IT42298: SPECTRUM CONTROL PRIORITISES DOMAIN USER WITHOUT PERMISSIONS OVER LOCAL USER WITH PERMISSIONS

IBM Spectrum Control 5.4.10.1 - Windows Server
IBM Spectrum Control 5.4.10.1 - Linux Server
IBM Spectrum Control 5.4.10.1 - AIX Server
IBM Spectrum Control 5.4.10.1 - Agents

APAR status

• Closed as program error.

Error description

• traceWebServer_errors_0.log
  2022-09-01 15:50:58.517+0530 [Default Executor-thread-62]
  [TPCManagerCreator.checkValidRole] [ERROR] No role found for
  user:  ABC\db2admin groups:  [ABC\Domain Users,
  ABC\Non_Staff_ID_xxxxx]
  2022-09-01 15:50:58.520+0530 [Default Executor-thread-62]
  [RestRequestContextFactory.getTpcUserPrincipal] [ERROR] Error
  recording the first login time
  com.ibm.tpc.internal.api.TPCInternalAPIException: BPCUI0330E
  at com.ibm.tpc.internal.api.TPCManagerCreator.checkValidRole(TP
  CManagerCreator.java:90)
  at com.ibm.tpc.internal.api.TPCManagerCreator.getTPCManager(TPC
  ManagerCreator.java:69)
  at com.ibm.tpc.internal.api.TPCManagerCreator.getTPCManager(TPC
  ManagerCreator.java:39)
  at com.ibm.tpc.gui.rest.RestRequestContextFactory.getSupportSer
  vice(RestRequestContextFactory.java:262)
  at com.ibm.tpc.gui.rest.RestRequestContextFactory.getTpcUserPri
  ncipal(RestRequestContextFactory.java:113)
  at com.ibm.tpc.gui.rest.RestRequestContext.<init>(RestRequestCo
  ntextFactory.java:493)
  
  OSRegistry.log
  Sep 01, 2022 4:16:26 PM
  com.ibm.tpc.authentication.os.OSUserRegistry
  SEVERE: The login failed for the username xxxxxxxxx\db2admin
  Sep 01, 2022 4:16:26 PM
  com.ibm.tpc.authentication.os.OSUserRegistry
  FINE: The login failed for the username xxxxxxxxxxxx\db2admin
  com.ibm.tpc.authentication.os.data.PasswordCheckFailedException:
  The specified domain, xxxxxxxxxx, does not match the domain of
  the server, ABC.
  at com.ibm.tpc.authentication.os.win.WindowsUserAuthenticator.a
  uthenticateDomainUser(WindowsUserAuthenticator.java:128)
  at com.ibm.tpc.authentication.os.win.WindowsUserAuthenticator.c
  heckPassword(WindowsUserAuthenticator.java:204)
  at com.ibm.tpc.authentication.os.OSUserRegistry.checkPassword(O
  SUserRegistry.java:97)
  at com.ibm.ws.security.registry.internal.CustomUserRegistryWrap
  per.checkPassword(CustomUserRegistryWrapper.java:67)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Users who install IBM Spectrum Control on Windows inside a   *
  * domain and the Spectrum Control login user is defined both   *
  * locally and in the domain.                                   *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * In Spectrum Control, to be authenticated and authorized into *
  *                                                              *
  * the Spectrum Control GUI, specifically with the local user,  *
  * <computer_name>\<user_name> must be entered in the login     *
  * dialog.                                                      *
  *                                                              *
  * The "<computer_name>\" prefix is necessary only when there   *
  * are two different users with the same user name: one created *
  *                                                              *
  * locally, and the other in the domain.                        *
  *                                                              *
  * Using <computer_name>\<user_name> eliminates the             *
  * confusion and designates the local account.                  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• The fix for this APAR is targeted for the following release:
  
  IBM Spectrum Control 5.4.10.1   [ 5.4.10.1-IBM-SC ]
  ( release target 2Q 2023 / June  )
  https://www.ibm.com/support/pages/node/359939
  
  The target dates for future releases do not represent a formal
  commitment by IBM. The dates are subject to change without
  notice.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  TPC

• Fixed component ID

  5608TPC00

Applicable component levels