PK76656: COM.IBM.WS.WEBCONTAINER.DISABLESECURITYPREINVOKEONFILTERS PREVENTS SECURITYPREINVOKE FROM BEING CALLED PROPERLY.

Fixes are available

APAR status

Closed as program error.

Error description

Session Manager found Webcontainer custom property
com.ibm.ws.webcontainer.disablesecuritypreinvokeonfilters with
the value = true.  This is preventing securityPreInvoke from
being called before calling filters.

Local fix

```
test fix provided
```

Problem summary

****************************************************************
* USERS AFFECTED:  IBM WebSphere Application Server Version 6.1*
*                  and 7.0.0 users.                            *
****************************************************************
* PROBLEM DESCRIPTION: When a SPNEGO TAI is used for           *
*                      authentication, a request for a         *
*                      nonexistent resource which should       *
*                      require a user to authenticate results  *
*                      in a 404 error.                         *
****************************************************************
* RECOMMENDATION:                                              *
****************************************************************
When a request is received for a static file which does not
exist, the WebContainer calls defined servlet filters. If the
filters complete successfully, an error code is not set.
Otherwise, a 404 error code is set. However, when application
security is enabled, a security check is performed as part of
filter invocation and if security fails the WebContainer
considers the filters to have failed. This causes, for example,
a 401 error code set by a Simple and Protected GSS-API
Negotiation Mechanism (SPENGO) trust association interceptor
(TAI) to be replaced by a 404 error. The result is that the
user may not be required to authenticate.

Problem conclusion

The WebContainer has been updated when calling filters on a
request for a nonexistent static resource. If the filters fail
as a result of a security check failure, the error code set by
the security check is returned and is not replaced with a 404
error code. However, to enable the new behavior provided by
this APAR, the WebContainer custom property
com.ibm.ws.webcontainer.assumefiltersuccessonsecurityerror
must be set to true (default is false).

Please refer to the following technote for instructions on
enabling WebContainer custom properties:
http://www.ibm.com/support/docview.wss?rss=180&uid=swg21284395

The fix for this APAR is currently targeted for inclusion in
fix packs 6.1.0.23 and 7.0.0.5.  Please refer to the
Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980

Temporary fix

Comments

APAR Information

APAR number
PK76656
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
61W
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2008-12-01
Closed date
2008-12-18
Last modified date
2008-12-18

APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800

Applicable component levels

R61A PSY
UP
R61H PSY
UP
R61I PSY
UP
R61P PSY
UP
R61S PSY
UP
R61W PSY
UP
R61Z PSY
UP
R700 PSY
UP

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"6.1","Line of Business":{"code":"LOB45","label":"Automation"}}]

Document Information

Modified date:
29 December 2021

Tips

PK76656: COM.IBM.WS.WEBCONTAINER.DISABLESECURITYPREINVOKEONFILTERS PREVENTS SECURITYPREINVOKE FROM BEING CALLED PROPERLY.

Fixes are available

Subscribe

APAR status

Closed as program error.

Error description

Local fix

Problem summary

Problem conclusion

Temporary fix

Comments

APAR Information

APAR number

Reported component name

Reported component ID

Reported release

Status

PE

HIPER

Special Attention

Submitted date

Closed date

Last modified date

APAR is sysrouted FROM one or more of the following:

APAR is sysrouted TO one or more of the following:

Fix information

Fixed component name

Fixed component ID

Applicable component levels

R61A PSY

R61H PSY

R61I PSY

R61P PSY

R61S PSY

R61W PSY

R61Z PSY

R700 PSY

Document Information

Share your feedback

Need support?