PI57277: SENDING CONCURRENT INVOKE PROCEDURE REQUESTS WHEN USING SESSION INDEPENDENT MODE CAN RESULT A FAILURE IN A REQUEST OR MORE

IBM MobileFirst Platform Foundation Interim Fix README for 7.1

APAR status

• Closed as program error.

Error description

• sending concurrent invoke procedure requests when using session
  independent mode ,
  a number of requests can receive different changes for same
  realm but only the last challenge created will be saved in
  attribute store , this will cause a failure response if the
  realm do not allow wrong answers
  this problem can occur when invoking procedure protected by app
  authenticity or device no provisioning realms
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * End users of application using invoke procedure, running on  *
  * MFP server 7.1 in session independent mode.                  *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * If the application is sending two or more adapter invocation *
  * requests to server working in session independent mode,      *
  * request can arrive to different nodes.                       *
  * As a result, the sever generates different challenges but is *
  * able to save only one challenge in the attribute store. The  *
  * client might send a challenge answer for a challenge that    *
  * was not saved in attribute store, which will cause           *
  * authentication to fail, preventing the client from invoking  *
  * the adapters.                                                *
  * If the realm that failed is the device no provisioning       *
  * realm, the error "received bad token from client" is logged  *
  * by the server.                                               *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * -                                                            *
  ****************************************************************
  

Problem conclusion

• The server now allows the client to respond to no-provisioning
  device authentication challenges and authenticity challenges
  more than once. This allows the client and the server to
  "synchronize", and the challenges can be verified successfully.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  MFPF/WORKLIGHT

• Fixed component ID

  5725I4301

Applicable component levels

• R710 PSY

     UP