PM42314: EJB TIMERS USING @TIMEOUT ANNOTATION DON'T PASS ON RUNAS ROLES

7.0.0.21: WebSphere Application Server V7.0 Fix Pack 21
7.0.0.23: WebSphere Application Server V7.0 Fix Pack 23
7.0.0.25: WebSphere Application Server V7.0 Fix Pack 25
7.0.0.27: WebSphere Application Server V7.0 Fix Pack 27
7.0.0.29: WebSphere Application Server V7.0 Fix Pack 29
7.0.0.31: WebSphere Application Server V7.0 Fix Pack 31
7.0.0.27: Java SDK 1.6 SR13 FP2 Cumulative Fix for WebSphere Application Server
7.0.0.33: WebSphere Application Server V7.0 Fix Pack 33
7.0.0.35: WebSphere Application Server V7.0 Fix Pack 35
7.0.0.37: WebSphere Application Server V7.0 Fix Pack 37
7.0.0.39: WebSphere Application Server V7.0 Fix Pack 39
7.0.0.41: WebSphere Application Server V7.0 Fix Pack 41
7.0.0.43: WebSphere Application Server V7.0 Fix Pack 43
7.0.0.45: WebSphere Application Server V7.0 Fix Pack 45
7.0.0.21: Java SDK 1.6 SR9 FP2 Cumulative Fix for WebSphere
7.0.0.23: Java SDK 1.6 SR10 FP1 Cumulative Fix for WebSphere
7.0.0.25: Java SDK 1.6 SR11 Cumulative Fix for WebSphere Application Server
7.0.0.27: Java SDK 1.6 SR12 Cumulative Fix for WebSphere Application Server
7.0.0.29: Java SDK 1.6 SR13 FP2 Cumulative Fix for WebSphere Application Server
7.0.0.45: Java SDK 1.6 SR16 FP60 Cumulative Fix for WebSphere Application Server
7.0.0.31: Java SDK 1.6 SR15 Cumulative Fix for WebSphere Application Server
7.0.0.35: Java SDK 1.6 SR16 FP1 Cumulative Fix for WebSphere Application Server
7.0.0.37: Java SDK 1.6 SR16 FP3 Cumulative Fix for WebSphere Application Server
7.0.0.39: Java SDK 1.6 SR16 FP7 Cumulative Fix for WebSphere Application Server
7.0.0.41: Java SDK 1.6 SR16 FP20 Cumulative Fix for WebSphere Application Server
7.0.0.43: Java SDK 1.6 SR16 FP41 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• EJB Timers using @Timeout annotation don't pass on RunAS roles
  
  
  Using the javax.ejb.Timeout annotation, we are able to register
  EJB timeout methods to execute on timeout but ONLY when there
  are no @RunAs roles declared.
  
  
  When called the class that implements TimerAnnotatedSecured
  following error is seen
  
  Exception show on systemout.log as follows
  
  ----------------------------------------------------------------
  
   SecurityAutho 3   SecurityAuthorizationModule received an
  onEJBAuthTime event
   SystemOut     O   >>> [TimerTimedObjectUnsecured] Timeout
  happened!
  
  WSAccessManag 3   Subject:
   Principal: /UNAUTHENTICATED
   Public Credential:
  com.ibm.ws.security.auth.WSCredentialImpl@767b767b
   is not granted any of the required roles: WSS_SYS_ROLE
  [6/3/11 14:08:12:272 CDT] 00000025 SecurityColla 3
  Authorization failed accessing EJB
  
  com.ibm.ws.security.core.AccessException: Subject:
   Principal: /UNAUTHENTICATED
   Public Credential:
  com.ibm.ws.security.auth.WSCredentialImpl@767b767b
   is not granted any of the required roles: WSS_SYS_ROLE
   at
  com.ibm.ws.security.core.WSAccessManager.checkAccess(WSAccessMan
  ager.java:448)
   at
  com.ibm.ws.security.core.SecurityCollaborator.ejbCheckAuthorizat
  ion(SecurityCollaborator.java:1515)
  
  --------------------------------------------------------------
  

Local fix

• n/a
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server                                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: EJB 3.0 Timer callback methods of the   *
  *                      Timer Service fail with SECJ0053E for   *
  *                      the UNAUTHENTICATED id.                 *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Customer is implementing a Timer Service. The Timer callback
  method is annotated with the @Timeout tag. When the Timer
  callback method is called, if fails as being not authorized.
  [5/25/11 15:04:06:491 BST] 00000030 SecurityColla A
  SECJ0053E:
  Authorization failed for /UNAUTHENTICATED while invoking
  (Bean)myApp.TimerEar#MyApp.TimerEjb.jar#MyAppClassname .
  As per the EJB3.0 Spec section 18.2.2:
  Since the timeout callback method is an internal method of the
  bean class, it has no client security context. When
  getCallerPrincipal is called from within the timeout
  callback method, it returns the container?s representation of
  the unauthenticated identity.
  So the Application Server should run using the UNAUTHENTICATED
  id. However, it should run as an unprotected resource. We
  should not make an authorization check on this method.
  

Problem conclusion

• Code has been changed to run the Timer callback method as
  unprotected.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 7.0.0.21.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels

• R61A PSY

     UP

• R61H PSY

     UP

• R61I PSY

     UP

• R61P PSY

     UP

• R61S PSY

     UP

• R61W PSY

     UP

• R61Z PSY

     UP