PI83656: SLO BASED ON CUSTOMCAMLOGOUTURL MAY FAIL DUE TO A RACE CONDITIONWHICH INCURS A SECURITY ISSUE (SESSION NOT PROPERLY ENDED)

APAR status

• Closed as program error.

Error description

• In environments where some outer security is used to SSO into
  TM1Web->mode 5 -> CAM the use of SLO via CustomCAMLogoutURL can
  suffer from a race condition which prevents the outer session
  not to be ended in time, thus SLO failing. A different user can
  thereby gain access to another user's CAM/TM1Web session.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All Users                                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to Planning Analytics Release 2.0.5 or later         *
  ****************************************************************
  

Problem conclusion

• Code Fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• UNKNOWN
  

Fix information

• Fixed component name

  TM1 SERVER

• Fixed component ID

  5724W49SE

Applicable component levels