JR30018; 6.2.0.0: A LTPA Token Timeout is Observed for SCA Messages

Download Description

JR30018 resolves the following problem:

ERROR DESCRIPTION:
SCA messages use the LTPA token provided by WebSphere Application Server. This token has an expiration time with a default of 2 hours. If the LTPA token living time is exceeded, LTPA token timeout value, TokenExpiredException will be observed

LOCAL FIX:
A local fix is to increase the LTPA token timeout. But be aware that this may lead to security concerns, because the token is also used in other cases, like for browser cookies. All usages of the LTPA token need to be considered and your system needs to be correspondingly hardened.


USERS AFFECTED:
WebSphere Process Server 6.1 and 6.2 users.

PROBLEM DESCRIPTION:
The problem occurs with SCA messages that use the LTPA token authentication. The asynchronous SCA messages use the LTPA token provided by WebSphere Application Server to authenticate the messages. The LTPA timeout value is a part of the security configuration for WebSphere Application Server, which you can assign a desired value. The default expiration time is 120 minutes.

For asynchronous messages there can be a situation where messages stay in a queue more than the LTPA Token expiration time. For example, in the SCA internal queue, there can be SCA asynchronous messages that are not processed by SCA due to high workload and at this time, WebSphere Process Server is shutdown for a long time due to maintenance reason. If this condition happens, the SCA server will not be able to process these messages as the tokens in the messages will be expired by then.

Note:
Timeout leniency is only one option for addressing timeouts. Assessing whether an appropriate timeout configuration (maxCacheCushion and LTPA token timeout) have been set and adjusting the timeout settings accordingly is another and the recommended approach. The technote listed above explains the steps to configure those respective settings.

Apply this interim fix JR30018 and configure the leniency timeout only when you have deemed your timeout settings are properly set as per your internal enterprise security standards and cannot be changed.


RECOMMENDATION:
None

PROBLEM CONCLUSION:
The official fix for JR30018 includes changes to the SCA design, which allows support to consume the messages even for expired LTPA tokens. A new WebSphere variable, TIMEOUTLENIENCY, is introduced to leverage this behavior. Using this official fix, the incoming messages with expired LTPA tokens will continue to be processed by SCA within the TIMEOUTLENIENCY window.


If WebSphere Process Server security is enabled the following configurations are set::
• LTPA Token Timeout = 120 minutes
• SCA Timeout Leniency = 60 minutes
An asynchronous SCA call happens at 12:00. Then an asynchronous SCA messages is created with LTPA token created at 12:00. The asynchronous message remains in the queue because target service is not available. More than two hours later, target service is started up at 14:30 and continues to process the asynchronous SCA messages,
If the official Fix JR30018 is not installed, the target will issue an LTPA Timeout Exception.
If the official Fix JR30018 is installed, SCA can consume the asynchronous SCA message between 14:30 – 15:00 without LTPA Timeout Exception (Until the Leniency Time is elapsed).
Leniency time can postpone the LTPA token timeout time, which SCA can process the message in given leniency time after the LTPA token in message is expired.

NOTE:
This example represents the "maximum effective expiration possible".

All of the existing old SCA messages that were submitted prior to applying the fix will fail with the LTPA exception. The leniency will not have an effect on the messages submitted prior to applying the fix.

Instructions to apply the official Fix:

1. Stop WebSphere Process Server or Network Deployment Environment
2. Launch the UpdateInstaller wizard.
3. Install the fix in each WebSphere Process Server installation
4. Start the WebSphere Process Server or cluster
5. Configure the TIMEOUTLENIENCY
• Launch the administrative console
• Environment -> WebSphere Variables -> New
• Select the desired scope (Cell or Cluster for Network Deployment Environment; Cell, Node or Server for standalone server)
  Name (case sensitive): TIMEOUTLENIENCY
  Value (in minutes): any integer value greater than 0 as desired. This value will determine the time starting from the LTPA expiration, within which the expired tokens will be processed. If an invalid value is input, the fix will not take effect.