PH02955: Unable to use SAF Keyring for collective SSH communication

APAR status

• Closed as program error.

Error description

• A collective controller configured to use a SAF Keyring for
  its collective-wide SSH key may receive a
  java.lang.ClassNotFoundException:
  javax.xml.bind.DatatypeConverter during initialization.
  This class is used in the processing of a Keyring in the
  CollectiveHostAuthInfo configuration.
  
  The following is an example of the configuration using a SAF
  Keyring for Collective-wide SSH:
      <!-- BYO collective-wide SSH Key information. -->
      <collectiveHostAuthInfo
           safKeyring="safkeyring:///MIKE.KEYRING"
           safCertificateLabel="Mike Label768" />
  
  The following is an example of the FFDC captured for this
  failure:
  Stack Dump = java.lang.ClassNotFoundException:
  javax.xml.bind.DatatypeConverter
  	at java.lang.Class.forNameImpl(Native Method)
  	at java.lang.Class.forName(Class.java:278)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveH
  ostAuthInfoImpl.printBase64Binary(CollectiveHostAuthInfoImpl
  .java:1094)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveH
  ostAuthInfoImpl.extractSAFSSHKeyPair(CollectiveHostAuthInfoI
  mpl.java:1057)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveH
  ostAuthInfoImpl.validateKeyAccess(CollectiveHostAuthInfoImpl
  .java:384)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveH
  ostAuthInfoImpl.processCollectiveHostAuthConfig(CollectiveHo
  stAuthInfoImpl.java:249)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveH
  ostAuthInfoImpl.activate(CollectiveHostAuthInfoImpl.java:178
  )
  ...
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty for z/OS                     *
  ****************************************************************
  * PROBLEM DESCRIPTION: Unable to use SAF Keyring for           *
  *                      collective SSH communication            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  A collective controller configured to use a SAF Keyring for its
  collective-wide SSH key will be unable to communicate with other
  servers in the collective.  A java.lang.ClassNotFoundException:
  javax.xml.bind.DatatypeConverter will be seen during
  initialization.  This class is used in the processing of a
  Keyring in the CollectiveHostAuthInfo configuration.
  
  The following is an example of the configuration using a SAF
  Keyring for Collective-wide SSH:
      <!-- BYO collective-wide SSH Key information. -->
      <collectiveHostAuthInfo
           safKeyring="safkeyring:///MIKE.KEYRING"
           safCertificateLabel="Mike Label768" />
  
  The following is an example of the FFDC captured for this
  failure:
  Stack Dump = java.lang.ClassNotFoundException:
  javax.xml.bind.DatatypeConverter
  	at java.lang.Class.forNameImpl(Native Method)
  	at java.lang.Class.forName(Class.java:278)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveHostA
  uthInfoImpl.printBase64Binary(CollectiveHostAuthInfoImpl.java:10
  94)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveHostA
  uthInfoImpl.extractSAFSSHKeyPair(CollectiveHostAuthInfoImpl.java
  :1057)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveHostA
  uthInfoImpl.validateKeyAccess(CollectiveHostAuthInfoImpl.java:38
  4)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveHostA
  uthInfoImpl.processCollectiveHostAuthConfig(CollectiveHostAuthIn
  foImpl.java:249)
  	at
  com.ibm.ws.collective.controller.config.internal.CollectiveHostA
  uthInfoImpl.activate(CollectiveHostAuthInfoImpl.java:178)
  ...
  

Problem conclusion

• Code was modified to successfully find the
  javax.xml.bind.DatatypeConverter class on z/OS.
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 18.0.0.4.  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  LIBERTY PROF -

• Fixed component ID

  5655W6514

Applicable component levels

• RCD0 PSY

     UP