JR64717: BUSINESS AUTOMATION WORKFLOW SCIM CALLS FAIL DUE TO INCORRECTLY ENCODED WHITESPACE

21.0.2-WS-CP4BA-IF010
21.0.3-WS-CP4BA-IF007

APAR status

• Closed as program error.

Error description

• When Business Automation Workflow issues calls to the LDAP via
  the IAM SCIM component, requests for entities containing white
  space result in a 400 Bad Request response.
  
  
  For example, you might find an exception stack such as the
  following when issuing a groups sync REST API request:
  
  
  2022-03-11T01:38:57.775+0000] 000000c0 id=00000000
  com.lombardisoftware.userorg.http.JaxRSRestCallHandler      2
  doGet THROW  com.lombardisoftware.core.TeamWorksException: Error
  in GET
  https://icp-management-ingress.ibm-common-services.svc/idmgmt/id
  entity/api/v1/scim/Groups/CN%3DCSP_Platform_Support_Modifier+%28
  AG%29%2COU%3DCSP%2COU%3DApplication%2COU%3DGroups%2CDC%3Ducb%2CD
  C%3Dlan?attributes=displayName:400
       at
  com.lombardisoftware.userorg.http.JaxRSRestCallHandler.doGet(Jax
  RSRestCallHandler.java:472)
       at
  com.lombardisoftware.userorg.http.JaxRSRestCallHandler.doGet(Jax
  RSRestCallHandler.java:429)
       at
  com.lombardisoftware.userorg.scim.utility.SCIMHelper.triggerSCIM
  RoleRequest(SCIMHelper.java:404)
       at
  com.lombardisoftware.userorg.scim.SCIMAppServerUserRegistryGroup
  .getRoleName(SCIMAppServerUserRegistryGroup.java:83)
       at
  com.lombardisoftware.server.core.GroupCore.removeAndLogGroupDupl
  icates(GroupCore.java:1639)
       at
  com.lombardisoftware.server.core.GroupCore.syncGroupMembershipIm
  pl(GroupCore.java:1179)
       at
  com.lombardisoftware.server.core.GroupCore.syncGroupMembership(G
  roupCore.java:1102)
       at
  com.lombardisoftware.server.ejb.security.SecurityCore.syncGroupM
  embershipForGroups(SecurityCore.java:470)
  
  PRODUCTS AFFECTED:
  IBM Cloud Pak for Automation
  

Local fix

Problem summary

• IBM Business Automation Workflow and IBM Business Automation
  Studio in Cloud Pak for Automation consume a SCIM REST API from
  a IBM Cloud Pak foundational services to query user, group and
  membership information.
  Requests can fail for users or groups with whitespace characters
  in their distinguished name, e.g. cn=group1, ou=sales
  department, o=customer.com
  The SCIM API no longer accepts whitespaces encoded as + in URLs,
  but forces clients to use proper URL encoding with %20 in place
  of whitespace.
  
  APAR Products Affected:
  IBM Cloud Pak for Automation
  

Problem conclusion

• The fix ensures the use of % encoding in SCIM request URLs.
  

Temporary fix

• Not applicable
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  CLOUD PAK FOR A

• Fixed component ID

  5737I2300

Applicable component levels