PI51301: OAUTH MAY NOT HONOR SECURITY DOMAIN CREDENTIALS

8.0.0.12: WebSphere Application Server V8.0 Fix Pack 12
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
7.0.0.41: WebSphere Application Server V7.0 Fix Pack 41
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.0.0.13: WebSphere Application Server V8.0 Fix Pack 13
7.0.0.43: WebSphere Application Server V7.0 Fix Pack 43
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.0.0.14: WebSphere Application Server V8.0 Fix Pack 14
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
7.0.0.45: WebSphere Application Server V7.0 Fix Pack 45
8.0.0.15: WebSphere Application Server V8.0 Fix Pack 15
7.0.0.45: Java SDK 1.6 SR16 FP60 Cumulative Fix for WebSphere Application Server
7.0.0.41: Java SDK 1.6 SR16 FP20 Cumulative Fix for WebSphere Application Server
7.0.0.43: Java SDK 1.6 SR16 FP41 Cumulative Fix for WebSphere Application Server
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• The OAuth component may not honor defined Security Domain
  configurations in the cell and attempt to use the global
  security registry instead.
  

Local fix

• Install WebSphereOAuth20.sp at the global security level
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server users of   *
  *                  OAuth                                       *
  ****************************************************************
  * PROBLEM DESCRIPTION: OAuth may not honor Security Domain     *
  *                      credentials                             *
  ****************************************************************
  * RECOMMENDATION:  Install a fix pack that contains this       *
  *                  APAR.                                       *
  ****************************************************************
  The OAuth component may not honor defined Security Domain
  configurations in the cell and attempt to use the global
  security registry instead.
  

Problem conclusion

• When the OAuth service is initialized, OAuth attempts to cache
  its user registry.  At the time of initialization, if the
  required Security Domain has not also been initialized, the
  Global Security user registry will be cached instead of the
  Security Domain.  Later, when OAuth attempts credential
  validation, the Security Domain is not used as intended.
  
  The OAuth runtime is updated to initialize its cache the first
  time the registry is required instead of during the
  service initializion.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 7.0.0.41, 8.0.0.12 and 8.5.5.9.  Please refer to the
  Recommended Updates page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  
  Keywords: IBMWL3WSS, OAUTH
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSPHERE APP S

• Fixed component ID

  5724J0800

Applicable component levels

• R700 PSY

     UP

• R800 PSY

     UP

• R850 PSY

     UP