IT44836: INBOUND INTEGRATED WINDOWS AUTHENTICATION CAN CACHE EXCESSIVE AUTHORIZATION TOKENS

APAR status

• Closed as program error.

Error description

• By default when using Integrated Windows Authentication to
  secure inbound WebServices authentication tokens are cached for
  the validity of the kerberos ticket, which may be several hours.
   If clients frequently reconnect this can lead to an excessive
  number of tokens being held in an active state and this can
  cause high CPU usage in the Microsoft lsass.exe process.
  
  Additionally the Persistent-Auth header is not sent on the first
  successful response to the service so clients may not be aware
  that they do not need to send the authentication token on
  subsequent requests for the already authorised TCP/IP
  connection.
  
  Further even if a client does not send a duplicate auth header
  the connection was not treated as authenticated by the SOAP
  Input Node leading to every request needing to go through an IWA
  challenge response cycle.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All Users of IBM App Connect Enterprise v12 and v13 using IWA
  authentication.
  
  
  Platforms affected:
  WinX64
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  IBM App Connect Enterprise caches IWA/Kerberos token handles per
  connection and releases them only when tokens expire, causing
  large numbers of active tokens when clients frequently
  reconnect. This leads to high CPU usage in lsass.exe.
  Additionally, ACE does not send the Persistent-Auth header on
  the first successful response, and the SOAP Input Node does not
  treat subsequent requests as authenticated. As a result, clients
  repeatedly perform full IWA authentication cycles, further
  increasing system load.
  

Problem conclusion

• The product has been modified to add a new configurable property
  IWATimeToLive in server.conf.yaml. Setting the IWATimeToLive
  property to an integer value defines the maximum duration, in
  seconds, that an IWA authentication entry can remain cached from
  the moment the connection is established. Once this lifetime is
  exceeded, the entry will be removed the next time the cache is
  checked for expired items.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version   Maintenance Level
  v12.0      12.0.12.24
  v13.0      13.0.3.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0560

Applicable component levels