IBM Support

IT14302: JSON WEB SECURITY CORRECTIONS AND ENHANCEMENTS

Subscribe

You can track all active APARs for this component.

APAR status

  • Closed as program error.

Error description

  • DataPower Gateway has the following JSON web security problems:
    
    (1) Although the header contains a JWK, DataPower rejects a
    validly signed, encrypted, or signed and encrypted JSON message.
    
    (2) The JWK that DataPower generates might exclude the key type.
    
    To improve JWT validation with AAA, added PCRE support to
    replace basic string comparison.
    

Local fix

Problem summary

  • DataPower Gateway has the following JSON web security problems:
    (1) Although the header contains a JWK, DataPower rejects a
    validly signed, encrypted, or signed and encrypted JSON message.
    (2) The JWK that DataPower generates might exclude the key type.
    
    To improve JWT validation with AAA, added PCRE support to
    replace basic string comparison.
    

Problem conclusion

Temporary fix

Comments

APAR Information

  • APAR number

    IT14302

  • Reported component name

    DATAPOWER

  • Reported component ID

    DP1234567

  • Reported release

    720

  • Status

    CLOSED PER

  • PE

    NoPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2016-03-14

  • Closed date

    2016-03-20

  • Last modified date

    2016-03-20

  • APAR is sysrouted FROM one or more of the following:

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    DATAPOWER

  • Fixed component ID

    DP1234567

Applicable component levels

  • R720 PSY

       UP



Document information

More support for: IBM DataPower Gateways
General

Software version: 7.2

Reference #: IT14302

Modified date: 20 March 2016