Operating Systems: i5/OS
             Personalize the table of contents and search results

 

Security enablement followed by errors

 

Use this information if you are experiencing errors after security is enabled. What kind of error are you seeing?

For general tips on diagnosing and resolving security-related problems, see the topic Troubleshooting the security component. IBM Support has documents and tools that can save you time gathering information needed to resolve problems as described in Troubleshooting help from IBM. Before opening a problem report, see the Support page:

 

Authentication error accessing a Web page

Possible causes for authentication errors include:

If the user registry configuration, user ID, and password appear correct, use the WebSphere Application Server trace to determine the cause of the problem. To enable security trace, use the com.ibm.ws.security.*=all=enabled trace specification.

 

Authorization error accessing a Web page

If a user who is supposed to have access to a resource does not, a configuration step is probably missing. Review Authorizing access to administrative roles. Specifically:

If the user is granted required roles, but still fails to access the secured resources, enable security trace, using com.ibm.ws.security.*=all=enabled as the trace specification. Collect trace information for further resolution.

 

Authentication fails when code pages differ between the client and the server

When a client uses a code page that is different from the server, and non-US-ASCII characters are used for the user ID and password during basic authentication, the login does not succeed. The HTTP header does not include the encoding method information that is necessary to translate the encoded data, so the server does not know how to decode the information correctly. Use a login form that relies on POST parameters, which are in the HTML body text. The encoding for the text is sent by the browser and so is capable of being decoded properly.

Note: Web services customers are not able to use form login to resolve this problem. Users must ensure there is consistency in the code pages between the client and the server.

 

Error Message: CWSCJ0314E: Current Java 2 security policy reported a potential violation on server

If you find errors on your server similar to: 

Error Message: CWSCJ0314E: Current Java 2 Security policy reported a potential violation of 
Java 2 Security Permission. Please refer to Problem Determination Guide for further information.
{0}Permission/:{1}Code/:{2}{3}Stack Trace/:{4}Code Base Location/:{5}
The Java security manager checkPermission method has reported a SecurityException exception .

The reported exception might be critical to the secure system. Turn on security trace to determine the potential code that might have violated the security policy. Once the violating code is determined, verify if the attempted operation is permitted with respect to Java 2 Security, by examining all applicable Java 2 security policy files and the application code. A more detailed report is enabled by either configuring RAS trace into debug mode, or specifying a Java property.

For a review of Java security policies, see the Java 2 Security documentation at http://java.sun.com/j2se/1.3/docs/guide/security/index.html. Tip: If the application is running with a Java Mail application programming interface (API), this message might be benign. You can update the installed Enterprise Application root/META-INF/was.policy file to grant the following permissions to the application:

 

Error message: CWMSG0508E: The JMS Server security service was unable to authenticate user ID:" error displayed in SystemOut.log when starting an application server

This error can result from installing the Java Message Service (JMS) API sample and then enabling security. You can follow the instructions in the Configure and Run page of the corresponding JMS sample documentation to configure the sample to work with WebSphere Application Server security.

You can verify the installation of the message-driven bean sample by launching the installation program, selecting Custom, and browsing the components which are already installed in the Select the features you like to install panel. The JMS sample is shown as Message-Driven Bean Sample, under Embedded Messaging.

You can also verify this installation by using the administrative console to open the properties of the application server that contains the samples. Select MDBSamples and click uninstall.

 

Error message: CWSCJ0237E: One or more vital LTPAServerObject configuration attributes are null or not available after enabling security and starting the application server

This error message can result from selecting Lightweight Third Party Authentication (LTPA) as the authentication mechanism, but not generating the LTPA keys. The LTPA keys encrypt the LTPA token. To resolve this problem:

  1. Click Security > Secure administration, applications and infrastructure> Authentication > Authentication mechanisms and expiration> LTPA

  2. Enter a password, which can be anything.

  3. Enter the same password in Confirm Password.

  4. Click Apply.

  5. Click Generate Keys.

  6. Click Save.

 

The AccessControlException exception, is reported in the SystemOut.log

The problem is related to the Java 2 security feature of WebSphere Application Server, the API-level security framework that is implemented in WebSphere Application Server. An exception similar to the following example displays. The error message and number can vary. 

