IT31112: SECURITYPROFILE WITH STATIC ID DOESNT WORK FOR OUTBOUND IWA.

APAR status

• Closed as program error.

Error description

• A SecurityProfile with STATIC ID can be used to provide
  credentials to outbound requests. However, it doesn't work when
  used for integrated windows authentication (IWA) on
  HTTPRequest/SOAPRequest nodes. This is as a result of a failure
  to use the correct domain value while requesting IWA tokens .
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  <span style="background-color:rgb(255, 255, 255)">All users of
  IBM Integration Bus V10.0 and IBM App Connect Enterprise V11.0
  with  SecurityProfile configured for STATIC ID
  propagation.</span>
  
  
  Platforms affected:
  z/OS, MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  <span style="background-color:rgb(255, 255, 255)">A
  SecurityProfile with STATIC ID can be used to provide
  </span><span style="background-color:rgb(255, 255,
  255)">credentials to outbound requests. However, it won't work
  when </span><span style="background-color:rgb(255, 255,
  255)">used for integrated windows authentication (IWA) like
  kerberos authentication on  </span><span
  style="background-color:rgb(255, 255,
  255)">HTTPRequest/SOAPRequest nodes. </span>
  
  More details on providing credentials using STATIC ID can be
  found in
  https://www.ibm.com/support/knowledgecenter/en/SSMKHH_10.0.0/com
  .ibm.etools.mft.doc/ap04160_.html
  <span style="background-color:rgb(255, 255, 255)">
  It is seen to be using an incorrect </span><span
  style="background-color:rgb(255, 255, 255)">domain value while
  requesting IWA tokens causing failure.</span>
  <span style="background-color:rgb(255, 255, 255)">
                                                </span>
  

Problem conclusion

• The product has been modified to use correct domain value when
  requesting IWA/kerberos tokens. A user can set the static
  credentials of the following form to include the domain name.
  
  <span style="background-color:rgb(255, 255, 255);color:rgb(22,
  50,
  92);font-family:salesforcesans-regular,arial,sans-serif">mqsiset
  dbparms IBNODE -n SECID -u <domain>\<userid> -p
  <password></span>
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v10.0      10.0.0.20
  v11.0      11.0.0.8
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  INTEGRATION BUS

• Fixed component ID

  5724J0540

Applicable component levels