New JSSE support may require permission for new RACF profiles


java.lang.reflect.InvocationTargetException
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:79)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:618)
at com.ibm.ws.bootstrap.WSLauncher.main(WSLauncher.java:263)
Caused by: java.lang.RuntimeException: Hardware error from call CSNBRNG returnCode 8reasonCode 16000
at com.ibm.crypto.hdwrCCA.provider.SecureRandom.engineNextBytes(SecureRandom.java:97)
at java.security.SecureRandom.nextBytes(SecureRandom.java:433)
at java.security.SecureRandom.next(SecureRandom.java:455)
at java.util.Random.nextLong(Random.java:293)
at java.io.File.generateFile(File.java:1357)
at java.io.File.createTempFile(File.java:1466)
at java.io.File.createTempFile(File.java:1503)
at com.ibm.ws.console.plugin.core.HelpExtensionProcessor.generatePluginFromFragment(HelpExtensionProcessor.java:164)
...done running iscdeploy -restore

In the above message, the reason code 16000 means:
RACF failed your request to use this service.
User action: Contact your ICSF or RACF administrator if you need this service.

There is also this RACF error present:

ICH408I USER(DMGR ) GROUP(xxxxx ) NAME(WAS DMGR CR )
CSFRNGL CL(CSFSERV )
INSUFFICIENT ACCESS AUTHORITY
FROM * (G)
ACCESS INTENT(READ ) ACCESS ALLOWED(NONE )


Java 5 SR9 and Java 6 SR3 shipped new feature in the IBMJCECCA provider where if the CSNBRNGL service is available from ICSF, the RNGL service will be called. This was done to improve performance since the RNGL service is able to generate more random bytes at one time then the older CSNBRNG service.

With that, new RACF profiles may need to have permission added in order for the IBMJCECCA provider to work. You can add a generic profile using the following RACF commands:

SETROPTS RACLIST(CSFSERV) GENERIC(CSFSERV)
RDEFINE CSFSERV CSF* UACC(NONE)
PERMIT CSF* CLASS(CSFSERV) ID(xyz PUBLIC) ACCESS(READ)
SETROPTS CLASSACT(CSFSERV)
SETROPTS RACLIST(CSFSERV) GENERIC(CSFSERV) REFRESH

If you do not want to use wildcards and would rather give permission to individual profiles only, review this list of RACF profiles provided in the table under the following link:

http://www.ibm.com/servers/eserver/zseries/software/java/products/j6jcecca.html