RS03769: CANNOT AUTHENTICATE TO REST API WITH A PASSWORD THAT CONTAINS A COLON

IBM Operational Decision Manager V8.10.5.1 Fix Pack
IBM Operational Decision Manager for z/OS 8.10.5.1 Fix Pack

APAR status

• Closed as program error.

Error description

• When using a password that contains a colon, authentication
  fails for the REST API. As a consequence you cannot deploy
  ruleApps from Rule Designer.
  
  In server logs you
  get:
  
  com.ibm.rules.res.console E An error occurred when
  validating the basic authentication header of a
  request.
  javax.servlet.ServletException
  at com.ibm.ws.webcontain
  er.security.AuthenticateApi.login(AuthenticateApi.java:154)
  at c
  om.ibm.ws.webcontainer.security.WebAppSecurityCollaboratorImpl.l
  ogin(WebAppSecurityCollaboratorImpl.java:1149)
  at com.ibm.ws.web
  container.srt.SRTServletRequest.login(SRTServletRequest.java:393
  9)
  at ilog.rules.res.console.jsf.RestAuthenticationFilter.authen
  ticateUser(RestAuthenticationFilter.java:126)
  at ilog.rules.res.
  console.jsf.RestAuthenticationFilter.validateBasicAuth(RestAuthe
  nticationFilter.java:108)
  at ilog.rules.res.console.jsf.RestAuth
  enticationFilter.doFilter(RestAuthenticationFilter.java:88)
  
  In
  rule designer logs you get:
  
  An error prevented the RuleApp to
  be deployed to res sample (http://localhost:9090/res):
  Unexpected error "javax.xml.bind.UnmarshalException
  - with
  linked exception:
  [org.xml.sax.SAXParseException: Premature end
  of file.]" when contacting
  "http://localhost:9090/res/api/v1/xml/ruleapps/dep_conf/1.0",
  HTTP status 401:
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Users having a colon in their password.                      *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * When using a password that contains a colon, authentication  *
  * fails for the REST API. As a consequence you cannot deploy   *
  * ruleApps from Rule Designer.                                 *
  *                                                              *
  * In server logs you get:                                      *
  *                                                              *
  * com.ibm.rules.res.console E An error occurred when           *
  * validating the basic authentication header of a              *
  * request.                                                     *
  * javax.servlet.ServletException                               *
  * at com.ibm.ws.webcontain                                     *
  * er.security.AuthenticateApi.login(AuthenticateApi.java:154)  *
  * at c                                                         *
  * om.ibm.ws.webcontainer.security.WebAppSecurityCollaboratorIm *
  * pl.l                                                         *
  * ogin(WebAppSecurityCollaboratorImpl.java:1149)               *
  * at com.ibm.ws.web                                            *
  * container.srt.SRTServletRequest.login(SRTServletRequest.java *
  * :393                                                         *
  * 9)                                                           *
  * at                                                           *
  * ilog.rules.res.console.jsf.RestAuthenticationFilter.authen   *
  * ticateUser(RestAuthenticationFilter.java:126)                *
  * at ilog.rules.res.                                           *
  * console.jsf.RestAuthenticationFilter.validateBasicAuth(RestA *
  * uthe                                                         *
  * nticationFilter.java:108)                                    *
  * at ilog.rules.res.console.jsf.RestAuth                       *
  * enticationFilter.doFilter(RestAuthenticationFilter.java:88)  *
  *                                                              *
  * In Rule Designer logs you get:                               *
  *                                                              *
  * An error prevented the RuleApp to                            *
  * be deployed to res sample (http://localhost:9090/res):       *
  * Unexpected error "javax.xml.bind.UnmarshalException          *
  * - with                                                       *
  * linked exception:                                            *
  * [org.xml.sax.SAXParseException: Premature end                *
  * of file.]" when contacting                                   *
  * "http://localhost:9090/res/api/v1/xml/ruleapps/dep_conf/1.0" *
  * ,                                                            *
  * HTTP status 401                                              *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  

Problem conclusion

• Passwords can now contain a colon.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WDS FOR RULES

• Fixed component ID

  5725B6903

Applicable component levels