IT44096: LDAP USERS CANNOT LOGIN AFTER IBM STORAGE PROTECT PLUS UPDATE TO VERSION 10.1.15

APAR status

• Closed as program error.

Error description

• Starting with version 10.1.15, any login attempt to the
  IBM Storage Protect Plus GUI with a LDAP user fails with the
  message :
  ?An error has occurred. See logs for more information.
  
  The superuser and any other user created within the GUI are not
  affected and can login.
  
  In the virgo log, the message seen will be :
  
  ERROR .. com.catalogic.ecx.mfa.totp.domain.error.
           UserNotFoundException: null
     at com.catalogic.ecx.mfa.totp.domain.error.
        UserNotFoundException.forUsername(UserNotFoundException.
        java:28)
     at com.catalogic.ecx.mfa.totp.service.defaults.ops.
        DefaultTotpLoginOperations.lambda$authenticate$0
        (DefaultTotpLoginOperations.java:28)
     at java.util.Optional.orElseThrow(Optional.java:290)
     at com.catalogic.ecx.mfa.totp.service.defaults.ops.
        DefaultTotpLoginOperations.authenticate
        (DefaultTotpLoginOperations.java:28)
     at ...
  ERROR .. com.catalogic.ecx.mfa.totp.domain.error.
           UserNotFoundException: An error has occurred.
           See logs for more information.
  
  |MDVREGR 10.1.14.1 5737SPLUS|
  
  IBM Storage Protect Plus Versions Affected:
  IBM Storage Protect Plus 10.1.15 and later
  
  Additional Keywords: SPP, SPPLUS, TS013477625
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Spectrum Protect Plus level 10.1.15.                     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply the fixing level when available. This problem is fixed *
  * in IBM Spectrum Protect Plus levels 10.1.15.1 and 10.1.16.   *
  * Note that this is subject to change at the discretion of     *
  * IBM.                                                         *
  ****************************************************************
  

Problem conclusion

• The introduction of Multifactor Authentication (MFA) in IBM
  Spectrum Protect Plus 10.1.15 introduced a regression in the
  LDAP login code that prohibits a user from logging in as an LDAP
  user. This regression has been resolved in IBM Spectrum Protect
  Plus 10.1.15.1. and 10.1.16.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• Platform
  

Fix information

• Fixed component name

  SP PLUS

• Fixed component ID

  5737SPLUS

Applicable component levels