RE: HTTP API Error

["Bradley V. Stone" <bvstone@xxxxxxxxxxxx>]

If this is for the SSL *SYSTEM store, directory needs at least *RX
authority, and all files in the dir need at least *R authority.

I have the same info in my FAQ for GETURI at
www.bvstools.com/docs/geturi/faq.html.

The complete path is listed there that needs authority.

I'm making a GETURI request that uses SSL and receiving an authority error
like "Error during initializing SSL. Permission Denied. RC(10) errno(3401)".
What do I need to do to fix this?

This is because the user that is making the request does not have the proper
authorities to the SSL keyring files and/or directory that are located in
the IFS. The keyring files (on most systems) can be found by using the
following command:

WRKLNK '/QIBM/UserData/ICSS/Cert/Server/*'

Bradley V. Stone
BVSTools - www.bvstools.com
eRPG SDK - www.erpgsdk.com

> -----Original Message-----
> From: midrange-l-bounces@xxxxxxxxxxxx
> [mailto:midrange-l-bounces@xxxxxxxxxxxx]On Behalf Of Jon S
> Sent: Tuesday, November 27, 2007 9:27 AM
> To: midrange-l@xxxxxxxxxxxx
> Subject: Re: HTTP API Error
>
>
>
> Scott,
>
> I had a person onsite grant authority for a group profile that
> all of the CSR's were under and I did verify remotely that they
> are setup correctly, but we are still getting the same error. Is
> there a a service or something that needs to be restarted for the
> changes to take effect? Any help is appreciated.
>
> Thanks, Jon> Date: Mon, 19 Nov 2007 15:30:43 -0600> From:
> midrange-l@xxxxxxxxxxxxxxxx> To: midrange-l@xxxxxxxxxxxx>
> Subject: Re: HTTP API Error> > Jon...> > Your question is really
> only tangentially related to HTTPAPI. HTTPAPI > uses i5/OS (or
> OS/400) to do the networking. This includes SSL, which > is
> provided by software called "Global Secure Toolkit" (GSKit for
> short) > that's included with i5/OS.> > The problem is that your
> ordinary users (presumably those without > *ALLOBJ) don't have
> adequate authority to use the *SYSTEM security store.> > Yes,
> it's true that this error surfaced when using HTTPAPI -- but if
> you > had tried to use another SSL application run by an ordinary
> user profile > (for example, running the FTP client in SSL mode)
> you would've had the > same error. It has to do with operating
> system configuration -- not > HTTPAPI itself.> > The README
> member included with HTTPAPI includes instructions on how to >
> grant users access to the *SYSTEM certificate store. However, for
> your > convienience, I'll provide them here as well:> > >
> GRANTING ORDINARY USERS PERMISSION TO RUN SSL APPLICATIONS>
> ------------------------------------------------------------------
> ---> 1) In order to give your users proper permissions to run
> apps> that use HTTPAPI/SSL you should give them access to the>
> *SYSTEM certificate store.> > 2) Open iSeries Navigator (or,
> Operations Navigator)> > 3) Click your iSeries connection, then
> "Users and Groups"> > 4) To grant access to a group profile,
> click "Groups"> To grant access to an individual user, click "All
> Users"> > 5) Choose the user profile that you'd like to grant
> access to,> right click on it, and choose "Properties"> > 6)
> Click the "Capabilities" button.> > 7) Select the "Applications"
> tab> > 8) Pull down the "Access for" list box, and select "host>
> applications"> > 9) Expand the "Digital Certificate Manager" and
> check the> box next to the "*SYSTEM certificate store"> > > > > >
> > Jon S wrote:> > I am using Scott Klement's HTTP API to send
> HTTP posts over the> > internet and when I run it, it works fine.
> When the average users> > tries it they get an error stating
> "gsk_env_init: (GSKit) Access to> > the key database is"> > > >
> It appears to be an authority problem but I am stumped. Any
> ideas?> > > > -- > This is the Midrange Systems Technical
> Discussion (MIDRANGE-L) mailing list> To post a message email:
> MIDRANGE-L@xxxxxxxxxxxx> To subscribe, unsubscribe, or change
> list options,> visit:
http://lists.midrange.com/mailman/listinfo/midrange-l> or email:
MIDRANGE-L-request@xxxxxxxxxxxx> Before posting, please take a moment to
review the archives> at http://archive.midrange.com/midrange-l.>



Share life as it happens with the new Windows Live. Share now!