PH04135: BEHAVIOR DIFFERENCE IN GETREMOTEUSER() AND GETUSERPRINCIPAL() IN WAS 8.5.5 VS WAS 9.0.0 WHEN JASPIC IS CONFIGURED

9.0.5.0: WebSphere Application Server traditional Version 9.0.5 Refresh Pack
9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3

APAR status

• Closed as program error.

Error description

• When configuring the property below on WAS 9.0.0, it will not
  be honored, when it has worked in the past:
  
  NAME: com.ibm.wsspi.security.web.webAuthReq
  VALUE: persisting
  

Local fix

• N/A
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server who use JASPI (Java Authentication   *
  *                  Service Provider Interface for containers)  *
  *                  authentication provider                     *
  ****************************************************************
  * PROBLEM DESCRIPTION: Authenticated user's Subject is not     *
  *                      set on the thread when unprotected      *
  *                      URL is accessed                         *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When a custom JASPI authentication provider is plugged in,
  authenticated user's Subject was not set on the thread when
  unprotected URL is accessed, even though "Use available
  authentication data when an unprotected URI is accessed"
  setting is enabled.  This causes some of APIs of
  HttpServletRequest,such as getRemoteUser() and
  getUserPrincipal(),return NULL instead of valid user
  Subject.
  In the same scenario above, jaspicSession Cookie
  was not set in the http response. Additionally,
  regardless of the requested URL, uniqueUserId
  from the plugin provider was not honored. This could cause
  authorization error.
  

Problem conclusion

• The bug was fixed.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 9.0.5.0.  Please refer to the Recommended
  Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R900 PSY

     UP