IBM Support

PM89426: WS-SECURITY COMMON COMPONENT CANNOT USE KEYRING FILES

Fixes are available

8.5.5.1: WebSphere Application Server V8.5.5 Fix Pack 1
8.0.0.8: WebSphere Application Server V8.0 Fix Pack 8
7.0.0.31: WebSphere Application Server V7.0 Fix Pack 31
8.5.5.2: WebSphere Application Server V8.5.5 Fix Pack 2
7.0.0.33: WebSphere Application Server V7.0 Fix Pack 33
8.0.0.9: WebSphere Application Server V8.0 Fix Pack 9
8.5.5.3: WebSphere Application Server V8.5.5 Fix Pack 3
7.0.0.35: WebSphere Application Server V7.0 Fix Pack 35
8.5.5.4: WebSphere Application Server V8.5.5 Fix Pack 4
8.0.0.10: WebSphere Application Server V8.0 Fix Pack 10
7.0.0.37: WebSphere Application Server V7.0 Fix Pack 37
8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.0.0.11: WebSphere Application Server V8.0 Fix Pack 11
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
7.0.0.39: WebSphere Application Server V7.0 Fix Pack 39
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
7.0.0.41: WebSphere Application Server V7.0 Fix Pack 41
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
7.0.0.43: WebSphere Application Server V7.0 Fix Pack 43
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
7.0.0.45: WebSphere Application Server V7.0 Fix Pack 45
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
7.0.0.45: Java SDK 1.6 SR16 FP60 Cumulative Fix for WebSphere Application Server
7.0.0.31: Java SDK 1.6 SR15 Cumulative Fix for WebSphere Application Server
7.0.0.35: Java SDK 1.6 SR16 FP1 Cumulative Fix for WebSphere Application Server
7.0.0.37: Java SDK 1.6 SR16 FP3 Cumulative Fix for WebSphere Application Server
7.0.0.39: Java SDK 1.6 SR16 FP7 Cumulative Fix for WebSphere Application Server
7.0.0.41: Java SDK 1.6 SR16 FP20 Cumulative Fix for WebSphere Application Server
7.0.0.43: Java SDK 1.6 SR16 FP41 Cumulative Fix for WebSphere Application Server
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • WS-Security common component cannot open z/OS keyring files.
    
    In the WebSphere application server full profile, the keyring
    files are handled exclusively by base security so wssecurity
    doesn't have to ever process them directly.  When the common
    component is used, WS-Security must process them directly.
    
    Some additional code needs to be added to use a different url
    constructor when a keyring file is used.
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:  IBM WebSphere Application Server            *
    *                  developers of WS-Security enabled JAX-WS    *
    *                  web services applications and SAML          *
    ****************************************************************
    * PROBLEM DESCRIPTION: WS-Security common component cannot     *
    *                      use keyring files for SAML token        *
    *                      processing.                             *
    ****************************************************************
    * RECOMMENDATION:  Update the was-wssecurity-*.jar used by     *
    *                  the application with one that includes      *
    *                  this APAR.                                  *
    ****************************************************************
    When an application developer wants to use a private key or
    public certificate when processing a SAML token, they use one
    of the two methods for keystores provided in the
    SAMLTokenFactory:
    newKeyStoreConfig(java.lang.String ksRef)
    newKeyStoreConfig(java.lang.String type,
    java.lang.String path, java.lang.String password)
    If you want to use a keyring file on the application server,
    you configure a managed keystore using the administrative
    console or wsadmin, then use the
    newKeyStoreConfig(java.lang.String ksRef) method.  Keyring
    files cannot be opened using the other method that is
    available.
    Howevever, when the WebSphere WS-Security runtime is not
    running on an Application Server (such as IMS SOAP Gateway),
    managed keystores are not available.  This leaves no mechanism
    for using keyring files when not running on the Application
    Server.
    

Problem conclusion

  • The WebSphere WS-Security runtime is updated to support
    keyring files using the following existing method in
    com.ibm.websphere.wssecurity.wssapi.token.SAMLTokenFactory:
    
    newKeyStoreConfig(java.lang.String type,
      java.lang.String path, java.lang.String password)
    
    Following is an example of creating a new keystore config for
    use with SAML token processing for a keyring file:
    
    newKeyStoreConfig("JCERACFKS",
    "safkeyring://ownerID/RACF_KEYRING_NAME", "password");
    
    JCERACFKS and JCECCARACFKS types are supported.
    
    
    The fix for this APAR is currently targeted for inclusion in
    fix packs 7.0.0.31, 8.0.0.8, and 8.5.5.1.  Please refer to the
    Recommended Updates page for delivery information:
    http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
    

Temporary fix

Comments

APAR Information

  • APAR number

    PM89426

  • Reported component name

    WEBS APP SERV N

  • Reported component ID

    5724H8800

  • Reported release

    850

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2013-05-21

  • Closed date

    2013-07-12

  • Last modified date

    2013-07-12

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    WEBS APP SERV N

  • Fixed component ID

    5724H8800

Applicable component levels

  • R700 PSY

       UP

  • R800 PSY

       UP

  • R850 PSY

       UP



Document information

More support for: WebSphere Application Server
General

Software version: 850

Reference #: PM89426

Modified date: 12 July 2013