PH38861: Provide option to bypass Java subject creation when linking to a Liberty program

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• Provide option to bypass Java subject when linking to a Liberty
  program.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All CICS Users.                              *
  ****************************************************************
  * PROBLEM DESCRIPTION: The propagation of the CICS task id     *
  *                      onto a Java Subject for Link-to-Liberty *
  *                      CICS transaction can be expensive in    *
  *                      performance for high volume L2L         *
  *                      workload.                               *
  ****************************************************************
  Link-to-Liberty (L2L) is initiated from  a CICS transaction
  where CICS security applies. By default the JCA adapter and
  WorkManager that process the CICS L2L  requests create a Java
  subject with security credentials based on the CICS userid used
  from the parent task. The performance of these CICS transactions
  can suffer from local lock contention.
  
  Keyword: DSAPTHWT
  

Problem conclusion

• This APAR introduces a new mode of operation, using a new JVM
  property,  which will allow the bypass of the propagation of the
  CICS task id onto a Java Subject.
  With this new property set to false, CICS security and Liberty
  security will still be in force, the key difference is that Java
  authorisation would not be performed using the CICS task id but
  instead use the Liberty unauthenticated userid (the
  Liberty default is WSGUEST).
  
  The new property is:
  com.ibm.cics.jvmserver.wlp.security.subject.create=true | false
  
  'true' is the default and retains the current behaviour.
  'false' will bypass the creation of the Java Subject.
  
  IBM Documentation will be updated for the new parameter.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  UI77466 UI77467

Modules/Macros

• DFJ@H467
  

Fix information

• Fixed component name

  CICS TS Z/OS V5

• Fixed component ID

  5655Y0400

Applicable component levels

• R200 PSY UI77467

     UP21/10/08 P F110

• R300 PSY UI77466

     UP21/10/07 P F110

Fix is available

• Select the PTF appropriate for your component level. You will be required to sign in. Distribution on physical media is not available in all countries.