PM89884: DYNAMIC SPNEGO CONFIGURATION UPDATES CAN RESULT IN AN EXCESSIVE NUMBER OF LOG ENTRIES INDICATING KERBEROS TOKEN EXPIRATION.

Fixes are available

APAR status

Closed as program error.

Error description

Rational Team Concert (RTC) is running on WebSphere Application
Server with SPNEGO used as Single Sign on (SSO).
Some frames in the RTC application are not rendered at all or
are rendered partially. This results in the application server
continually reauthenticating requests for each frame when
SPNEGO dynamic reloading is enabled.
We have established this issue is caused by the Kerberos token
time-to-live being set to zero. This is occurring when a SPNEGO
config is rebuilt dynamically.
The exception may look like below.
----
[05/05/14 09:31:20:387 CEST] 00000fc9 SubjectHelper <
getKerberosAuthnTokenFromSubject Exit
                                 Subject:
    Principal: userA@IBM.US
    Principal: ldap.ibm.us:389/usera-id
    Public Credential:
com.ibm.ws.security.auth.WSCredentialImpl@9513652c
    Private Credential:
token name:
com.ibm.wsspi.wssecurity.token.krbAuthnToken
version:            1
hashCode:           100416
uniqueId:           usera-id
kerberos principal: usera-id
realm:              IBM.US
expiration:         Mon May 05 09:31:20 CEST 2014
renew until:        null
isReadOnly:         false
isAddressless:      false
isForwardable:      false
isRenewable:        false
KerberosTicket:     Kerberos TGT is null.
GSSCredential:      null
    Private Credential:
com.ibm.ws.security.token.SingleSignonTokenImpl@58b56459
    Private Credential:
com.ibm.ws.security.token.AuthenticationTokenImpl@d249f030
[05/05/14 09:31:20:389 CEST] 00000fc9 ContextManage 3   login
failed:
com.ibm.websphere.security.auth.WSLoginFailedException:
org.ietf.jgss.GSSException, major code: 8, minor code: 0
    major string: Credential expired
    minor string: GSSCredential expired, must login again.
Additional search keywords: outofmemory out of memory

Local fix

Disable SPNEGO dynamic reloading. It should be noted this may
cause issues with other applications.

Problem summary

****************************************************************
* USERS AFFECTED:  All users of IBM WebSphere Application      *
*                  Server                                      *
****************************************************************
* PROBLEM DESCRIPTION: Dynamic SPNEGO configuration updates    *
*                      can result in excessive Kerberos        *
*                      token expiration.                       *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
Dynamic SPNEGO updates result in Kerberos token timeout to
zero. This results in every request requiring a login.
These logins are successful.
In the customers reported RTC environment it caused pages on
the workbench to fail to load, because of RTC behavior.

Problem conclusion

The fix for this APAR is currently targeted for inclusion in
fix pack 8.0.0.8, 8.5.5.1.  Please refer to the Recommended
Updates
page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PM89884
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
800
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2013-05-28
Closed date
2013-07-23
Last modified date
2015-01-26

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R800 PSY
UP
R850 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"8.0","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
12 January 2022

Tips

PM89884: DYNAMIC SPNEGO CONFIGURATION UPDATES CAN RESULT IN AN EXCESSIVE NUMBER OF LOG ENTRIES INDICATING KERBEROS TOKEN EXPIRATION.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R800 PSY

R850 PSY

Document Information

Share your feedback

Need support?