PK90859: WEB SERVICE PROVIDER SECURED WITH BASIC AUTH MAY FAIL WHEN THINCLIENT CONSUMER PROMPTS FOR LOGIN CREDENTIALS

Java SDK 1.5 SR10 Cumulative Fix for WebSphere Application Server
6.1.0.29: Java SDK 1.5 SR11 Cumulative Fix for WebSphere Application Server
6.1.0.31: Java SDK 1.5 SR11 FP1 Cumulative Fix for WebSphere Application Server
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• An attempt is made to invoke a web service protected by
  basic authentication security by using the unmanaged
  Feature Pack for Web Services 6.1 thinclient with the JVM
  property:
  
  -Dcom.ibm.ws.webservices.loginSource=stdin
  
  to prompt the user for the username/password, but is failing
  with a very non-descript message.
  
  The expected messages is apparently not being returned.
  This is the failure seen in standard output as:
  
  Expected the output string to contain "Response: <provider>
  <message>request processed</message></provider>", but instead
  contained:
  
  junit.framework.AssertionFailedError: Expected the output
  string to contain "Response: <provider><message>request
  processed</message></provider>", but instead contained:
  at wasintegration.basicauth.wsfvt.test.StdInTest.
  testBasicAuthStdinProperty(StdInTest.java:160)
  
  In the unmanaged client trace, a NoClassDefFound error
  seems to point to the root of the issue, and appears
  around the part where it says "challengeRealmInfo" in
  the trace excerpt below:
  
  [1/23/09 15:16:01:343 CST] 0000000a BasicAuthProm E
  WSWS7002E:
  The following exception occurred: java.lang.reflect.
  InvocationTargetException
  at sun.reflect.NativeConstructorAccessorImpl.
  newInstance0(Native Method)
  at sun.reflect.NativeConstructorAccessorImpl.
  newInstance(NativeConstructorAccessorImpl.java:67)
  at sun.reflect.DelegatingConstructorAccessorImpl.
  newInstance(DelegatingConstructorAccessorImpl.java:45)
  at java.lang.reflect.Constructor.
  newInstance(Constructor.java:521)
  at com.ibm.ws.websvcs.transport.security.
  BasicAuthPromptStdIn.launch(BasicAuthPromptStdIn.java:96)
  at com.ibm.ws.websvcs.transport.http.SOAPOverHTTPSender$1.
  run(SOAPOverHTTPSender.java:1229)
  ...
  Caused by: java.lang.NoClassDefFoundError:
  com.ibm.wsspi.security.
  auth.WSSubjectWrapper
  at java.lang.J9VMInternals.verifyImpl(Native Method)
  at java.lang.J9VMInternals.verify(J9VMInternals.java:66)
  at java.lang.J9VMInternals.
  initialize(J9VMInternals.java:127)
  at java.lang.Class.forNameImpl(Native Method)
  at java.lang.Class.forName(Class.java:130)
  at com.ibm.ws.security.core.ContextManagerFactory.
  getInstance(ContextManagerFactory.java:75)
  at com.ibm.ws.security.core.ContextManagerFactory.
  <init>(ContextManagerFactory.java:201)
  at com.ibm.ws.security.core.ContextManagerFactory.
  <clinit>(ContextManagerFactory.java:49)
  at java.lang.J9VMInternals.initializeImpl(Native Method)
  at java.lang.J9VMInternals.initialize(J9VMInternals.java:192)
  at com.ibm.ws.security.auth.WSLoginHelperImpl.
  getDefaultRealmName(WSLoginHelperImpl.java:1081)
  at com.ibm.websphere.security.auth.callback.
  WSStdinCallbackHandlerImpl.<init>(WSStdinCallbackHandlerImpl.
  java:90)
  ... 21 more
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server v6.1 JAX-WS Web Service providers    *
  *                  protected by basic authentication, that     *
  *                  communicate with consumers using the        *
  *                  JAX-WS thinclient                           *
  ****************************************************************
  * PROBLEM DESCRIPTION: Web service call using JAX-WS           *
  *                      thinclient to a provider protected by   *
  *                      basic authentication may fail to        *
  *                      prompt for username.                    *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  After the failed JAX-WS thinclient web service call is made to
  the web service protected by basic authentication security:
  the main exception seen is a NoClassDefFoundError asking for
  the com.ibm.wsspi.security.auth.WSSubjectWrapper class:
  
  ...
  Caused by: java.lang.NoClassDefFoundError:
  com.ibm.wsspi.security.
  auth.WSSubjectWrapper
  at java.lang.J9VMInternals.verifyImpl(Native Method)
  at java.lang.J9VMInternals.verify(J9VMInternals.java:66)
  ...
  at java.lang.J9VMInternals.initialize(J9VMInternals.java:192)
  at com.ibm.ws.security.auth.WSLoginHelperImpl.
  getDefaultRealmName(WSLoginHelperImpl.java:1081)
  at com.ibm.websphere.security.auth.callback.
  WSStdinCallbackHandlerImpl.<init>(WSStdinCallbackHandlerImpl.
  java:90)
  ... 21 more
  
  This only happens when the thinclient is used with the web
  service consumer. When using a managed client, this
  exception does not occur.
  

Problem conclusion

• The issue was corrected by adding missing classes to the
  JAX-WS thinclient.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 6.1.0.27.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  PK90885

Fix information

• Fixed component name

  WEBSERVIC FEATU

• Fixed component ID

  5724J0850

Applicable component levels

• R610 PSY

     UP