PI43772: PERSISTENT BROWSER SESSIONS ARE ONLY POSSIBLE IF CREDENTIALS IN REST URIS ARE ALLOWED

Rational ClearQuest Fix Pack 16 (8.0.0.16) for 8.0
Rational ClearQuest Fix Pack 9 (8.0.1.9) for 8.0.1
Rational ClearQuest Fix Pack 17 (8.0.0.17) for 8.0
Rational ClearQuest Fix Pack 10 (8.0.1.10) for 8.0.1
Rational ClearQuest Fix Pack 18 (8.0.0.18) for 8.0
Rational ClearQuest Fix Pack 11 (8.0.1.11) for 8.0.1
Rational ClearQuest Fix Pack 19 (8.0.0.19) for 8.0
Rational ClearQuest Fix Pack 12 (8.0.1.12) for 8.0.1
Rational ClearQuest Fix Pack 20 (8.0.0.20) for 8.0
Rational ClearQuest Fix Pack 13 (8.0.1.13) for 8.0.1
Rational ClearQuest Fix Pack 21 (8.0.0.21) for 8.0
Rational ClearQuest Fix Pack 14 (8.0.1.14) for 8.0.1
Rational ClearQuest Fix Pack 15 (8.0.1.15) for 8.0.1
Rational ClearQuest Fix Pack 16 (8.0.1.16) for 8.0.1
Rational ClearQuest Fix Pack 17 (8.0.1.17) for 8.0.1
Rational ClearQuest Fix Pack 18 (8.0.1.18) for 8.0.1
Rational ClearQuest Fix Pack 19 (8.0.1.19) for 8.0.1
Rational ClearQuest Fix Pack 20 (8.0.1.20) for 8.0.1
Rational ClearQuest Fix Pack 21 (8.0.1.21) for 8.0.1
Rational ClearQuest Fix Pack 22 (8.0.1.22) for 8.0.1
Rational ClearQuest Fix Pack 23 (8.0.1.23) for 8.0.1
Rational ClearQuest Fix Pack 24 (8.0.1.24) for 8.0.1
Rational ClearQuest Fix Pack 25 (8.0.1.25) for 8.0.1

APAR status

• Closed as program error.

Error description

• If the IBM Rational ClearQuest (CQ) Web Site Administration
  setting "Allow credentials in REST URIs" is not checked then
  users are required to log in each time they access a CQ record
  from a different tab in the browser.
  
  In the past (with older CQ versions that did not have the
  possibility to forbid autologin URL's) the user were able to
  open multiple CQ records by only logging in once.
  

Local fix

• Security risk if enabled:
  Due to this defect, to be able to have sessions persisting
  between browser tabs CQ admins need to allow credentials in the
  REST (REpresentational State Transfer) URI's but this workaround
  may not be desired.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * ClearQuest Web                                               *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * ClearQuest Web sessions cannot be reused in REST URIs.  If   *
  * the ClearQuest Web Site Administration setting "Allow        *
  * credentials in REST URIs" is not checked, users are required *
  * to log in each time they access a CQ record from a different *
  * tab in the browser.                                          *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• A fix is available in ClearQuest 8.0.0.16 and 8.0.1.9.
  A security option in Site Configuration is now available for
  ClearQuest Web administrators so they can configure CQ web
  sessions to be reusabled.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  CLEARQUEST WIN

• Fixed component ID

  5724G3600

Applicable component levels

• R801 PSY

     UP