IBM Support

PM24003: PING METHOD GETS CORBA.NO_PERMISSION ON NODEAGENT WHEN AUTHENTICATION IS SET AS REQUIRED

Fixes are available

6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
7.0.0.17: Java SDK 1.6 SR9 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
7.0.0.27: Java SDK 1.6 SR13 FP2 Cumulative Fix for WebSphere Application Server
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server
7.0.0.19: Java SDK 1.6 SR9 FP2 Cumulative Fix for WebSphere Application Server
7.0.0.21: Java SDK 1.6 SR9 FP2 Cumulative Fix for WebSphere
7.0.0.23: Java SDK 1.6 SR10 FP1 Cumulative Fix for WebSphere
7.0.0.25: Java SDK 1.6 SR11 Cumulative Fix for WebSphere Application Server
7.0.0.27: Java SDK 1.6 SR12 Cumulative Fix for WebSphere Application Server
7.0.0.29: Java SDK 1.6 SR13 FP2 Cumulative Fix for WebSphere Application Server
7.0.0.45: Java SDK 1.6 SR16 FP60 Cumulative Fix for WebSphere Application Server
7.0.0.31: Java SDK 1.6 SR15 Cumulative Fix for WebSphere Application Server
7.0.0.35: Java SDK 1.6 SR16 FP1 Cumulative Fix for WebSphere Application Server
7.0.0.37: Java SDK 1.6 SR16 FP3 Cumulative Fix for WebSphere Application Server
7.0.0.39: Java SDK 1.6 SR16 FP7 Cumulative Fix for WebSphere Application Server
7.0.0.41: Java SDK 1.6 SR16 FP20 Cumulative Fix for WebSphere Application Server
7.0.0.43: Java SDK 1.6 SR16 FP41 Cumulative Fix for WebSphere Application Server

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • When CSIv2Inbound Authentication is set as required. If
    Location Service code tries to register a server to Dmgr, a
    failure may occur. When this condition happens, the following
    exception is logged in a node agent log:
    
    [12/29/09 10:15:09:028 CST] 00000983 ORBRas        1
    com.ibm.rmi.pi.InterceptorManager iterateClientInterceptors:433
    ORB.thread.pool : 0 The following exception was logged
    org.omg.CORBA.NO_PERMISSION:
    ERROR:
    Unauthenticated credential found, client auth required by client
    or server, throwing NO_PERMISSION.  vmcid: 0x49421000  minor
    code: 92 completed: No
    at
    com.ibm.ISecurityLocalObjectBaseL13Impl.CSIClientRIBase.retrie
    veSubject(CSIClientRIBase.java:467)
    at
    com.ibm.ISecurityLocalObjectBaseL13Impl.CSIClientRI.send_request
    (CSIClientRI.java:404)
    at
    com.ibm.rmi.pi.InterceptorManager.invokeInterceptor(InterceptorM
    anager.java:597)
    at
    com.ibm.rmi.pi.InterceptorManager.iterateClientInterceptors(Inte
    rceptorManager.java:415)
    at
    com.ibm.rmi.pi.InterceptorManager.iterateSendRequest(Interceptor
    Manager.java:665)
    at
    com.ibm.rmi.iiop.ClientRequestImpl.<init>(ClientRequestImpl.java
    :165)
    at com.ibm.rmi.iiop.GIOPImpl.createRequest(GIOPImpl.java:159)
    at
    com.ibm.rmi.corba.ClientDelegate._createRequest(ClientDelegate.j
    ava:1993)
    at
    com.ibm.rmi.corba.ClientDelegate.createRequest(ClientDelegate.ja
    va:1155)
    at
    com.ibm.rmi.corba.ClientDelegate.createRequest(ClientDelegate.ja
    va:1270)
    at
    com.ibm.CORBA.iiop.ClientDelegate.createRequest(ClientDelegate.j
    ava:1325)
    at
    com.ibm.rmi.corba.ClientDelegate.createRequest(ClientDelegate.ja
    va:1131)
    at
    com.ibm.CORBA.iiop.ClientDelegate.createRequest(ClientDelegate.j
    ava:1291)
    at
    com.ibm.rmi.corba.ClientDelegate.request(ClientDelegate.java:186
    9)
    at
    com.ibm.CORBA.iiop.ClientDelegate.request(ClientDelegate.java:12
    47)
    at
    org.omg.CORBA.portable.ObjectImpl._request(ObjectImpl.java:458)
    at
    com.ibm.ws.orb.services.lsd._ORB_ServerStub.ping(_ORB_ServerStub
    .java:34)
    at
    com.ibm.ws.orbimpl.services.lsd.LocationServiceImpl.reactivateSe
    rvers(LocationServiceImpl.java:879)
    

Local fix

  • Change CSIv2 inbound authentication from "required" to
    "supported"
    
    1. Open the admin console and go to Security > Secure
    administration,
    applications, and infrastructure
    2. Under the "Authentication" section, expand the "RMI/IIOP
    security"
    section
    3. Click on "CSIv2 inbound authentication"
    4. Under "Basic authentication", make certain that "Supported"
    is
    selected.  From the traces, it looks like you have "Required"
    selected
    instead.
    

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  All users of IBM WebSphere Application      *
    *                  Server                                      *
    ****************************************************************
    * PROBLEM DESCRIPTION: Location Services calls may fail        *
    *                      when CSIv2Inbound Authentication is     *
    *                      set as required.                        *
    ****************************************************************
    * RECOMMENDATION:                                              *
    ****************************************************************
    The security code prohibits sending some location service
    methods without having security credentials even when these
    methods are non protected public methods.
    

Problem conclusion

  • With this fix, these location services methods are called
    regardless of CSIv2Inbound/Outbound Authentication settings.
    
    The fix for this APAR is currently targeted for inclusion in
    fix pack 6.1.0.37 and 7.0.0.17.  Please refer to the
    Recommended Updates page for delivery information:
    http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PM24003

  • Reported component name

    WEBS APP SERV N

  • Reported component ID

    5724H8800

  • Reported release

    61A

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2010-10-05

  • Closed date

    2010-12-29

  • Last modified date

    2010-12-29

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WEBS APP SERV N

  • Fixed component ID

    5724H8800

Applicable component levels

  • R61A PSY

       UP

  • R61H PSY

       UP

  • R61I PSY

       UP

  • R61P PSY

       UP

  • R61S PSY

       UP

  • R61W PSY

       UP

  • R61Z PSY

       UP

  • R700 PSY

       UP



Document information

More support for: WebSphere Application Server
General

Software version: 6.1

Reference #: PM24003

Modified date: 29 December 2010