PM66457: KERBEROS SERVICE PRINCIPAL NAME (SPN) MIGHT BE COMPOSED IMPROPERLY.

8.5.0.1: WebSphere Application Server V8.5 Fix Pack 1
8.0.0.5: WebSphere Application Server V8.0 Fix Pack 5
8.5.0.2: WebSphere Application Server V8.5 Fix Pack 2
8.0.0.6: WebSphere Application Server V8.0 Fix Pack 6
8.0.0.7: WebSphere Application Server V8.0 Fix Pack 7
8.0.0.8: WebSphere Application Server V8.0 Fix Pack 8
8.0.0.9: WebSphere Application Server V8.0 Fix Pack 9
8.0.0.10: WebSphere Application Server V8.0 Fix Pack 10
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15

APAR status

• Closed as program error.

Error description

• Kerberos authentication fails with the below error:
  
  [6/8/12 10:16:35:539 CDT] 00000000  E
  
  UOW=1-fffd622c-23888294:VH-A0042981
  source=com.ibm.ISecurityLocalObjectTokenBaseImpl.Krb5WSSecurityC
  ontextIm
  pl org=IBM prod=WebSphere component=Application Server
  thread=[P=592045:O=0:CT]
            SECJ9314E: An unexpected exception occurred when
  trying to run
  initSecContext() method : GSSException:
  org.ietf.jgss.GSSException,
  major code: 11, minor code: 0
   major string: General failure, unspecified at GSSAPI level
   minor string: Error: java.lang.Exception: Error:
  com.ibm.security.krb5.KrbException, status code: 31
   message: Integrity check on decrypted field failed
  at com.ibm.security.jgss.i18n.I18NException.throwGSSException
                                           (I18NException.java:33)
  at com.ibm.security.jgss.mech.krb5.n.a(n.java:193)
  at com.ibm.security.jgss.mech.krb5.n.initSecContext(n.java:671)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: WebSphere Application Server may not    *
  *                      be able to construct SPN name           *
  *                      properly for Kerberos Authentication.   *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Under some circumstances, there is a situation that hostname
  is returned with all uppercase characters. Usually it won't be
  an issue because hostname is not case sensitive. However, the
  same string is being used to compose kerberos SPN name which
  is case sensitive. As a result, when this condition happens,
  the composed SPN name is not consistent with the one in Key
  Distribution Center (KDC).  Therefore, a kerberos ticket is not
  granted.
  

Problem conclusion

• With this fix, WebSphere Application Server provides an option
  to choose which hostname value will be used for constructing
  SPN name.
  
  The following security custom property was added to switch a
  method to get a hostname
  
  Name : com.ibm.websphere.security.util.useCanonicalHost
  Value : true or false
  
  In here, a canonical hostname which is extracted by
  getCanonicalHostname method is used when the value is set as
  true. This is the default.
  If the custom property is set to false, then the getHostname
  method is used.
  
  To set security custom properties, view the administrative
  console page, click Security > Global security > Custom
  properties. Then click New to add the new custom property and
  its associated value.
  
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.0.0.5 and 8.5.0.1.  Please refer to the Recommended
  Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R800 PSY

     UP

• R850 PSY

     UP