IBM Support

PH17401: SECURITY RULE DATE OFFSET DOES NOT WORK WITHIN CERTAIN TIME OFFSETS

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • If a security rule is set up with a Date offset that tests
    within a certain time limit, the rule does not work.
    
    Documentation on the date function with time offset:
    https://www.ibm.com/support/knowledgecenter/en/SSFUEU_8.0.0/op_g
    rc_admin/r_op_admin_grammar_rules.html
    
    Upon further testing, the issue seems restricted to any time
    within 17 hours?
    For example, modifying the test to the following works whereas
    anything less than 1020 minutes fails. Switching to hours is the
    same:
    
    [SOXIssue].[System Fields].[Creation Date] > NOW (-1020,'mi') ?
    works
    [SOXIssue].[System Fields].[Creation Date] > NOW (-1000,'mi') -
    fails
    [SOXIssue].[System Fields].[Creation Date] > NOW (-18,'h') ?
    works
    [SOXIssue].[System Fields].[Creation Date] > NOW (-16,'h') -
    fails
    
    Prerequisites:
    
    OpenPages installed
    
    Create security rule
    1.	Log into OpenPages UI as OpenPagesAdministrator
    2.	Switch to Standard UI
    3.	Navigate to Administration -> Security Rules -> SOXIssue
    4.	Enable System Admin Mode (SAM)
    5.	Click Add on a Record Level Security Rule
    6.	Enter a name, then paste the following Formula which tests
    the Creation Date and should show Issues created within the last
    15 minutes:
    
    [SOXIssue].[System Fields].[Creation Date] > NOW (-15,'mi')
    
    Tick Read on the Access Controls and click Save.
    
    7.	Disable System Admin Mode
    
    Steps to Reproduce:
    
    1.	Log into OpenPages UI as OpenPagesAdministrator
    2.	Switch to Standard UI
    3.	On the top right, click on Add New and select Issue
    4.	Enter all mandatory fields and click save. Note the creation
    time of this record
    5.	Log off OpenPagesAdministrator and log back in as a normal
    user
    6.	Switch to Standard UI
    7.	Navigate to Remediation -> Issues and search for the new
    record and confirm the record does not appear
    
    Expected Results:
    
    Security rules should work when configured with a time offset
    set in minutes
    
    Actual Results:
    
    Security rules with a time offset set in minutes does not work
    
    Error Message:
    
    None
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:                                              *
    * OpenPages Users                                              *
    ****************************************************************
    * PROBLEM DESCRIPTION:                                         *
    * SECURITY RULE DATE OFFSET DOES NOT WORK WITHIN CERTAIN TIME  *
    * OFFSETS                                                      *
    ****************************************************************
    * RECOMMENDATION:                                              *
    * Customers should download OpenPages with Watson 8.2 Fix Pack *
    * 2 (8.2.0.2). See the following document for details on       *
    * obtaining OpenPages 8.2.0.2:                                 *
    * https://www.ibm.com/support/pages/openpages-watson-82-fix-pa *
    * ck-2                                                         *
    ****************************************************************
    

Problem conclusion

  • We have updated the RLS Rule engine logic to handle all the
    conditions for date offsets, such as seconds, minutes, hours,
    days, weeks, months, year.
    
    Customers should download OpenPages with Watson 8.2 Fix Pack 2
    (8.2.0.2). See the following document for details on obtaining
    OpenPages 8.2.0.2:
    https://www.ibm.com/support/pages/openpages-watson-82-fix-pack-2
    

Temporary fix

Comments

APAR Information

  • APAR number

    PH17401

  • Reported component name

    OPENPAGES GRC

  • Reported component ID

    5725D5100

  • Reported release

    800

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2019-09-26

  • Closed date

    2021-03-24

  • Last modified date

    2021-03-24

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    OPENPAGES GRC

  • Fixed component ID

    5725D5100

Applicable component levels

[{"Line of Business":{"code":"LOB10","label":"Data and AI"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSFUEU","label":"IBM OpenPages with Watson"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"800"}]

Document Information

Modified date:
25 March 2021