PH39883: THE USER "unauthenticated" (in lower case) ASSERTED BY TRUSTASSOCIATIONINTERCEPTOR IS NO LONGER AUTHENTICATED

APAR status

• Closed as program error.

Error description

• In the distributed environment,  WebSphere has the reserved
  username "UNAUTHENTICATED".  When this user name is passed in
  from a custom Trust Association Interceptor (TAI) or a custom
  LoginModule, the user is treated as an unauthenticated user.
  
  
  After PH21890 (8.5.5.18 and 9.0.5.4), the user
  "unauthenticated" is also treated as unauthenticated user as the
  condition check inadvertently included "ignoreCase" operation.
  In the prior fixpack, the user went through authentication
  process.
  
  
  In the zOS environment, WebSphere's reserved username for the
  unauthenticated user is configurable.
  (com.ibm.security.SAF.unauthenticated) .  Since the username is
  all upper case, this APAR does not apply to the WebSphere on zOS
  platform.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server who asserts a user named             *
  *                  "unauthenticated" user in lower case from   *
  *                  Trust Association Interceptor (TAI)         *
  ****************************************************************
  * PROBLEM DESCRIPTION: The user "unauthenticated" from TAI was *
  *                      no longer authenticated after PH21890.  *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  Due to a bug in PH21890, the user named
  "unauthenticated" (all lowercase) returned from a custom TAI or
  a custom login module was automatically treated as
  unauthenticated user. Prior to the APAR, the user was
  authenticated against the user registry.
  Note 1: The username "UNAUTHENTICATED" in all uppercase is
  reserved username. When this username is returned from a custom
  TAI, or a custom LoginModule, the user is treated as an
  unauthenticated user as designed.
  Note 2: This APAR does not apply to WebSphere configured with
  SAF user registry where the reserved unauthenticated user string
  depends on the value of com.ibm.security.SAF.unauthenticated.
  Note 3: Fixpacks affected by PH21890 are 9.0.5.4-9.0.5.10,
  8.5.5.18-8.5.5.21
  

Problem conclusion

• The bug has been fixed.
  
  The fix for this APAR is targeted for inclusion in fix pack
  8.5.5.22 and 9.0.5.11. For more information, see 'Recommended
  Updates for WebSphere Application Server':
  https://www.ibm.com/support/pages/node/715553
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  WEBS APP SERV N

• Fixed component ID

  5724H8800

Applicable component levels