IC96065: AAA POLICY DOES NOT WORK WITH GENERATED LTPA TOKEN

Fix packs for DataPower XML Security Gateway version 6.0
Fix packs for DataPower Integration Appliance version 6.0
Fix packs for DataPower Low Latency Appliance version 6.0
Fix packs for DataPower Service Gateway version 6.0

APAR status

• Closed as program error.

Error description

• An AAA policy does not work with generated LTPA token when
  running 5.0.0.8 while the same policy works when running
  4.0.2.6.
  
  When this fails, a space (e.g.' ') is added to the distinguished
  name(DN) when generating the LTPA token. For example:
  
  <LTPAUserID>cn=9E1744, ou=swsapins, ou=ssa, o=u.s.government,
  c=us</LTPAUserID>
  
  The DN should not have any spaces.  For example:
  <LTPAUserID>cn=9E1744,ou=swsapins,ou=ssa,o=u.s.government,c=us</
  LTPAUserID>
  

Local fix

• As a workaround, apply a simple XPath in the map credentials
  where the XPath points to the 'entry' element. The map
  credential step changes the 'entry' attribute 'type' to 'xpath',
   but still pass along the entry value.
  
  This should prevent the name from being formatted with spaces.
  
  To implement the workaround, go to the AAA policy's ?credential
  mapping? tab:
  
  1) Select ?Apply XPath expression? for the Method.
  2) Enter The following:
  
  /*[local-name()='credentials']/*[local-name()='entry']
  
  for the XPath expression.
  
  Here is an example of how this alters the AAA info:
  
  AU
  
  <credentials
  xmlns:dp="http://www.datapower.com/schemas/management"
  xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"
  >
  
      <entry type="xmlfile">
          <OutputCredential
          xmlns="http://www.datapower.com/AAAInfo"
          >admin</OutputCredential>
      </entry>
  
  </credentials>
  
  MC
  
  <mapped-credentials type="xpath" au-success="true"
  xmlns:dp="http://www.datapower.com/schemas/management"
  xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"
  >
  
      <entry type="xpath">admin</entry>
  
  </mapped-credentials>
  
  In this example, the <OutputCredential> from the AAA info file
  is removed, and it takes the data defined by the element, but
  not the elements themselves, and then adds this data to the
  output of the entry type="xpath".
  

Problem summary

• A user's DN might be formatted with spaces during the generation
   of an LTPA token. The spaces in the DN might cause a valid user
   to be rejected from a WebSphere Application Server.
  

Problem conclusion

• Fix is available in 5.0.0.11 and 6.0.0.3.
  
  For a list of the latest fix packs available, please see:
  http://www-01.ibm.com/support/docview.wss?uid=swg21237631
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DPWR SRV GTWAY

• Fixed component ID

  DP905XG45

Applicable component levels

• R500 PSY

     UP

• R600 PSY

     UP