PM50025: NO GROUP IS RETURNED WHEN DIRECT GROUP SEARCH IS PERFORMED.

8.0.0.3: WebSphere Application Server V8.0 Fix Pack 3
8.0.0.4: WebSphere Application Server V8.0 Fix Pack 4
8.0.0.5: WebSphere Application Server V8.0 Fix Pack 5
8.0.0.6: WebSphere Application Server V8.0 Fix Pack 6
8.0.0.7: WebSphere Application Server V8.0 Fix Pack 7
8.0.0.8: WebSphere Application Server V8.0 Fix Pack 8
8.0.0.9: WebSphere Application Server V8.0 Fix Pack 9
8.0.0.10: WebSphere Application Server V8.0 Fix Pack 10
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15

APAR status

• Closed as program error.

Error description

• On WebSphere Application Server v8 Console User is not able
  to authenticate when User is part of LDAP group.
  
  Error message on logs
  
  WebCollaborat A   SECJ0129E: Authorization failed for user
  ldap.xxx.xxx.com:636 while invoking
  GET on admin_host:/ibm/console/, Authorization failed, Not
  granted any of the required roles: administrator operator
  configurator monitor nobody
  

Local fix

• n/a
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server with standalone LDAP user registry   *
  *                  enabled.                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION: When nested group search function is    *
  *                      enabled, Standalone LDAP user           *
  *                      registry does not search nested         *
  *                      groups.                                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Due to a code defect, when nested group search function is
  enabled, Standalone LDAP user registry searches only groups of
  which a user is a member of. As a result, when there are
  nested groups, the code fails to find these groups.
  

Problem conclusion

• With this fix, Standalone LDAP user registry now searches
  nested groups properly.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.0.0.3.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels

• R800 PSY

     UP