PM89426: WS-SECURITY COMMON COMPONENT CANNOT USE KEYRING FILES

Fixes are available

APAR status

Closed as program error.

Error description

WS-Security common component cannot open z/OS keyring files.

In the WebSphere application server full profile, the keyring
files are handled exclusively by base security so wssecurity
doesn't have to ever process them directly.  When the common
component is used, WS-Security must process them directly.

Some additional code needs to be added to use a different url
constructor when a keyring file is used.

Local fix

Problem summary

****************************************************************
* USERS AFFECTED:  IBM WebSphere Application Server            *
*                  developers of WS-Security enabled JAX-WS    *
*                  web services applications and SAML          *
****************************************************************
* PROBLEM DESCRIPTION: WS-Security common component cannot     *
*                      use keyring files for SAML token        *
*                      processing.                             *
****************************************************************
* RECOMMENDATION:  Update the was-wssecurity-*.jar used by     *
*                  the application with one that includes      *
*                  this APAR.                                  *
****************************************************************
When an application developer wants to use a private key or
public certificate when processing a SAML token, they use one
of the two methods for keystores provided in the
SAMLTokenFactory:
newKeyStoreConfig(java.lang.String ksRef)
newKeyStoreConfig(java.lang.String type,
java.lang.String path, java.lang.String password)
If you want to use a keyring file on the application server,
you configure a managed keystore using the administrative
console or wsadmin, then use the
newKeyStoreConfig(java.lang.String ksRef) method.  Keyring
files cannot be opened using the other method that is
available.
Howevever, when the WebSphere WS-Security runtime is not
running on an Application Server (such as IMS SOAP Gateway),
managed keystores are not available.  This leaves no mechanism
for using keyring files when not running on the Application
Server.

Problem conclusion

The WebSphere WS-Security runtime is updated to support
keyring files using the following existing method in
com.ibm.websphere.wssecurity.wssapi.token.SAMLTokenFactory:

newKeyStoreConfig(java.lang.String type,
  java.lang.String path, java.lang.String password)

Following is an example of creating a new keystore config for
use with SAML token processing for a keyring file:

newKeyStoreConfig("JCERACFKS",
"safkeyring://ownerID/RACF_KEYRING_NAME", "password");

JCERACFKS and JCECCARACFKS types are supported.


The fix for this APAR is currently targeted for inclusion in
fix packs 7.0.0.31, 8.0.0.8, and 8.5.5.1.  Please refer to the
Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PM89426
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
850
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2013-05-21
Closed date
2013-07-12
Last modified date
2013-07-12

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R700 PSY
UP
R800 PSY
UP
R850 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.5","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
11 January 2022

Tips

PM89426: WS-SECURITY COMMON COMPONENT CANNOT USE KEYRING FILES

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R700 PSY

R800 PSY

R850 PSY

Document Information

Share your feedback

Need support?