IT37694: WWW-Authenticate header value may contain more than one challenge

APAR status

• Closed as program error.

Error description

• When Integrated Windows Authentication is enabled, it is
  possible that a request message can return more than one
  challenge type (NTLM, Negotiate, NEGO2, etc.), depending on your
  configuration.
  
  If multiple are configured, they are being returned as a comma
  separated list like:
  WWW-Authenticate: Negotiate, NTLM
  
  While this is acceptable by the standards, some clients may not
  correctly parse the combined header, believing both challenges
  to be a single challenge that is malformed.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All users of IBM App Connect Enterprise V11 who uses Integrated
  Windows Authentication.
  
  
  Platforms affected:
  MultiPlatform
  
  ****************************************************************
  PROBLEM DESCRIPTION:
  When Integrated Windows Authentication (IWA) is enabled,  the
  server(ACE) can return more than one challenge through
  WWW-Authenticate header such as NTLM,  Negotiate, NEGO2, etc.
  depending on the configuration. They are being returned as a
  comma-separated list like below  :
  
  WWW-Authenticate: Negotiate, NTLM.
  
  Though this format is acceptable as per standards, some clients
  may fail to parse the combined header. Clients may expect
  multiple <span style="background-color:rgb(255, 255,
  255)">WWW-Authenticate headers when there are more than one
  values like below </span>
  
  <span style="background-color:rgb(255, 255,
  255)">WWW-Authenticate: Negotiate
  WWW-Authenticate: NTLM.</span>
  

Problem conclusion

• The product is fixed to avoid using comma-separated values in
  <span style="background-color:rgb(255, 255,
  255)">WWW-Authenticate header. Instead for each value, a new
  header is created.</span>
  
  ---------------------------------------------------------------
  The fix is targeted for delivery in the following PTFs:
  
  Version    Maintenance Level
  v11.0      11.0.0.14
  v12.0      12.0.2.0
  
  The latest available maintenance can be obtained from:
  http://www-01.ibm.com/support/docview.wss?rs=849&uid=swg27006041
  
  If the maintenance level is not yet available,information on
  its planned availability can be found on:
  http://www-1.ibm.com/support/docview.wss?rs=849&uid=swg27006308
  ---------------------------------------------------------------
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  APP CONNECT ENT

• Fixed component ID

  5724J0550

Applicable component levels