Thursday, May 10, 2007

Inadvertantly disabled user profile (iSeries)

Back in September of 2004, a colleague was developing a Swing application. I wasn't involved much at all but was consulted when problems arouse with my DBConnection class he incorporated into his project for connection management to the AS/400, err ... iSeries machine. The problem arose during the time the user logged into the iSeries database using the JDBC connection. It appeared the process was mysteriously rendering the user profile as expired. Some circles, including the one we consider ourselves to be in, view that behavior as a problem. It was a real mystery and left us scratching our heads.

Consulting IBM, we discovered the problem; it was the way the driver was being registered.

Driver aDriver = (Driver)Class.forName(driver).newInstance();
DriverManager.registerDriver(aDriver);


To me, it seems benign enough; it creates a new driver and then registers the driver object using the DriverManager object. However, IBM explained that using the DriverManager class actually registered the driver a second time resulting in two drivers in the driver manager's list.

As a consequence, when the user/developer was entering an invalid password for an unfortunate second time, it processed the event again with the second driver in the list and so counted that as the third invalid attempt. The user's profile had been established so that it became invalid on the third invalid login attempt.

The remedy was simple enough; comment out the 2nd line.

No comments: