PK34390; 6.1.0.5: unauthenticated HTTP requests are redirected to the error page
Downloadable files
Abstract
When an unauthenticated IBM® HTTP Server request comes without passing through a security proxy server, the request is redirected to an error page.
Download Description
PK34390 resolves the following problem:
ERROR DESCRIPTION:
This issue is newly observed after applying PK27074. As a design change of PK27074, When Trust Association Intercepters(TAI) is enabled and a form login page is configured by the application deployment descriptor, incoming requests, which do not have TAI header information, are always redirected to the error page. These requests needs to be redirected to the login page.
The expected behavior should be as follows:
1) If TAI doesn't handle request, then the request redirects to the login page.
2) If TAI handles the request and returns Subject or user name, but IBM WebSphere Application Server fails to map the user, then the request redirects to the error page.
USERS AFFECTED:
WebSphere Application Server version 6 users who are using Trust Association Interceptors.
PROBLEM DESCRIPTION:
When an unauthenticated HTTP request comes without passing through a security proxy server, the request is redirected to an error page.
RECOMMENDATION:
None
The security code treats incoming requests, which do not have any attributes of Trust Association Interceptors, as an error condition. When this condition happens, Application Server redirects such requests to the error page. As a result, there is no way to access protected resources without passing through a security proxy server, because Application Server doesn't redirect such requests to a login page.
Note that this problem happens on Application Server version 6.0.2.13 or later, and 6.1.0.3 or later.
PROBLEM CONCLUSION:
With this fix, when a request does not have any attributes for TAI, Application Server redirects it to a login page.
The fix for this APAR is currently targeted for inclusion in fixpack 6.0.2.19 and 6.1.0.7. Please refer to the
IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.
Rate this page
Please take a moment to complete this form to help us better serve you.
