PI70467: Z/OS CONNECT API WITH EXPLORER/EMBEDDED SWAGGER USER INTERFACE RESULTS IN SECURITYEXCEPTION WITH CORS PREFLIGHT

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• You are using Basic Authentication, and server.xml with
  requireSec=false, requireAuth=True.  A CICS program is
  exposed as a restful API through zCEE, using the swagger user
  interface embedded in API editor to call this API.  This
  results in:
   java.lang.SecurityException:
   com.ibm.ws.kernel.security.thread.ThreadIdentityException:
   java.util.NoSuchElementException
  
  
  
  
  Additional Symptom(s) Search Keyword(s): KIXREVEAA
  

Local fix

• CICS TS 5.3 tolerates this error with the PTF for PI58375
  applied
  

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: CORS-preflight request causes AJ05      *
  *                      abend due to                            *
  *                      java.lang.SecurityException caused by   *
  *                      java.util.NoSuchElementException.       *
  ****************************************************************
  An API is deployed in z/OS Connect EE running in CICS and a
  CORS-preflight request is received.  Authentication is disabled
  for this type of request, but CICS attempts to retrieve a
  WSCredential.  As the set of WSCredentials is empty a
  java.util.NoSuchElementException occurs, causing a
  com.ibm.ws.kernel.security.thread.ThreadIdentityException which
  causes a java.lang.SecurityException and an AJ05 abend.
  Such a failure is reported in the Swagger UI as "Cross-Origin
  Request Blocked".
  

Problem conclusion

• CICSThreadIdentityServiceImpl.java has been modified to only
  attempt to retrieve a WSCredential if one exists.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI43455

Modules/Macros

• DFJ@H417
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R90D PSY UI43455

     UP16/12/29 P F612

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.