IBM Support

IV60232: JAAS LOGIN SHOULD TRY TO RETRIEVE SERVER CREDENTIAL FROM KEYTAB WHEN SERVICE NAME IS NULL

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

APAR status

  • Closed as program error.

Error description

  • Error Message: If JAAS login finds that the service name is null
    when it tries to do authentication for the server, it will throw
    an exception which will stop the authentication process and this
    in turn will produce a null server credential object and break
    the whole communication chain.
    .
    Stack Trace: org.ietf.jgss.GSSException, major code: 13, minor
    code: 0major string: Invalid credentialsminor string: Cannot get
    credential from JAAS Subject for principal: default serviceat
    com.ibm.security.jgss.i18n.I18NException.throwGSSException(I18NE
    xception.java:7)at
    com.ibm.security.jgss.mech.krb5.y.b(y.java:68)at
    com.ibm.security.jgss.mech.krb5.y.a(y.java:220)at
    com.ibm.security.jgss.mech.krb5.y.a(y.java:278)at
    com.ibm.security.jgss.mech.krb5.y.<init>(y.java:241)at
    com.ibm.security.jgss.mech.krb5.Krb5MechFactory.getCredentialEle
    ment(Krb5MechFactory.java:19)at
    com.ibm.security.jgss.GSSManagerImpl.createMechCredential(GSSMan
    agerImpl.java:75)at
    com.ibm.security.jgss.mech.spnego.SPNEGOContext.a(SPNEGOContext.
    java:463)at
    com.ibm.security.jgss.mech.spnego.SPNEGOContext.a(SPNEGOContext.
    java:42)at
    com.ibm.security.jgss.mech.spnego.SPNEGOContext.a(SPNEGOContext.
    java:105)at
    com.ibm.security.jgss.mech.spnego.SPNEGOContext.a(SPNEGOContext.
    java:592)at
    com.ibm.security.jgss.mech.spnego.SPNEGOContext.acceptSecContext
    (SPNEGOContext.java:607)at
    com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContext
    Impl.java:232)at
    com.ibm.security.jgss.GSSContextImpl.acceptSecContext(GSSContext
    Impl.java:419)at
    net.sourceforge.spnego.SpnegoAuthenticator.doSpnegoAuth(SpnegoAu
    thenticator.java:444)at
    net.sourceforge.spnego.SpnegoAuthenticator.authenticate(SpnegoAu
    thenticator.java:283)at
    com.lawson.security.authen.LawsonKerberosLoginProcedure.spnegoAu
    thenticate(LawsonKerberosLoginProcedure.java:299)at
    com.lawson.security.authen.LawsonKerberosLoginProcedure.authenti
    cate(LawsonKerberosLoginProcedure.java:141)at
    com.lawson.security.authen.LawsonLoginSchemeImpl.authenticate(La
    wsonLoginSchemeImpl.java:864)at
    com.lawson.security.authen.SSOServiceInteractor.processLoginActi
    on(SSOServiceInteractor.java:1526)at
    com.lawson.security.authen.PrimarySSOServiceInteractor._processR
    equest(PrimarySSOServiceInteractor.java:237)at
    com.lawson.security.authen.SSOServiceInteractor.processRequest(S
    SOServiceInteractor.java:158)at
    com.lawson.security.authen.SSOServlet.process(SSOServlet.java:44
    7)at
    com.lawson.security.authen.SSOServlet.doGet(SSOServlet.java:220)
    at
    javax.servlet.http.HttpServlet.service(HttpServlet.java:575)at
    javax.servlet.http.HttpServlet.service(HttpServlet.java:668)at
    com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWr
    apper.java:1230)at
    com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(Ser
    vletWrapper.java:779)at
    com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(Ser
    vletWrapper.java:478)at
    com.ibm.ws.webcontainer.servlet.ServletWrapperImpl.handleRequest
    (ServletWrapperImpl.java:178)at
    com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters
    (WebAppFilterManager.java:1071)at
    com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleReques
    t(CacheServletWrapper.java:87)at
    com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.
    java:909)at
    com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContai
    ner.java:1662)at
    com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLin
    k.java:200)at
    com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscr
    imination(HttpInboundLink.java:459)at
    com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRe
    quest(HttpInboundLink.java:526)at
    com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequ
    est(HttpInboundLink.java:312)at
    com.ibm.ws.http.channel.inbound.impl.HttpICLReadCallback.complet
    e(HttpICLReadCallback.java:88)at
    com.ibm.ws.ssl.channel.impl.SSLReadServiceContext$SSLReadComplet
    edCallback.complete(SSLReadServiceContext.java:1784)at
    com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureComp
    leted(AioReadCompletionListener.java:175)at
    com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyn
    cFuture.java:217)at
    com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncC
    hannelFuture.java:161)at
    com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)at
    com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)a
    t
    com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHand
    ler.java:775)at
    com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)at
    com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1862)
    .
    

Local fix

Problem summary

  • JAAS login doesn't try to get server credential from keytab if
    service name is null
    

Problem conclusion

  • This APAR will be fixed in the following Java Releases:
       7    SR7 FP1   (7.0.7.1)
       7 R1 SR1 FP1   (7.1.1.1)
    .
    A fix is made to JGSS provider to handle null service name
    properly while doing JAAS loginThe associated Hursley RTC
    Problem Report is 64986The associated Austin  CMVC defect is
    115461JVMs affected : Java 7.0, Java 727 and Java 8.0The fix was
    delivered for Java 7.0 SR7 FP1, Java 7.1 SR1 FP1 and Java 8. The
    affected jar is "ibmjgssprovider.jar". The build level of this j
    ar for the affected releases is "20140430"
    

Temporary fix

Comments

APAR Information

  • APAR number

    IV60232

  • Reported component name

    SECURITY

  • Reported component ID

    620700125

  • Reported release

    260

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2014-05-07

  • Closed date

    2014-05-07

  • Last modified date

    2014-07-16

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    SECURITY

  • Fixed component ID

    620700125

Applicable component levels

  • R260 PSY

       UP



Document information

More support for: Runtimes for Java Technology
Security

Software version: 260

Reference #: IV60232

Modified date: 16 July 2014