PK95991; 7.0.0.7: servlet form logouts fail with integrated session security and

Download Description

PK95991 resolves the following problem:

ERROR DESCRIPTION:
With integrated session security and auditing enabled, a servlet form logout fails with the following error:

webcontainer E com.ibm.ws.webcontainer.WebContainer
handleRequest SRVE0232E: Internal Server Error: Exception
Message:
[com.ibm.websphere.servlet.session.UnauthorizedSessionRequestExc
SESN0008E: A user authenticated as {0} has attempted to access
a session owned by {1}

LOCAL FIX:

PROBLEM SUMMARY

* USERS AFFECTED: All users of IBM WebSphere Application Server

PROBLEM DESCRIPTION:
With session security and auditing enabled, an exception occurs during a formlogout when trying to
acquire the session id.

RECOMMENDATION:
None

When audit is enabled formLogout fails because the caller subject on the thread is null.

PROBLEM CONCLUSION:
Added code to check if session security is enabled to control flow.

The fix for this APAR is currently targeted for inclusion in Fix Pack 7.0.0.9. Refer to the Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980