PH17696: ENCRYPTED PASSWORDS DELETED IF CUSTOM ENCRYPTION JAS IS REMOVED.

8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3

APAR status

• Closed as program error.

Error description

• If a custom encryption class is used to encrypt WAS passwords,
  and then the customer encryption class is removed, upon start up
  WebSphere will remove the passwords from the security.xml
  instead of leaving them alone.
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere                  *
  *                  Application Server using custom password    *
  *                  encryption                                  *
  ****************************************************************
  * PROBLEM DESCRIPTION: If the custom encryption JAR is         *
  *                      removed, encrypted passwords might be   *
  *                      removed from security.xml               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Users of WebSphere Application Server can set up custom
  password encryption by providing a class in a JAR file and
  placing it in the <WAS_HOME>/lib/ext directory.
  The encryption works.  When you start the application server,
  the passwords in security.xml are encrypted.
  The problem occurs when you remove the JAR from the lib/ext
  directory, or the JAR somehow becomes inaccessible.  In that
  case, upon server startup the passwords are removed from the
  security.xml.   This makes recovery of passwords rather
  difficult.
  

Problem conclusion

• The code was modified to prevent removal of passwords from
  security.xml when the custom password encryption JAR becomes
  inaccessible.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.5.5.17 and 9.0.5.3.  Please refer to the Recommended
  Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP