IV76524: GSSCREDENTIAL.ADD() FAILS TO ADD SPNEGO CREDENTIAL IN JAVA 8

APAR status

• Closed as program error.

Error description

• Error Message: A GSSException is seen while running the
  SpnegoTokenHelper to add SPNEGO credential to an existing
  GSSCredential by calling GSSCredential.add() in Java 8. This
  same call succeeds in Java 7 and the SPNEGO credential is
  successfully added.
  .
  Stack Trace: java.security.PrivilegedActionException:
  org.ietf.jgss.GSSException, major code: 13, minor code: 0
      major string: Invalid credentials
      minor string: SubjectCredFinder: no JAAS Subject
  .
  

Local fix

Problem summary

• SPNEGO Credential is failed to be created in Java 8 if the
  current Subject is null
  

Problem conclusion

• The behavior difference between Java 7 and Java 8 in creating
  SPNEGO credential is due to the implementation difference. Java
  8 expects there is a Subject existing to proceed to get the
  credential while Java 7 creates the credential directly. The fix
  is to fallback to Java 7 implementation if Java 8 implementation
  fails.
  The associated RTC PR is 96529
  The associated Austin CMVC defect is 116863
  JVMs affected : Java 8.0
  The fix was delivered for Java 8.0 SR2
  The affected jar is "ibmjgssprovider.jar".
  The build level of this jar for the affected releases is
  "20150827"
  .
  This APAR will be fixed in the following Java Releases:
     8    SR2       (8.0.2.0)
  .
  Contact your IBM Product's Service Team for these Service
  Refreshes and Fix Packs.
  For those running stand-alone, information about the available
  Service Refreshes and Fix Packs can be found at:
             https://www.ibm.com/developerworks/java/jdk/
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels

• R270 PSY

     UP