PK44945: WEB SERVICE REQUESTS MAY BE SENT OVER HTTPS INSTEAD OF HTTP WHEN WS-ATOMIC TRANSACTION IS USED WITH GLOBAL SECURITY ENABLED

Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR8 Cumulative Fix for WebSphere Application Server
Java SDK 1.5 SR10 Cumulative Fix for WebSphere Application Server
6.1.0.31: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.29: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• In WebSphere Application Server V6, a web service client may
  sent a request message over HTTPS rather than HTTP when global
  security is enabled and WS-Atomic Transaction is used.  The
  WebSphere WS-Atomic Transaction implementation needs to be fixed
  so that request messages can be sent over HTTP when global
  security is enabled.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED: All IBM WebSphere Application Server users   *
  *                 of Web Services - Atomic Transactions        *
  *                 (WS-AT) on Distributed Platforms in a        *
  *                 secure environment                           *
  ****************************************************************
  * PROBLEM DESCRIPTION: Enabling WebSphere Application Server   *
  *                      global security settings caused  WS-AT  *
  *                      messages to be transmitted over HTTPS.  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The decision regarding whether to send WS-AT request messages
  over HTTPS rather than HTTP is based on the global security
  setting applied on the application server, and not related to
  whether or not SSL was enabled on the chosen transport chain.
  

Problem conclusion

• The decision as to whether to send the WS-AT messages over
  HTTP or HTTPS was being made based on the WebSphere
  Application Server global security settings, and ignoring the
  security settings that were active on the transport chain
  actually in use.
  
  If WebSphere Application Server global security is enabled,
  the assumption was being made that the WS-AT protocol messages
  would also be sent secure - by default, the transaction service
  will use the default secure Web container transport chain:
  WCInboundDefaultSecure.  To use an alternate transport chain in
  a secure environment, the WSTX_SECURE_TRANSPORT_CHAIN custom
  property details which transport chain should be used.  While
  WS-AT would use the defined chain in the secure environment,
  it ignored the security settings in force on the specified
  transport chain, causing the messages to be always sent over
  HTTPS. Changes were made to ensure that HTTP or HTTPS is
  selected based on the security settings in force on that
  transport chain defined by the custom property.
  
  As described in the Information Centre, the following custom
  properties should be enabled to allow WS-AT to operate in a
  secure environment :
  
  DISABLE_PROTOCOL_SECURITY=TRUE
  WSTX_SECURE_TRANSPORT_CHAIN=WCInboundDefault
  
  The fix for this APAR is currently targeted for inclusion in
  fixpack 6.0.2.21.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PK45192

Modules/Macros

• WSAT
  

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R60A PSY

     UP

• R60H PSY

     UP

• R60I PSY

     UP

• R60P PSY

     UP

• R60S PSY

     UP

• R60W PSY

     UP

• R60Z PSY

     UP

• R61A PSN

     UP

• R61H PSN

     UP

• R61I PSN

     UP

• R61P PSN

     UP

• R61S PSN

     UP

• R61W PSN

     UP

• R61Z PSN

     UP