IT36622: KERBEROS CONNECTION FAILURE AFTER FIX PACK UPGRADE.

APAR status

• Closed as program error.

Error description

• After a fixpack upgrade (in this case the upgrade was to
  10.0.0.22) , Kerberos connections to IIB/ACE may get rejected
  with BIP3484E. A service trace shows the following exception
  
  
  TomcatInstanceManager.authorizeUserGSS 'stack for exception' ,
  'org.ietf.jgss.GSSException, major code: 11, minor code: 0
  major string: General failure, unspecified at GSSAPI level
  minor string: None
  at com.ibm.security.jgss.mech.spnego.SPNEGOC
  ontext.getSrcName(Unknown Source)
  at
  com.ibm.security.jgss.GSSContextImpl.getSrcName(Unknown Source)
  
  at com.ibm.broker.inlinehttp.tomcatthreadpool.TomcatInstanceMan
  ager.authorizeUserGSS(TomcatInstanceManager.java:5323)
  
  The
  issue is identified as a JAVA defect and fixed under JAVA APAR
  IJ29317
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of App Connect Enterprise V11 and IBM Integration Bus
  V10.0 using Kerberos authentication with webservice flows.
  
  
  Platforms affected:
  z/OS, MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  <span style="background-color:rgb(255, 255, 255)">After upgrade
  to a fixpack containing a java level of 8.0.6.15 or
  later</span><span style="background-color:rgb(255, 255, 255)">,
  Kerberos client connections to web service flows may get
  rejected </span><span style="background-color:rgb(255, 255,
  255)">with BIP3484E. A service trace shows the following
  exception   </span>
  <span style="background-color:rgb(255, 255, 255)">
  
  </span>
  <span style="background-color:rgb(255, 255, 255)">
  
  </span>
  <span style="background-color:rgb(255, 255,
  255)">TomcatInstanceManager.authorizeUserGSS 'stack for
  exception' , </span><span style="background-color:rgb(255, 255,
  255)">'org.ietf.jgss.GSSException, major code: 11, minor code: 0
   </span><span style="background-color:rgb(255, 255, 255)">major
  string: General failure, unspecified at GSSAPI level
  </span><span style="background-color:rgb(255, 255, 255)">minor
  string: None</span>
  <span style="background-color:rgb(255, 255, 255)">at
  com.ibm.security.jgss.mech.spnego.SPNEGOC</span><span
  style="background-color:rgb(255, 255,
  255)">ontext.getSrcName(Unknown Source)
                               </span>
  <span style="background-color:rgb(255, 255, 255)">at
  </span><span style="background-color:rgb(255, 255,
  255)">com.ibm.security.jgss.GSSContextImpl.getSrcName(Unknown
  Source)</span><span style="background-color:rgb(255, 255, 255)">
                                                          </span>
  <span style="background-color:rgb(255, 255, 255)">at
  com.ibm.broker.inlinehttp.tomcatthreadpool.TomcatInstanceMan</sp
  an><span style="background-color:rgb(255, 255,
  255)">ager.authorizeUserGSS(TomcatInstanceManager.java:5323)
       </span>
  <span style="background-color:rgb(255, 255, 255)">
  
  </span>
  <span style="background-color:rgb(255, 255, 255)">The
  </span><span style="background-color:rgb(255, 255, 255)">issue
  is identified as a JAVA defect and fixed under JAVA APAR
  </span><span style="background-color:rgb(255, 255, 255)">IJ29317
                             </span>
  

Problem conclusion

• The Java levels are upgraded to a recent level that includes
  Java APAR <span style="background-color:rgb(255, 255, 255)">
  </span><span style="background-color:rgb(255, 255, 255)">IJ29317
  which fixes the problem.</span>
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v10.0      10.0.0.24
  v11.0      11.0.0.14
  v12.0      12.0.2.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  INTEGRATION BUS

• Fixed component ID

  5724J0540

Applicable component levels