IT00434: SAML 1.1 TOKENS GIVEN INCORRECT TOKEN TYPE IN LOGIN MODULES

IBM Integration Bus V9.0 - Fix Pack 9.0.0.2

APAR status

• Closed as program error.

Error description

• When using a policyset and policyset binding which specifies a
  SAML v1.1 token this is passed to the WAS login module stack
  with an incorrect token type.
  This causes the WAS code to be unable to locate the token which
  results in the WAS login stack issuing the following error:
  
  CWWSS6521E: The login failed because of an exception:
  javax.security.auth.login.LoginException: No Token
  
  This error text may be observed in the content of a SOAP fault
  or as an insert in a BIP3701E message.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of IBM Integration Bus V9.0 using SAML 1.1 tokens for
  outbound requests.
  
  
  Platforms affected:
  z/OS, MultiPlatform
  
  ****************************************************************
  PROBLEM SUMMARY:
  When using a policyset and a consumer policyset binding which
  specifies a
  SAML v1.1 token this is passed to the WAS login module stack
  with an incorrect token type.
  This causes the WAS code to be unable to locate the token which
  results in the WAS login stack issuing the following error:
  
  CWWSS6521E: The login failed because of an exception:
  javax.security.auth.login.LoginException: No Token
  
  This error text may be observed in the content of a SOAP fault
  or as an insert in a BIP3701E message.
  
  Nodes which may exhibit this error include the SOAPRequest Node,
  SOAPAsyncRequest Node, HTTPRequest Node and HTTPAsyncREquest
  Nodes.
  
  
  There are a number of resource name changes between WebSphere
  Message Broker and IBM Integration Bus Version 9.0. For details
  visit
  http://pic.dhe.ibm.com/infocenter/wmbhelp/v9r0m0/topic/com.ibm.e
  tools.mft.doc/bb23814_.htm
  

Problem conclusion

• IBM Integration Bus has been modified so that the stackable
  login module which passes the token through to the WS-Security
  layer now looks up in the bindings what type of token is
  expected before placing the token in the shared state. This
  prevents the error from occurring in the WAS login module layer.
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v9.0       9.0.0.2
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available, information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  INTEGRATION BUS

• Fixed component ID

  5724J0530

Applicable component levels

• R900 PSY

     UP