JR50675: BPEL PROCESS ENGINE DOES NOT CORRECTLY EVALUATE JAVA EE ROLE-BASED AUTHORIZATION

8.5.5.0-WS-BPM-IFJR50675
Version 8.5 Refresh Pack 6 for the IBM Business Process Manager products
Version 8.5.0 Fix Pack 2 for the IBM Business Process Manager products

APAR status

• Closed as program error.

Error description

• Authorization to read or manipulate BPEL process data can be
  granted either by using process instance-based authorization
  roles (such as reader, editor, potential owner, owner,
  administrator) or by assigning users or groups to the
  BPESystemAdministrator or BPESystemMonitor Java EE roles. Users
  or groups in the BPESystemMonitor role are not correctly checked
  to determine if they are authorized to perform actions on
  processes or activity instances.
  

Local fix

Problem summary

• Because the BPESystemMonitor Java EE role is not being honored,
  users in this role are not granted correct permissions on
  process instances.
  

Problem conclusion

• A fix is available for IBM BPM V8.5.0.1 that adds the check for
  the BPESystemMonitor role.
  
  On Fix Central (http://www.ibm.com/support/fixcentral), search
  for JR50675:
  
  1. Select IBM Business Process Manager with your edition from
    the product selector, the installed version to the fix pack
    level, and your platform, and then click Continue.
  
  2. Select APAR or SPR, enter JR50675, and click Continue.
  
  When you download fix packages, ensure that you also download
  the readme file for each fix. Review each readme file for
  additional installation instructions and information about the
  fix.
  

Temporary fix

• Not applicable
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM ADVANCED

• Fixed component ID

  5725C9400

Applicable component levels

• R850 PSY

     UP