JR44299: ATTACHED DOCUMENTS CAN'T BE VIEWED

Version 8.0 Refresh Pack 1 for the IBM Business Process Manager products
Version 7.5.1 Fix Pack 2 for the IBM Business Process Manager products

APAR status

• Closed as program error.

Error description

• In this scenario the setup is as follows,
  
  - There are two processes: BPD A and B
  - BPD A has two sequential tasks: Attach and View Document.
  - BPD B has a single task: View Document.
  - There are two users in the same participan group: User 1 and 2
  - BPD A and B are exposed to the participant group.
  
  Reproduction steps,
  1. User 1 runs BPD A and claims the Attached Doc task and
  creates a document.
  2. User 2 runs BPD B and claims the View Doc task to see the
  document created by User 1.
  RESULT: User 2 is told that he/she is not authorized.
  

Local fix

Problem summary

• USER AFFECTED:
  ==> Users who have BPM documents created and accessed from
  different BPDs
  
  PROBLEM SUMMARY:
  ==> Users claiming tasks in one BPD cannot see document content
  created by another BPD, also accessible by them.
  
  PROBLEM DETAILED DESCRIPTION:
  ==> The default implementation for the authorization API shipped
  with the product did not do the proper checking to determine
  whether a user, requesting to see the content of a document, had
  the right access to the process instance that created the
  document.
  
  The implementation only checked if the user could claim a task
  in the process.  If no tasks where available the user would be
  denied access.  This behaviour is incorrect.  The implementaiton
  needed to check
  if the user could work on any tasks in the owning process,
  regardless of whether any were available, as this would imply
  the user could also read the document content.
  

Problem conclusion

• Fix available for 7.5.1.1 on Fix Central,
  http://www.ibm.com/support/fixcentral/
  Fix is also planned to be delivered in next cumulative
  maintenance deliverable for 8.0.1.
  
  The fix modified the AuthorizationAPI implementation to check
  access as described in the detailed description section above.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM STANDARD

• Fixed component ID

  5725C9500

Applicable component levels

• R751 PSY

     UP

• R801 PSY

     UP