IJ56810: KERBEROS ILLEGALARGUMENTEXCEPTION: ENCRYPTIONKEY: KEY BYTES CANNOT BE NULL! READING VERSION 4 CREDENTIALS CACHE FILE

APAR status

• Closed as program error.

Error description

• Error Message: Caused by: org.ietf.jgss.GSSException, major
  code: 13, minor code: -1
   major string: Invalid credentials
   minor string: Attempt to obtain new INITIATE
  credentials failed! (null)
  .
  Stack Trace: Exception in thread "main"
  java.lang.IllegalArgumentException: EncryptionKey: Key bytes
  cannot be null!
   at
  com.ibm.security.krb5.EncryptionKey.<init>(EncryptionKey.java:25
  9)
   at
  com.ibm.security.krb5.internal.ccache.a.j(a.java:154)
   at
  com.ibm.security.krb5.internal.ccache.a.q(a.java:39)
   at
  com.ibm.security.krb5.internal.ccache.d.a(d.java:12)
   at
  com.ibm.security.krb5.internal.ccache.e.c(e.java:43)
   at
  com.ibm.security.krb5.internal.ccache.d.a(d.java:26)
  .
  

Local fix

• Use only IBM Java to create and manage the credentials cache
  file.
  

Problem summary

• Loading a version 4 format credentials cache file which contains
  "config entries" data results in an
   java.lang.IllegalArgumentException. Version 4
  format files may contain "Credential cache configuration
  entries" with
   a ticket field that is not (usually) a valid
  encoding of a Kerberos ticket.
   An implementation must not treat the cache file as
  malformed if it cannot decode the ticket field.
   Refer to
  https://web.mit.edu/kerberos/krb5-devel/doc/formats/ccache_file_
  format.html#credential-cache-configuration-entries
   for information on "Credential cache configuration
  entries".
  

Problem conclusion

• A fix is made to IBMJGSS/ibmjgssprovider.jar
   The associated Hursley RTC Problem Report is 153351
   The associated Austin git issue IBMJGSS#142
   JVMs affected: Java 8
   The fix was delivered for Java 8SR8FP60 The affected
  jar is "ibmjgssprovider.jar".
   The build level of this jar for the affected
  releases is "20251119-561"
  
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
  IBM SDK, Java Technology Edition
   8 SR8 FP60 (8.0.8.60)
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For non z/OS operating systems:
   - IBM Semeru Runtimes, Version 11 and later
   https://www.ibm.com/semeru-runtimes/downloads/
   - IBM SDK, Java Technology Edition, Version 8
   https://www.ibm.com/support/pages/java-sdk-downloads/
  - For the z/OS operating system:
   - Java SDK Products on z/OS
   https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  SECURITY

• Fixed component ID

  620700125

Applicable component levels