PM24003: PING METHOD GETS CORBA.NO_PERMISSION ON NODEAGENT WHEN AUTHENTICATION IS SET AS REQUIRED

6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
7.0.0.17: Java SDK 1.6 SR9 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
7.0.0.27: Java SDK 1.6 SR13 FP2 Cumulative Fix for WebSphere Application Server
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server
7.0.0.19: Java SDK 1.6 SR9 FP2 Cumulative Fix for WebSphere Application Server
7.0.0.21: Java SDK 1.6 SR9 FP2 Cumulative Fix for WebSphere
7.0.0.23: Java SDK 1.6 SR10 FP1 Cumulative Fix for WebSphere
7.0.0.25: Java SDK 1.6 SR11 Cumulative Fix for WebSphere Application Server
7.0.0.27: Java SDK 1.6 SR12 Cumulative Fix for WebSphere Application Server
7.0.0.29: Java SDK 1.6 SR13 FP2 Cumulative Fix for WebSphere Application Server
7.0.0.45: Java SDK 1.6 SR16 FP60 Cumulative Fix for WebSphere Application Server
7.0.0.31: Java SDK 1.6 SR15 Cumulative Fix for WebSphere Application Server
7.0.0.35: Java SDK 1.6 SR16 FP1 Cumulative Fix for WebSphere Application Server
7.0.0.37: Java SDK 1.6 SR16 FP3 Cumulative Fix for WebSphere Application Server
7.0.0.39: Java SDK 1.6 SR16 FP7 Cumulative Fix for WebSphere Application Server
7.0.0.41: Java SDK 1.6 SR16 FP20 Cumulative Fix for WebSphere Application Server
7.0.0.43: Java SDK 1.6 SR16 FP41 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• When CSIv2Inbound Authentication is set as required. If
  Location Service code tries to register a server to Dmgr, a
  failure may occur. When this condition happens, the following
  exception is logged in a node agent log:
  
  [12/29/09 10:15:09:028 CST] 00000983 ORBRas        1
  com.ibm.rmi.pi.InterceptorManager iterateClientInterceptors:433
  ORB.thread.pool : 0 The following exception was logged
  org.omg.CORBA.NO_PERMISSION:
  ERROR:
  Unauthenticated credential found, client auth required by client
  or server, throwing NO_PERMISSION.  vmcid: 0x49421000  minor
  code: 92 completed: No
  at
  com.ibm.ISecurityLocalObjectBaseL13Impl.CSIClientRIBase.retrie
  veSubject(CSIClientRIBase.java:467)
  at
  com.ibm.ISecurityLocalObjectBaseL13Impl.CSIClientRI.send_request
  (CSIClientRI.java:404)
  at
  com.ibm.rmi.pi.InterceptorManager.invokeInterceptor(InterceptorM
  anager.java:597)
  at
  com.ibm.rmi.pi.InterceptorManager.iterateClientInterceptors(Inte
  rceptorManager.java:415)
  at
  com.ibm.rmi.pi.InterceptorManager.iterateSendRequest(Interceptor
  Manager.java:665)
  at
  com.ibm.rmi.iiop.ClientRequestImpl.<init>(ClientRequestImpl.java
  :165)
  at com.ibm.rmi.iiop.GIOPImpl.createRequest(GIOPImpl.java:159)
  at
  com.ibm.rmi.corba.ClientDelegate._createRequest(ClientDelegate.j
  ava:1993)
  at
  com.ibm.rmi.corba.ClientDelegate.createRequest(ClientDelegate.ja
  va:1155)
  at
  com.ibm.rmi.corba.ClientDelegate.createRequest(ClientDelegate.ja
  va:1270)
  at
  com.ibm.CORBA.iiop.ClientDelegate.createRequest(ClientDelegate.j
  ava:1325)
  at
  com.ibm.rmi.corba.ClientDelegate.createRequest(ClientDelegate.ja
  va:1131)
  at
  com.ibm.CORBA.iiop.ClientDelegate.createRequest(ClientDelegate.j
  ava:1291)
  at
  com.ibm.rmi.corba.ClientDelegate.request(ClientDelegate.java:186
  9)
  at
  com.ibm.CORBA.iiop.ClientDelegate.request(ClientDelegate.java:12
  47)
  at
  org.omg.CORBA.portable.ObjectImpl._request(ObjectImpl.java:458)
  at
  com.ibm.ws.orb.services.lsd._ORB_ServerStub.ping(_ORB_ServerStub
  .java:34)
  at
  com.ibm.ws.orbimpl.services.lsd.LocationServiceImpl.reactivateSe
  rvers(LocationServiceImpl.java:879)
  

Local fix

• Change CSIv2 inbound authentication from "required" to
  "supported"
  
  1. Open the admin console and go to Security > Secure
  administration,
  applications, and infrastructure
  2. Under the "Authentication" section, expand the "RMI/IIOP
  security"
  section
  3. Click on "CSIv2 inbound authentication"
  4. Under "Basic authentication", make certain that "Supported"
  is
  selected.  From the traces, it looks like you have "Required"
  selected
  instead.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: Location Services calls may fail        *
  *                      when CSIv2Inbound Authentication is     *
  *                      set as required.                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The security code prohibits sending some location service
  methods without having security credentials even when these
  methods are non protected public methods.
  

Problem conclusion

• With this fix, these location services methods are called
  regardless of CSIv2Inbound/Outbound Authentication settings.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 6.1.0.37 and 7.0.0.17.  Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R61A PSY

     UP

• R61H PSY

     UP

• R61I PSY

     UP

• R61P PSY

     UP

• R61S PSY

     UP

• R61W PSY

     UP

• R61Z PSY

     UP

• R700 PSY

     UP