PH52832: A SUBJECT IS CREATED WITH INCORRECT PRINCIPAL NAME WHEN A REQUEST COMES FROM A FOREIGN TRUSTED REALM

APAR status

• Closed as program error.

Error description

• When a server receives a request from a foreign trusted realm
  containing an LtpaToken2, it creates a Subject based on the
  token. In some cases, the server generates a Subject
  with an incorrect Principal name that begins with "user:".
  
  
  -- Sample error -------
  In the following error, "user:" in the search parameter is not
  necessary. As a result, the search failed.
  
  samAccountName=user:IBM-BPM/CN=John
  
  [10/26/22 9:04:25:928 CDT] 00000137 LdapConnectio >
  com.ibm.ws.wim.adapter.ldap.LdapConnection JNDI_CALL
  search(String, String, Object[], SearchControls) ENTRY
  dc=corp,dc=ibm,dc=com
  (&(ObjectCategory=User)(samAccountName=user:IBM-BPM/CN=John
  Doe,OU=IBM,OU=AmericaUsers,dc=corp,dc=ibm,dc=com))
  null [searchScope: 2,
  timeLimit: 600000, countLimit: 3, returningObjFlag: false,
  returningAttributes: [displayName, objectguid, samAccountName,
  objectClass, cn]] java.naming.referral: ignore
  [10/26/22 9:04:25:928 CDT] 00000137 LdapConnectio 1
  com.ibm.ws.wim.adapter.ldap.LdapConnection search(String,
  String, Object[], SearchControls) Exception caught:
   javax.naming.CommunicationException: A system call received a
  parameter that is not valid. (Read failed) [Root exception is
  java.net.SocketException: A system call received a parameter
  that is not valid. (Read failed)]; remaining name
  'dc=corp,dc=ibm,dc=com'
  at com.sun.jndi.ldap.LdapCtx.doSearch(LdapCtx.java:2043)
  at com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1885)
  at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1810)
  at
  com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentD
  irContext.java:404)
  at
  com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Parti
  alCompositeDirContext.java:370)
  at
  org.apache.aries.jndi.DelegateContext.search(DelegateContext.jav
  a:360)
  at
  javax.naming.directory.InitialDirContext.search(InitialDirContex
  t.java:287)
  at
  com.ibm.ws.wim.adapter.ldap.TimedDirContext.search(TimedDirConte
  xt.java:185)
  at
  com.ibm.ws.wim.adapter.ldap.LdapConnection.search(LdapConnection
  .java:3352)
  at
  com.ibm.ws.wim.adapter.ldap.LdapConnection.checkSearchCache(Ldap
  Connection.java:3240)
  at
  com.ibm.ws.wim.adapter.ldap.LdapConnection.search(LdapConnection
  .java:3438)
  at
  com.ibm.ws.wim.adapter.ldap.LdapConnection.searchEntities(LdapCo
  nnection.java:3674)
  at
  com.ibm.ws.wim.adapter.ldap.LdapAdapter.search(LdapAdapter.java:
  3565)
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server who configured trusted foreign       *
  *                  realms and use LtpaToken                    *
  ****************************************************************
  * PROBLEM DESCRIPTION: When a server receives a request from   *
  *                      a                                       *
  *                      foreign trusted realm containing an     *
  *                      LtpaToken2, the server generates a      *
  *                      Subject with an incorrect Principal     *
  *                      name                                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  When a server receives a request from a foreign trusted realm
  containing an LtpaToken2, it creates a Subject based on the
  token. In some cases, the Subject is created incorrectly with
  an
  extra "user:" in the Principal name due to a bug.
  

Problem conclusion

• The bug has been fixed.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.24 and 9.0.5.17. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels