JR46647: HTTP SESSIONS FOR MULTIPLE APPLICATIONS ARE INVALIDATED WHEN THE HTTP SESSION FOR ONE APPLICATION IS INVALIDATED

Download Version 8.0.1 Fix Pack 2 for the IBM Business Process Manager products

APAR status

• Closed as program error.

Error description

• Multiple Business Process Manager applications can share the
  same HTTP session ID (JESSIONID).  When the HTTP session for
  one application is invalidated, the HTTP sessions for the
  other applications are invalidated.
  
  From the point of view of an end user using a Business Process
  Manager interface such as Process Portal, interdependencies
  between applications in relation to session invalidation can
  lead to continuity issues.  This is a potential cause of a
  "You have been automatically logged out for security
  reasons..." message.
  
  If the WLE.*=all trace is enabled, the following message will
  be written to the trace just before invalidating all HTTP
  sessions that share the same HTTP session ID.
  
  [5/10/13 9:46:37:783 EDT] 00000008 wle_servlet   1
  com.lombardisoftware.core.util.InvalidateSessionListener
  sessionDestroyed Invalidating all sessions on sessionDestroyed
  for user, session ID=GjnvHJKjlK7Q_AL7WrLKrpr"
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  Users of BPM Express, BPM Standard, and     *
  *                  BPM Advanced.                               *
  ****************************************************************
  * PROBLEM DESCRIPTION: HTTP session invalidation for one       *
  *                      Business Process Manager application    *
  *                      leads to HTTP session invalidation      *
  *                      for other Business Process Manager      *
  *                      applications that share the same HTTP   *
  *                      session ID (JESSIONID).                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Logic to link HTTP session invalidation for multiple Business
  Process Manager applications was not necessary based on other
  changes made in Business Process Manager version 8.0.1.
  

Problem conclusion

• HTTP session invalidation listener code was modified so that
  invalidation of an HTTP session for one Business Process
  Manager application will not lead to HTTP session invalidation
  for other applications.
  
  Interim fixes for JR46647 on Business Process Manager versions
  8.0.1.0 and 8.0.1.1 are available from Fix Central.  Fix
  application instructions are also available when obtaining the
  interim fix from Fix Central.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM ADVANCED

• Fixed component ID

  5725C9400

Applicable component levels

• R800 PSY

     UP