APIML integration - unknown protocol: safkeyring during web services STC startup

Products

• Endevor

Issue/Introduction

Customized apiml.properties file in order to integrate Endevor REST API with the Zowe API Mediation Layer. The minisystem where Endevor instance is running has ACF2 as Security Package,  Zowe server version is 2.7.0.

Endevor Tomcat server.xml SSL is configured using keyring:

<Connector port="29380" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" SSLEnabled="true" algorithm="IbmX509" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="+TLSv1.3,+TLSv1.2,+TLSv1.1,+TLSv1" keystoreType="JCERACFKS" keystoreFile="safkeyring://TCPIP66/tlsKeyring" sslImplementationName="com.ca.sslsocket.CASSLImplementation"/> 

 

Web services stc start up with few error messages. The first one:

08:40:23.709 <main> INFO  (o.z.a.s.HttpsFactory) Loading trust store key ring: safkeyring:////TCPIP66/tlsKeyring
08:40:23.720 <main> ERROR (o.z.a.s.HttpsFactory) error
java.net.MalformedURLException: unknown protocol: safkeyring

And then:

08:40:23.768 <main> ERROR (o.z.a.s.HttpsFactory) ZWEAM400E Error initializing SSL Context: 'unknown protocol: safkeyring'
08:40:23.768 <main> ERROR (c.c.e.c.InitialServiceSetupListener) runtime error while registering to API ML
08:40:23.771 <main> ERROR (c.c.e.c.InitialServiceSetupListener) Error initializing SSL Context: unknown protocol: safkeyring

Endevor PTF LU09458 to is applied to add SAF keyring support.

 

Environment

Release : 19.0

Zowe 2.7

Cause

Server.xml SSL configuration is using Broadcom common services sslimplentation, however, it might not be able to handle the SAF keyring for APIML integration.   

Resolution

Update WSTOMENV and add  "-Djava.protocol.handler.pkgs=com.ibm.crypto.provider"  to existing JVM options:

IJO="$IJO -Djava.protocol.handler.pkgs=com.ibm.crypto.provider"

This will add the IBM SAF keyring support to APIML integration. 

Restart Tomcat after the change.