LI83139: UPGRADING WITH INVALID OAUTH API WITH SECURITY DEFINITION FAILS UPGRADE

APAR status

• Closed as program error.

Error description

• Upgrading with invalid oauth API with security definition fails
  upgrade
  
  Example:
    10.0.7.0-5560   10.0.5.5-6227        API Connect cluster
  upgrade in progress - see status conditions for details   659d
  
  API Connect operator pod starts failing with this log error
  
  NAMESPACE                                          NAME
                                                       READY   STA
  
  openshift-operators                                ibm-apiconne
  ct-648ff4cfc-7dxxw                                   0/1     Cra
  
  ] error validating oai doc with extension:
  {"status":400,"message":["The OAuth provider contains an OpenAPI
  definition with validation errors."],"errors":["The value of
  'name' property in the security definition 'clientIdHeader' for
  a 'type' property with value 'header' must be either
  'X-IBM-Client-Id' or 'X-IBM-Client-Secret' if 'x-key-type' is
  not used."]}
  bhendi:error [00000000-0000-0000-0000-000000000000] Error in
  PATCH patch:/api/orgs/:org/oauth-providers/:oauthprovider
  (oauth_provider.js:update)
   - status : 400
   - message: The OAuth provider contains an OpenAPI definition
  with validation errors.
   - stack  : Error: The OAuth provider contains an OpenAPI
  definition with validation errors.
   - errors : The value of 'name' property in the security
  definition 'clientIdHeader' for a 'type' property with value
  'header' must be either 'X-IBM-Client-Id' or
  'X-IBM-Client-Secret' if 'x-key-type' is not used.:
  {"status":400,"message":["The OAuth provider contains an OpenAPI
  definition with validation errors."],"errors":["The value of
  'name' property in the security definition 'clientIdHeader' for
  a 'type' property with value 'header' must be either
  'X-IBM-Client-Id' or 'X-IBM-Client-Secret' if 'x-key-type' is
  not used."]}
  bhendi:error [00000000-0000-0000-0000-000000000000]
  invoker::invoke, error for call to patch
  /orgs/ogr#/oauth-providers/auth# (operation id:
  oauth_provider_update): {"status":400,"message":["The OAuth
  provider contains an OpenAPI definition with validation
  errors."],"errors":["The value of 'name' property in the
  security definition 'clientIdHeader' for a 'type' property with
  value 'header' must be either 'X-IBM-Client-Id' or
  'X-IBM-Client-Secret' if 'x-key-type' is not used."]}
  upgrade:upgrade [00000000-0000-0000-0000-000000000000] Error
  while upgrading step : 604: {"status":400,"message":["The OAuth
  provider contains an OpenAPI definition with validation
  errors."],"errors":["The value of 'name' property in the
  security definition 'clientIdHeader' for a 'type' property with
  value 'header' must be either 'X-IBM-Client-Id' or
  'X-IBM-Client-Secret' if 'x-key-type' is not used."]}
  sql [00000000-0000-0000-0000-000000000000] [43469]
  rollbackTransaction
  sql [00000000-0000-0000-0000-000000000000] [43469]
  releaseConnection
  Microservice startup failed because of error:  {
   status: 400,
   message: [
     'The OAuth provider contains an OpenAPI definition with
  validation errors.'
   ],
   errors: [
     "The value of 'name' property in the security definition
  'clientIdHeader' for a 'type' property with value 'header' must
  be either 'X-IBM-Client-Id' or 'X-IBM-Client-Secret' if
  'x-key-type' is not used."
   ]
  }  - stack trace: {"status":400,"message":["The OAuth provider
  contains an OpenAPI definition with validation
  errors."],"errors":["The value of 'name' property in the
  security definition 'clientIdHeader' for a 'type' property with
  value 'header' must be either 'X-IBM-Client-Id' or
  'X-IBM-Client-Secret' if 'x-key-type' is not used."]}
  

Local fix

Problem summary

• When upgrading to API Connect versions 10.0.7.0 or 10.0.5.6,
  upgrade fails if invalid OAuth definitions exist.
  

Problem conclusion

• Fixed in API Connect versions 10.0.8.0 and 10.0.5.7.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  API CONNECT ENT

• Fixed component ID

  5725Z2201

Applicable component levels