PI97974: INVALID USER ID THAT CONTAINS A PARENTHESIS SHOULD BE ESCAPED FOR STANDALONE LDAP CONFIGURATION

9.0.0.10: WebSphere Application Server traditional V9.0 Fix Pack 10
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
9.0.0.11: WebSphere Application Server traditional V9.0 Fix Pack 11
9.0.5.0: WebSphere Application Server traditional Version 9.0.5 Refresh Pack
9.0.5.1: WebSphere Application Server traditional Version 9.0.5 Fix Pack 1
9.0.5.2: WebSphere Application Server traditional Version 9.0.5 Fix Pack 2
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
9.0.5.3: WebSphere Application Server traditional Version 9.0.5 Fix Pack 3
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21

APAR status

• Closed as program error.

Error description

• User's supply an invalid user ID in the SOAP header's Security
  section.  If this user id contains LDAP query formatting such
  as '*)' or ')(' the server returns LDAP specific errors such as
  ?InvalidSearchFilterException: Unbalanced parenthesis? or
  ?InvalidSearchFilterException: Missing Equals? rather than
  simply rejecting the login.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: A Request to WebSphere Standalone       *
  *                      LDAP Registry API causes an             *
  *                      "Unbalanced Parenthesis error"          *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Users logging in with parentheses in their names cause
  "unbalanced parethesis error"
  Note: This APAR is for Standalone LDAP configuration. For the
  same issue with Federated Repository, following APAR is
  available.
  PI93225: A request to WebSphere Federated Repositories cause
  an "Unbalanced Parenthesis error"
  ---Sample error for PI97974  ---------------------------
  [4/10/18 15:19:17:064 UTC]     FFDC
  Exception:com.ibm.websphere.security.CustomRegistryException
  SourceId:com.ibm.ws.security.registry.ldap.LdapRegistryImpl.chec
  kPassword ProbeId:355
  Reporter:com.ibm.ws.security.registry.ldap.LdapRegistryImpl@adfb
  31fd
  javax.naming.directory.InvalidSearchFilterException:
  Unbalanced parenthesis; Remaining name: 'dc=rtp,dc=ibm,dc=com'
  at
  com.sun.jndi.ldap.Filter.encodeFilter(Filter.java:167)
  at
  com.sun.jndi.ldap.Filter.encodeFilterString(Filter.java:66)
  at
  com.sun.jndi.ldap.LdapClient.search(LdapClient.java:538)
  at com.sun.jndi.ldap.LdapCtx.doSearch(LdapCtx.java:1977)
  at
  com.sun.jndi.ldap.LdapCtx.searchAux(LdapCtx.java:1839)
  at com.sun.jndi.ldap.LdapCtx.c_search(LdapCtx.java:1764)
  at
  com.sun.jndi.toolkit.ctx.ComponentDirContext.p_search(ComponentD
  irContext.java:380)
  at
  com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.search(Parti
  alCompositeDirContext.java:350)
  at
  org.apache.aries.jndi.DelegateContext.search(DelegateContext.jav
  a:360)
  at
  javax.naming.directory.InitialDirContext.search(InitialDirContex
  t.java:227)
  at
  com.ibm.ws.security.registry.ldap.LdapRegistryImpl.performAuthen
  tication(LdapRegistryImpl.java:2278)
  at
  com.ibm.ws.security.registry.ldap.LdapRegistryImpl.search(LdapRe
  gistryImpl.java:2224)
  -----------------------------------
  

Problem conclusion

• The fix for this APAR is currently targeted for inclusion in
  fix pack 8.5.5.15 and 9.0.0.10.  Please refer to the
  Recommended
  Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R850 PSY

     UP

• R900 PSY

     UP