IC96065: AAA POLICY DOES NOT WORK WITH GENERATED LTPA TOKEN

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • An AAA policy does not work with generated LTPA token when
    running 5.0.0.8 while the same policy works when running
    4.0.2.6.
    
    When this fails, a space (e.g.' ') is added to the distinguished
    name(DN) when generating the LTPA token. For example:
    
    <LTPAUserID>cn=9E1744, ou=swsapins, ou=ssa, o=u.s.government,
    c=us</LTPAUserID>
    
    The DN should not have any spaces.  For example:
    <LTPAUserID>cn=9E1744,ou=swsapins,ou=ssa,o=u.s.government,c=us</
    LTPAUserID>
    

Local fix

  • As a workaround, apply a simple XPath in the map credentials
    where the XPath points to the 'entry' element. The map
    credential step changes the 'entry' attribute 'type' to 'xpath',
     but still pass along the entry value.
    
    This should prevent the name from being formatted with spaces.
    
    To implement the workaround, go to the AAA policy's ?credential
    mapping? tab:
    
    1) Select ?Apply XPath expression? for the Method.
    2) Enter The following:
    
    /*[local-name()='credentials']/*[local-name()='entry']
    
    for the XPath expression.
    
    Here is an example of how this alters the AAA info:
    
    AU
    
    <credentials
    xmlns:dp="http://www.datapower.com/schemas/management"
    xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"
    >
    
        <entry type="xmlfile">
            <OutputCredential
            xmlns="http://www.datapower.com/AAAInfo"
            >admin</OutputCredential>
        </entry>
    
    </credentials>
    
    MC
    
    <mapped-credentials type="xpath" au-success="true"
    xmlns:dp="http://www.datapower.com/schemas/management"
    xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"
    >
    
        <entry type="xpath">admin</entry>
    
    </mapped-credentials>
    
    In this example, the <OutputCredential> from the AAA info file
    is removed, and it takes the data defined by the element, but
    not the elements themselves, and then adds this data to the
    output of the entry type="xpath".
    

Problem summary

  • A user's DN might be formatted with spaces during the generation
     of an LTPA token. The spaces in the DN might cause a valid user
     to be rejected from a WebSphere Application Server.
    

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    IC96065

  • Reported component name

    DPWR SRV GTWAY

  • Reported component ID

    DP905XG45

  • Reported release

    500

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt

  • Submitted date

    2013-09-18

  • Closed date

    2013-10-23

  • Last modified date

    2013-11-13

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    DPWR SRV GTWAY

  • Fixed component ID

    DP905XG45

Applicable component levels

  • R500 PSY

       UP

  • R600 PSY

       UP



Rate this page:

(0 users)Average rating

Add comments

Document information


More support for:

WebSphere DataPower Service Gateway XG45

Software version:

5.0.0

Reference #:

IC96065

Modified date:

2013-11-13

Translate my page

Machine Translation

Content navigation