IC91903: REPLACING EXISTING USERNAME TOKEN IN AAA POLICY CAUSES CONNECTION REQUEST TO FAIL TO BACKEND SERVER

Fix packs for DataPower Service Gateway version 6.0.1
Fix packs for DataPower B2B Appliance version 6.0.1
Fix packs for DataPower Integration Appliance version 6.0.1

APAR status

• Closed as fixed if next.

Error description

• When a username token (UNT) is already present in a request
  message and the AAA PostProcessing step is configured to replace
  the existing UNT, DataPower will replace it by creating an
  entirely new security header.
  
  In the event the existing UNT contained a Timestamp element,
  the Timestamp element would be removed as result of the new
  security header added by DataPower.  This could then cause
  the backend server to fail the request due to the missing
  Timestamp element that it expected.
  
  DataPower should only replace the UNT element and not the entire
  security header.
  

Local fix

• In the AAA PostProcessing step, set "Replace existing username
  token" to Off, to prevent the TimeStamp element from being
  overwritten with a new security header.
  

Problem summary

• Fix will be available in a future major release.
  

Problem conclusion

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

Applicable component levels

• R400 PSN

     UP