JR55658: CONCURRENT CALLS TO REST API ASSIGNTOME MIGHT OVERWRITE EACH OTHER

bpm.8570.cf2016.06.delta.repository.1of2
bpm.8570.cf2016.06.delta.repository.2of2
8.5.5.0-WS-BPM-IFJR55658

APAR status

• Closed as program error.

Error description

• If multiple authorized users call the assignToMe REST API
  function at the same time, IBM Business Process Manager (BPM)
  might assign the task to the caller whose request is processed
  last but not send the other callers exceptions. As a result, all
  users might start working on the task. Furthermore, the first
  caller is unable to complete the task because he or she is
  meanwhile not the task owner anymore.
  
     If two different users call task.reassignTo function at the
  same time, it seems that the second call overwrites the first
  call and gets the ownership of the task. If we do the same call
  from bpm rest api, the second user can not get the task.
  
  task.reassignTo(tw.system.org.findUserByName(userName));
  

Local fix

Problem summary

• Because checking the authorization and claiming a task are not
  done in one operation, the authorization check could be
  successful for multiple users, which could lead to multiple
  updates on the task instance.
  

Problem conclusion

• A fix is/will be available for IBM BPM V8.5.5.0 that ensures the
  assignToMe REST API call checks authorization and changes the
  task owner in one operation.
  
  On Fix Central (http://www.ibm.com/support/fixcentral), search
  for JR55658:
  
  1. Select IBM Business Process Manager with your edition from
    the product selector, the installed version to the fix pack
    level, and your platform, and then click Continue.
  
  2. Select APAR or SPR, enter JR55658, and click Continue.
  
  When you download fix packages, ensure that you also download
  the readme file for each fix. Review each readme file for
  additional installation instructions and information about the
  fix.
  

Temporary fix

• Not applicable
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  BPM STANDARD

• Fixed component ID

  5725C9500

Applicable component levels