PH40124: THE LDAPLOGINGROUPFILTER SETTING IS NOT HONORED WHEN A GROUP SEARCHES FOR A GROUP

APAR status

• Closed as program error.

Error description

• The ldapLoginGroupFilter setting can be configured so that a
  group search uses this filter instead of the default (for a
  Federated Repository), and while this works when a user's groups
  are looked up, if a nested search of a group is performed (to
  find its groups perhaps), this nested search does not use the
  ldapLoginGroupFilter.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server using LDAP in a Federated Repository *
  *                  configured with the ldapLoginGroupFilter    *
  *                  setting.                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION: The ldapLoginGroupFilter setting does   *
  *                      not                                     *
  *                      work with a nested group search.        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The ldapLoginGroupFilter setting can be configured so that a
  group search uses this filter instead of the default (for a
  Federated Repository), and while this works when a user's
  groups
  are looked up, if a nested search of a group is performed (to
  find its groups perhaps), this nested search does not use the
  ldapLoginGroupFilter.
  

Problem conclusion

• The ldapLoginGroupFilter setting was fixed to work with a nested
  group search.
  
  The fix for this APAR is targeted for inclusion in fix pack
  9.0.5.11 and 8.5.5.22. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels