LI79326: API CONNECT: SCHEMA VALIDATION FAILS IF AN AUTHORIZATION HEADER IS PASSED BY THE CLIENT

APIConnect_Management_Essentials-5.0.5.0_20161121-0455_acd0cbcb10b8_a3db3c0.vcrypt2
APIConnect_Management_Essentials-5.0.5.0_20161121-0455_acd0cbcb10b8_a3db3c0.ova
5.0.5.0-APIConnect-Portal-Essentials-20161122-2243.ova
5.0.5.0-APIConnect-Portal-Essentials-20161122-2243

APAR status

• Closed as program error.

Error description

• Using an incoming request header containing an Authorization
  header with a validate policy results in the policy failing.
  
  For example:
  
  1- Create an open API with a JSON validate policy such as:
    validate:
            title: validate
            description: validateJson
            definition: '#/definitions/inputmessage'
  
  2- Add the API to a product and publish it
  3- Execute the command:
  
  curl --request POST \
    -k \
    --url
  https://<host>/<organization>/<catalog>/testjsonvalidation/test\
    --header 'accept: application/json' \
    --header 'content-type: application/json' \
    --header 'x-ibm-client-id: <clien-id>' \
    --header 'Authorization: Bearer <bearer>' \
    --data '{"FirstName":"John","LastName":"Doe"}'
  
  Results in the response:
  
  { "httpCode":"404", "httpMessage":"Invalid",
  "moreInformation":"Validate REST: Unable to retrieve the schema
  required for the REST validation or the schema is not valid:
  Unable to open URL 'var://context/policyschema'" }
  

Local fix

• WORKAROUND:
  
  Remove the token before the  validation in file
  local:///isp/policy/apim.schemavalidate/getSchema.js
  bt addinbg the following line on position 91
  "delete options.headers.Authorization;"
  
    85:           var options = {
    86:                   target : mpgwUrl,
    87:                   method : 'GET',
    88:                   timeout : 60,
    89:                   headers : headers
    90:           };
  **91:           delete options.headers.Authorization;
  =>92:           if (verbose) {
    93:               apim.console.debug(logPrefix+'getSchema.js:
  headers used in urlopen: ' +JSON.stringify(headers));
    94:           }
    95:
    96:           urlopen.open(options,function(error, response) {
  

Problem summary

• The authorization header needed to be removed before the schema
  validation was performed.
  

Problem conclusion

• This issue is resolved in IBM API Connect V5.0.5.0
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels

• R503 PSY

     UP