PM07733: WS-SECURITY JAX-WS GENERAL CUSTOM PROPERTY HIERARCHY DOES NOT ALWAYS WORK AS EXPECTED

PM08360; 6.1.0.9: Potential security exposure with JAX-WS WS-Security runtime
6.1.0.33: Java SDK 1.5 SR12 FP1 Cumulative Fix for WebSphere
6.1.0.35: Java SDK 1.5 SR12 FP2 Cumulative Fix for WebSphere
6.1.0.37: Java SDK 1.5 SR12 FP3 Cumulative Fix for WebSphere
6.1.0.47: WebSphere Application Server V6.1 Fix Pack 47
6.1.0.39: Java SDK 1.5 SR12 FP4 Cumulative Fix for WebSphere Application Server
6.1.0.41: Java SDK 1.5 SR12 FP5 Cumulative Fix for WebSphere Application Server
6.1.0.43: Java SDK 1.5 SR13 Cumulative Fix for WebSphere Application Server
6.1.0.45: Java SDK 1.5 SR14 Cumulative Fix for WebSphere Application Server
6.1.0.47: Java SDK 1.5 SR16 Cumulative Fix for WebSphere Application Server

APAR status

• Closed as program error.

Error description

• When a general custom property is specified in a WS-Security
  binding, the WS-Security JAX-WS runtime may not behave as
  expected with regards to that custom property.
  
  For example, consider the following custom property specified
  as a general Outbound Custom property in a general binding:
  
  com.ibm.wsspi.wssecurity.config.request.setMustUnderstand
  
  When an application uses the general binding, the WS-Security
  runtime uses the default setting instead of the user's
  specified value.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  IBM WebSphere Application Server Feature    *
  *                  Pack for Web Services users of              *
  *                  WS-Security enabled JAX-WS web services     *
  *                  applications                                *
  ****************************************************************
  * PROBLEM DESCRIPTION: WS-Security JAX-WS general custom       *
  *                      properties may not behave as expected   *
  ****************************************************************
  * RECOMMENDATION:  Install a fixpack that contains this APAR   *
  ****************************************************************
  When a general custom property is specified in a WS-Security
  JAX-WS custom binding, the WS-Security runtime may not behave
  as expected with regards to that custom property.
  
  There is more than one manifestation of this problem:
  
  * If the property is specified in a general binding, it will
  not be effective at all.
  * If the property is specified in a general binding, it will
  only be effective if the general binding itself is attached to
  the application.  When using an application specific binding,
  the setting of a custom property in the default general
  binding is not detected.
  

Problem conclusion

• The WS-Security JAX-WS runtime is not merging the properties
  from the default general binding with the ones from the
  application specific binding.  Also, the custom property
  setting has to be inspected in three places: initialization of
  the application specific binding, initialization of the
  default general binding, and merging of the two at runtime,
  which causes too much room for error when adding new custom
  properties.
  
  The runtime is updated to first set up the general custom
  property hierarchy properly in the following priority order:
  
  1) Inbound/Outbound (Application specific binding)
  2) Inbound and Outbound (Application specific binding)
  3) Inbound/Outbound (General binding)
  4) Inbound and Outbound (General binding)
  
  This behavior is prescribed in the information center:
  
  http://publib.boulder.ibm.com/infocenter/wasinfo/fep/topic/com.i
  bm.websphere.nd.multiplatform.doc/info/ae/ae/uwbs_wsscustomprop.
  html
  
  The runtime is also updated to require only a single
  inspection for a custom property in the merged custom property
  list to prevent similar errors in the future.
  
  Properties that are affected include:
  
  com.ibm.wsspi.wssecurity.config.disableWSSIfApplicationSecurityD
  isabled
  com.ibm.wsspi.wssecurity.config.response.forceMustUnderstandEqua
  lsOne
  com.ibm.wsspi.wssecurity.config.request.setMustUnderstand
  com.ibm.wsspi.wssecurity.consumer.checkOperationLevelPolicies
  
  The WS-Security general custom properties are accessed as
  follows:
  
  (bindingName)->WS-Security->Custom properties
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 6.1.0.33.  Please refer to the Recommended Updates
  page for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  PM07663

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBSERVIC FEATU

• Fixed component ID

  5724J0850

Applicable component levels

• R610 PSY

     UP