CWSRV0020E: [Servlet Error]-[validator]: Failed to load servlet: 
java.security.AccessControlException: access denied  
(java.io.FilePermission 


app_server_root/systemApps/isclite.ear/isclite.war/WEB-INF/validation.xml read)

For an explanation of Java 2 security, how and why to enable or disable it, how it relates to policy files, and how to edit policy files, see the Java 2 security topic in the information center navigation. The topic explains that Java 2 security is not only used by this product, but developers can also implement it for their business applications. Administrators might need to involve developers, if this exception is created when a client tries to access a resource that is hosted by WebSphere Application Server. Possible causes of these errors include:

To resolve these problems:

Tip: If the application is running with the Java Mail API, you can update the installed Enterprise Application root/META-INF/was.policy file to grant the following permissions to the application:

 

Error Message: CWSCJ0336E: Authentication failed for user {0} because of the following exception {1}

This error message results if the user ID that is indicated is not found in the Lightweight Directory Access Protocol (LDAP) user registry. To resolve this problem:

  1. Verify that your user ID and password are correct.

  2. Verify that the user ID exists in the registry.

  3. Verify that the base distinguished name (DN) is correct.

  4. Verify that the user filter is correct.

  5. Verify that the bind DN and the password for the bind DN are correct. If the bind DN and password are not specified, add the missing information and retry.

  6. Verify that the host name and LDAP type are correct.

Consult with the administrator of the user registry if the problem persists.

 

Error Message: SECJ0352E: Could not get the users matching the pattern {0} because of the following exception {1}

This authentication failure message displays when an external user account repository is corrupted or unavailable, and WebSphere Application Server is unable to authenticate the user name in the repository. Generally, authentication error messages are followed by additional information that indicates the nature or root cause of the problem, such as: 

Make sure the users matching the pattern exist in the registry. Contact your service representative if the problem persists.
This additional information might not provide a clear user action if the user account repository is corrupted or the user loses connectivity between WebSphere Application Server and an external user account repository. The external user account repository, which is referred to as a repository in this document, might be a Lightweight Directory Access Protocol (LDAP) product. To resolve this problem, you might need to re-install the repository and verify that it installs successfully by testing the connection. CAUTION:Proceed with the following steps only if you have ensured that all WebSphere Application Server-related configuration settings are accurate. Complete the following steps to resolve the issue:

  1. Restart both the repository and WebSphere Application Server.

  2. Test the connection to the repository. If the connection attempt still fails, it might be necessary to re-install the repository.

  3. If diagnostics are provided with the repository, run them to avoid having to re-install the repository. Attention: If the previous steps do not fix the problem, you might need to re-install the repository. Before proceeding, generate a complete list of all the configured users and groups; you will need to re-populate these fields after the re-installation.

  4. If necessary, re-install the corrupted repository.

  5. Populate the users and groups from your list into the newly installed repository.

  6. Restart both the repository and WebSphere Application server.

  7. In the administrative console, navigate to Security > Secure administration, applications, and infrastructure, and select the appropriate user account repository. For example, select Standalone LDAP registry if you are using a standalone Lightweight Directory Access Protocol repository.

  8. Click Test connection to ensure that WebSphere Application Server can connect to the repository.

 

Generate keys error when using the Profile Management tool to create a new profile

When you create a new profile using either the Profile Management tool or the command-line manageprofiles utility, an error message displays that indicates either partial success or failure. The error message, which is located in the install_dir/logs/manageprofiles/profile_name_create.log file, might point to an error in either the generateKeysforSingleProfile task or the generateKeysForCellProfile task.

The Profile Creation tool and the manageprofiles utility invoke several tasks. The generateKeysForSingleProfile task is invoked when you create a stand-alone application server or a deployment manager profile. The generateKeysForCellProfile task is invoked when you create a cell profile. Both of these tasks are the first tasks to invoke the wsadmin commands. Although the log indicates an error in one of these tasks, the error might actually result from a wsadmin command failure and not an error in the security tasks.

To determine the actual cause of the problem, review the information that is provided in the following log files:



 

Related concepts


Troubleshooting and support

 

Related tasks


Troubleshooting security configurations

 

Related Reference


Access problems after enabling security

 

Reference topic