JR55299: AFTER MOVING TO 8.5.6, ASSETS REST API REQUIRES ADMIN RIGHTS TO EXECUTE ON A PROCESS SERVER

bpm.8570.cf2016.06.delta.repository.1of2
bpm.8570.cf2016.06.delta.repository.2of2
8.5.6.2-WS-BPM-IFJR55299

APAR status

• Closed as program error.

Error description

• After moving to 8.5.6, assets REST API requires admin rights to
  execute on a Process Server.
  
  GET /rest/bpm/wle/v1/assets
  
  On Process Center, it returns assets that the user has "read"
  access to as mentioned in the infocenter.
  
  Although on Process Server, this rest command can be executed
  but will not return any results unless the user is a member of
  the tw_admins group. There is not a method for setting read
  access to a process app on the Process Server.
  
  Prior to 856, the API only required an authenicated user for it
  to be used
  

Local fix

• Execute the API with a user that is a member of the "tw_admins"
  group
  

Problem summary

• In an IBM Process Center environment, the process application's
  access control list (ACL) authorization is in place for the
  /rest/bpm/wle/v1/assets REST API. On a runtime IBM Process
  Server environment, the REST API is accessible by members of the
   tw_admin group only.
  
  PRODUCTS AFFECTED
  IBM BPM Advanced
  IBM BPM Standard
  IBM BPM Express
  

Problem conclusion

• A configurable property,
  <enforce-Authorization-Check-For-Ps-Model-Data>, will be
  incorporated into a later IBM BPM release to allow non tw_admin
  users to access the API.
  

Temporary fix

• Invoke the REST API with a user that is part of the tw_admin
  group.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM ADVANCED

• Fixed component ID

  5725C9400

Applicable component levels