JR55266: CANNOT DISABLE ACCESS TO PROCESS INSTANCE VARIABLES IN REST APIS

8.5.6.2-WS-BPM-IFJR55266
bpm.8570.cf2016.06.delta.repository.2of2
bpm.8570.cf2016.06.delta.repository.1of2

APAR status

• Closed as program error.

Error description

• When you work with the REST API or in Process Inspector, you can
  view and update process instance variables if you are either a
  IBM Business Process Manager (BPM) administrator or a member of
  the Portal Admin Team defined on the process application of the
  instance. In addition, each user who may see the process
  instance may see the process instance variables.
  
  However, currently you cannot disable access to process instance
  variables in REST APIs.
  

Local fix

Problem summary

• No additional information is available.
  

Problem conclusion

• A fix that introduces a configuration option to remove access to
  process instance variables in REST APIs is available on request.
  
  To remove the access to process instance variables, edit your
  IBM Process Center and IBM Process Server 100Custom.xml files to
  match the following entry:
  
  <server>
      <portal merge="mergeChildren">
    <authorization-for-process-data-access merge="replace">
      nobody
    </authorization-for-process-data-access>
   </portal>
  </server>
  

Temporary fix

• Not applicable
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM STANDARD

• Fixed component ID

  5725C9500

Applicable component levels

• R856 PSY

     UP