PI57668: Collective member certificate login fails with LDAP or Federated user registry

8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16

APAR status

• Closed as program error.

Error description

• When Collective is configured with LDAP registry, user is
  getting an error. On the Controller side, the
  following error is seen:
  
  com.ibm.ws.logging.internal.impl.IncidentImpl
  FFDC1015I: An FFDC Incident has been created:
  
  "com.ibm.ws.security.registry.RegistryException: CWIML0515E:
  The user registry operation could not be completed.
  
  The=myMember,L=C%3A%2FLibertyRuntime%2Fwlp-nd-runtime-8.5.5.
  8%2F
  w lp%2Fusr ,L=,OU=member,O=38690535-f2c7-41b2-bd50
  -72de615ec868,DC=com.ibm.ws.collective entity is not in the
  scope of the defined realm. Specify an entity that is in the
  scope of the configured realm in the server.xml file.
  
  com.ibm.ws.security.credentials.wscred.internal.WSCredential
  Prov
  ider 137" at ffdc_16.02.16_22.56.23.0.log
  

Local fix

• No work around at this time.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty Profile - Security           *
  ****************************************************************
  * PROBLEM DESCRIPTION: Collective member certificate login     *
  *                      failed with LDAP or Federated user      *
  *                      registry                                *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  After the collective controller successfully authenticates the
  collective member's certificate against the truststore,  the
  code went on to validate the certificate with LDAP or Federated
  user registry which should not happen.   The error usually
  contains "DC=com.ibm.ws.collective entity is not in the scope of
  the defined realm"
  
  -- Error message sample --
  [2/16/16 22:56:23:562 EST] 0000003e
  com.ibm.ws.logging.internal.impl.IncidentImpl                I
  FFDC1015I: An FFDC Incident has been created:
  "com.ibm.ws.security.registry.RegistryException: CWIML0515E: The
  user registry operation could not be completed. The
  CN=myMember,L=C%3A%2FLibertyRuntime%2Fwlp-nd-runtime-
  8.5.5.8%2Fwlp%2Fusr,L=hirokortp.raleigh.ibm.com,OU=member,O=3869
  0535-f2c7-41b2-bd50-72de615ec868,DC=com.ibm.ws.collective entity
  is not in the scope of the defined realm. Specify an entity that
  is in the scope of the configured realm in the server.xml file.
  com.ibm.ws.security.credentials.wscred.internal.WSCredentialProv
  ider 137" at ffdc_16.02.16_22.56.23.0.log
  

Problem conclusion

• The code was fixed to resolve the error.
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 8.5.5.9.  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  LIBERTY PROFILE

• Fixed component ID

  5724J0814

Applicable component levels

• R850 PSY

     UP