Most Popular Posts

Showing posts with label java. Show all posts
Showing posts with label java. Show all posts

16/08/2016

FIPS Compliance-Part II. IBMJCEFIPS not found for IBMSecureRandom

TL;DR

Add the following lines to the java.security ([java_homedir]/jre/lib/security/java.security) file:

security.provider.1=com.ibm.securerandom.provider.IBMSecureRandom
security.provider.2=com.ibm.crypto.provider.IBMJCE

Explanation of the issue:

After enabling the FIPS compliance you might encounter the following errors in the log file once you try to restart the Application server:

IBMJCEFIPS not found for IBMSecureRandom




Log details:

com.ibm.websphere.ssl.JSSEHelper.getSSLContext 704
com.ibm.ws.security.orbssl.WSSSLServerSocketFactoryImpl.createSSLServerSocket 459
com.ibm.ws.orbimpl.transport.WSTransport.createServerSocket 1439
com.ibm.ws.orbimpl.transport.WSTransport createServerSocket P=312105:O=0:CT ORBX0390E: Cannot create listener thread.
Exception=[ org.omg.CORBA.INTERNAL: CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_SERVER_SOCKET,
Exception=com.ibm.websphere.ssl.SSLException:
java.lang.RuntimeException: Provider IBMJCEFIPS not found for IBMSecureRandom
vmcid: 0x49421000 minor code: 77 completed: No - received while attempting to open server socket on port 1072 ].
com.ibm.ws.orbimpl.transport.WSTransport.startListening 805
com.ibm.ws.orbimpl.transport.WSTransport.createListener 724


The easiest way to fix it is by adding the missing IBM SecureRandom provider into the list before the IBM JCE provider inside the java.security ([java_homedir]/jre/lib/security/java.security):

security.provider.1=com.ibm.securerandom.provider.IBMSecureRandom
security.provider.2=com.ibm.crypto.provider.IBMJCE



15/08/2016

FIPS Compliance-Part I. How to enable the FIPS



How to Enable the FIPS in WebSphere Application Server?

Login to the web console (http[s]://[hostname]:port/ibm/console) and navigate to:

  1. Security > SSL certificate and key management.
  2. Go to Manage FIPS
  3. Select the check box to Use the United States Federal Information Processing Standard (FIPS 140-2) algorithms
  4. Click Apply.
  5. Save the configuration changes.

Next, set the environment variable to restrict the IBMJSSE2 provider to FIPS-compliant algorithms:

  1. Servers > Application servers, and choose your application server
  2. In the 'Configuration' tab, select the Server Infrastructure field
  3. Click on the Java and Process Management > Process Definition
  4. In the Additional Properties field, click Java Virtual Machine
  5. Inside the Generic JVM Arguments field add the value: -Dcom.ibm.jsse2.usefipsprovider=true
  6. Or, add the -Dcom.ibm.jsse2.usefipsprovider=true property to the jvm.options file
How to enable fips 140-2 in Websphere Application Server


04/07/2016

CurrentFunctionPath - resolving function and stored procedure references

Whenever you are getting the error for trying to access particular function via stored procedure, and you get the error, most probably the CurrentFunctionPath does not include the valid (or contains not enough) schema names.

The CurrentFunctionPath is a property, and can contain one or more schema names, separated by commas and enclosed in double quotation marks. Also, the order of the defined schemas determines the orders in which the function and procedure names are resolved.

The default value is the default CURRENT PATH (or CURRENT_PATH) special register setting at the database server.