PI13472: WARNING USING THE AUTO-LOGIN URL IN AN AUTHENTICATED CONTEXT

APAR status

• Closed as program error.

Error description

• If a user was authenticated using the auto-login URL and then
  uses the auto-login URL again, the following warning is written
  to SystemOut.log:
  
  [1/10/14 9:20:32:129 EET] 0000004c AbstractActio W
  com.ibm.wps.state.preprocessors.action
  .AbstractActionPreProcessor handleProtectionModeViolation()
  Action execution refused due to a security violation. Action ID
  0 violates protection mode REPLAY
  

Local fix

• Avoid use of auto-login URL in an authenticated context.
  

Problem summary

• If a user was authenticated using the auto-login URL and then
  uses the auto-login URL again, the following warning is written
  to SystemOut.log:
  ¬1/10/14 9:20:32:129 EET? 0000004c AbstractActio W
  com.ibm.wps.state.preprocessors.action
  .AbstractActionPreProcessor handleProtectionModeViolation()
  Action execution refused due to a security violation. Action ID
  0 violates protection mode REPLAY
  This APAR also introduces a new configuration option to
  completely disallow use of the auto-login URL.  The default
  setting is to allow the auto-login URL.  To disable:
  i.  Login to the WebSphere Administration Console
  ii.  Navigate to Resources > Resource Environment Providers >
  WP AuthenticationService > Custom Properties
  iii.  Create a new custom property
  name:  authentication.isLoginUrlActive
  value:  false
  type:  java.lang.Boolean
  iv.  Save changes.  If clustered, sync nodes.
  v.  Restart the Portal server.
  

Problem conclusion

• A code fix for this issue is integrated into the WebSphere
  Portal & WCM Combined Cumulative Fix 12 (PI14791) for Portal
  8.0.0.1 available from Fix Central:
  http://www-933.ibm.com/support/fixcentral/swg/selectFixes?parent
  =ibm/WebSphere&product=ibm/WebSphere/WebSphere+Portal&release=Al
  l&platform=All&function=aparId&apars=PI14791
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE PORTA

• Fixed component ID

  5724E7600

Applicable component levels

• R800 PSY

     UP