PM19604; 7.0.0.11: spnego web authentication always interacts with spnego interc

Download Description

PM19604 resolves the following problem:

ERROR DESCRIPTION:
Lotus application on WebSphere Application Server 7.0 SPNEGO always tries to authenticate for all URI's even though that are not protected. This is a problem when using browser outside the domain.

In v6.1 this is not happening and it is working correctly. Able to access the application without authenticate when using browser outsidethe domain

Difference In v6.1 it will use spnego tai on v7.0 it will use spnego web authentication.

LOCAL FIX:
n/a

PROBLEM SUMMARY

USERS AFFECTED:
All users of IBM WebSphere Application Server version 7.0 with SPNEGO WEB authentication enabled

PROBLEM DESCRIPTION:
A custom property "com.ibm.websphere.security.performTAIForUnprotectedURI" is not effective to SPNEGO WEB authentication

RECOMMENDATION:
None

The custom property "com.ibm.websphere.security.performTAIForUnprotectedURI", which was introduced in WebSphere Application Server version 6.1 is for enabling or disabling interactions to Trust Association Interceptors(TAI) when target URIs are not protected. On WebSphere Application Server version 7.0, SPNEGO WEB Authentication is introduced as a successor of SPNEGO TAI.
However, the value of custom property is not honored by SPNEGO WEB Authentication.

PROBLEM CONCLUSION:
With this fix, SPNEGO WEB Authentication honors the value of the custom property.

The fix for this APAR is currently targeted for inclusion in Fix Pack 7.0.0.13. Refer to the Recommended Updates page for delivery information:
http://www.ibm.com/support/docview.wss?uid=swg27004980