IJ49368: WSINVOKEDL FUNCTION DOES NOT ALWAYS LOAD DEFAULT TRUST STORE

APAR status

• Closed as program error.

Error description

• Web Services policy calling a web service over HTTPS fails when
  running below line
  "WSInvokeDLResult = WSInvokeDL(WSService, WSEndPoint, WSMethod,
  WSParams);"
  
  [PolicyLogger][webServicePolicy][pool-5-thread-32]Caused by:
  com.micromuse.common.parser.PolicyException: Unhandled
  Exception: unable to find valid certification path to requested
  target in policy: webServicePolicy
  

Local fix

• Set the WSInvokeDL function parameter callProps in the web
  services policy
  
  
  Create the following property in the web service policy:
  
  callProps = NewObject();
  
  and use the updated version of WSInvokeDL function including
  this property
  
  WSInvokeDLResult = WSInvokeDL(WSService, WSEndPoint, WSMethod,
  WSParams, callProps);
  
  
  
  or
  
  
  Add the key/trust store location parameters in jvm.options
  ($IMPACT_HOME/wlp/usr/servers/NCI/jvm.options
  -Djavax.net.ssl.keyStore=/opt/IBM/tivoli/impact/wlp/usr/servers
  /NCI/resources/security/key.jks
  -Djavax.net.ssl.keyStorePassword=PASSWORD
  -Djavax.net.ssl.trustStore=/opt/IBM/tivoli/impact/wlp/usr/serve
  rs/NCI/resources/security/trust.jks
  -Djavax.net.ssl.trustStorePassword=PASSWORD
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Impact Users                                                 *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * The WSInvokeDL users see certificate problems when using SSL *
  * endpoints.                                                   *
  * Example error:                                               *
  * HTTP transport error: javax.net.ssl.SSLHandshakeException:   *
  * com.ibm.jsse2.util.j: PKIX path building failed:             *
  * com.ibm.security.cert.IBMCertPathBuilderException: unable to *
  * find valid certification path to requested target            *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The WSInvokeDL function doesn't load  the Impact trust store
  (/opt/IBM/tivoli/impact/wlp/usr/servers/NCI/resources/security/t
  rust.jks) for SSL connections if the CallProps argument isn't
  defined.
  

Problem conclusion

• The fix for this APAR is contained in the following maintenance
  packages:
  |Fix Pack | 7.1.0-TIV-NCI-FP0033 |
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• UNKNOWN
  

Fix information

• Fixed component name

  NETCOOL/IMPACT

• Fixed component ID

  5724O59IS

Applicable component levels