010 is currently targeted for inclusion in
Service Level (7.0.0.13)  of WebSphere Application Server

Please refer to URL:
//www.ibm.com/support/docview.wss?rs=404&uid=swg27006970
for Fix Pack availability.

Temporary fix

Comments

APAR Information

APAR number
PM18010
Reported component name
WEBSPHERE FOR Z
Reported component ID
5655I3500
Reported release
700
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2010-07-07
Closed date
2010-08-31
Last modified date
2010-11-03

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBSPHERE FOR Z
Fixed component ID
5655I3500

Applicable component levels

R700 PSY UK61146
UP10/10/21 P F010

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SS7K4U","label":"WebSphere Application Server for z\/OS"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"7.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
24 October 2021

Tips

PM18010: SECJ0305I ROLE BASED AUTHORIZATION FAILURES AGAINST COSNAMING ROLES FOR CONSOLE ID THAT DOES NOT REQUIRE COSNAMING ACCESS.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY UK61146

Fix is available

Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.

Document Information

Share your feedback

Need support?