JR54212: YOU REQUIRE ADMIN RIGHTS TO RUN THE /SYSTEM/ENV/VARIABLE AND /PROCESSMODEL REST APIs IN V8.5.6.0

Version 8.5 Refresh Pack 7 for the IBM Business Process Manager products

APAR status

• Closed as program error.

Error description

• REST API behavior changed in IBM Business Process Manager (BPM)
  V8.5.6.0. Security authentication has been enhanced and only
  users who have administrative rights may access the
  /system/env/variable or /rest/bpm/wle/v1/processModel/<bpd_id>
  API.
  
  Tasks owners or users who have project rights may not access
  these APIs.
  

Local fix

Problem summary

• PRODUCTS AFFECTED
  IBM BPM Advanced
  IBM BPM Standard
  IBM BPM Express
  
  
  
  LOCAL FIX -
  None
  
  
  PROBLEM SUMMARY
  This behavior change on IBM BPM V8.5.6.0 might cause
  applications that have been migrated from previous IBM BPM
  versions to fail. Previously, all users could call these APIs to
   query for process application data and parse the response for
  further processing. However, now
  runtime non-admin users may no longer access that information
  and they might experience unexpected application behavior.
  

Problem conclusion

• The fix is available for IBM BPM V8.5.6.0. With the fix applied,
   only users part of the admin group may use the processApps APIs
   if you enable the <enforce-rest-admin-auth> property on the IBM
   Process Server environment. On the IBM Process Center
  environment, only users who are part of the admin group or part
  of the project authoring group may use the processApps APIs. By
  default, this property is disabled (false) and all authenticated
   IBM BPM users may access to these APIs, which is the behavior
  prior to V8.5.6.0.
  
  
  On Fix Central (http://www.ibm.com/support/fixcentral), search
  for JR54212:
  
  
  1. Select IBM Business Process Manager with your edition from
  the product selector, the installed version to the fix pack
  level, and your platform, and then click Continue.
   -
  Select APAR or SPR, enter JR54212, and click Continue.
   -
  When you download fix packages, ensure that you also download
  the readme file for each fix. Review each readme file for
  additional installation instructions and information about the
  fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM ADVANCED

• Fixed component ID

  5725C9400

Applicable component levels

• R856 PSY

     UP