PH48168: AH01617: AUTHENTICATION FAILURE : PASSWORD MISMATCH WHEN PASSPHRASE INCLUDES A FORWARD SLASH '/'

APAR status

• Closed as program error.

Error description

• If a user has a passphrase that includes a forward slash
  character - '/' - then authentications via SAF and the
  mod_authnz_saf module fail with the following error message in
  the IHS error_log:
  
  [client n.nnn.nn.nnnn:pppp] AH01617: user
  xxxx: authentication failure for "/sss": Password Mismatch
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM HTTP Server on z/OS with   *
  *                  SAF                                         *
  *                  authentication                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: Passwords with a forward slash are      *
  *                      rejected by mod_authnz_saf              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Passwords with a forward slash are rejected by mod_authnz_saf.
  They are mistaken for password change requests.
  

Problem conclusion

• The code was updated to properly detect when a password change
  was requested when returning the final result, i.e. only when
  there are two slashes with repeated new passwords.
  
  The fix for this APAR is targeted for inclusion in IBM HTTP
  Server fix packs 8.5.5.23 and 9.0.5.14. For more information, se
  'Recommended Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WAS IHS ZOS

• Fixed component ID

  5655I3510

Applicable component levels