Document algorithm support required for using secmec 8(USRSSSBPWD) and limitation on ibm141 vm.

• Key: DERBY-1867
• Type: Task
• Status: Closed
• Resolution: Fixed
• Priority: Major
• Assignee: Myrna van Lunteren
• Reporter: Sunitha Kambhampati
• Component/s: Documentation
• Affects Version/s: 10.2.1.6, 10.3.1.4
• Fix Version/s: 10.3.1.4

Description

Using secmec8 with ibm141 vms fails with java.security.NoSuchAlgorithmException : SHA1PRNG. This needs to be documented in the server guide.

Please see: http://issues.apache.org/jira/browse/DERBY-1788?page=comments#action_12432124

Comments

[Sunitha Kambhampati]

Problem:
With IBM 1.4.1 JVM, trying to connect to the server using the derby client with security mechanism 8 (USRSSSBPWD) will result in error

Symptoms:
Connecting using the client driver with security mechanism 8 will throw the following error
ERROR XJ112: Security exception encountered, see next exception for details.
The stack trace will show that the problem is caused by java.security.NoSuchAlgorithmException: SHA1PRNG SecureRandom not available

Cause:
Current USRSSBPWD implementation uses SHA1PRNG algorithm to generate random number(seed) that gets exchanged between client and the server. The SHA1PRNG algorithm is not available with the JCE provider that comes with IBM JVM version 1.4.1.

Workaround:
If you need to use the security mechanism 8, then make sure that support for SHA1PRNG is available in the JCE provider that is available with a particular JVM.
For e.g. Use IBM 1.4.2 JVM that has support for SHA1PRNG or the Sun JVMs.

[Sunitha Kambhampati]

Adding release note component. since it is not sure that this issue will get documented in time for the 10.2 release

[Sunitha Kambhampati]

For some reason (possibly related to encoding) , the title wasnt showing up in the jira mails, so attempting to copy/paste the title here.

[Andrew McIntyre]

Marking resolved, release note added to 10.2 release notes with revision 448934.

[Andrew McIntyre]

Reopening and reassigning to 10.3, since release note has been added to 10.2.1.

[Andrew McIntyre]

Unsetting Fix Version on unassigned issues.

[Myrna van Lunteren]

attaching a patch with the comment added in the server guide. Also attaching the html for convenience. If not comments, I'll commit tomorrow.

[Kim Haase]

Looks just fine for the most part, Myrna -- there are extra periods after "1.4.1" and "1.4.2" that you might want to get rid of. Other than that, great!

[Myrna van Lunteren]

Thx Kim, I don't know why I put those extra periods in! but they're gone now; committed with revision: http://svn.apache.org/viewvc?view=rev&revision=543588