Fixes are available
8.5.5.3: WebSphere Application Server V8.5.5 Fix Pack 3
8.5.5.4: WebSphere Application Server V8.5.5 Fix Pack 4
8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.17: WebSphere Application Server V8.5.5 Fix Pack 17
8.5.5.20: WebSphere Application Server V8.5.5.20
8.5.5.18: WebSphere Application Server V8.5.5 Fix Pack 18
8.5.5.19: WebSphere Application Server V8.5.5 Fix Pack 19
8.5.5.16: WebSphere Application Server V8.5.5 Fix Pack 16
8.5.5.21: WebSphere Application Server V8.5.5.21
APAR status
Closed as program error.
Error description
When using WAS 8.5.0.2 with the OAuth 2.0 functionality, "bearer" is used as token_type in OAuth 2.0 access token response. This may cause problems if subsequent processing expects "Bearer" as token_type, as per RFC 6750. An example of such a response is: { "access_token":"v8nMdCW3CIW569RLldcL9FvcgzZJtyFGt1y1QEvx", "token_type":"bearer", "expires_in":3599, "scope":"" }
Local fix
Outside vendors integrating with our systems have to add extra code to work around the token response being incorrect.
Problem summary
**************************************************************** * USERS AFFECTED: All users of IBM WebSphere Application * * Server. * **************************************************************** * PROBLEM DESCRIPTION: Should use "Bearer" as token_type * * when sending OAuth 2.0 access token * * response. * **************************************************************** * RECOMMENDATION: * **************************************************************** When using WAS 8.5.0.2 with the OAuth 2.0 functionality, "bearer" is used as token_type in OAuth 2.0 access token response. This may cause problems if subsequent processing expects "Bearer" as token_type, as per RFC 6750. An example of such a response is: { "access_token":"v8nMdCW3CIW569RLldcL9FvcgzZJtyFGt1y1QEvx", "token_type":"bearer", "expires_in":3599, "scope":"" }
Problem conclusion
We have updated the token_type to use "Bearer". The fix for this APAR is currently targeted for inclusion in fix pack 8.5.5.3. Please refer to the Recommended Updates page for delivery information: http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
Temporary fix
Comments
APAR Information
APAR number
PI11907
Reported component name
WEBS APP SERV N
Reported component ID
5724H8800
Reported release
850
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2014-02-17
Closed date
2014-02-28
Last modified date
2014-02-28
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
WEBS APP SERV N
Fixed component ID
5724H8800
Applicable component levels
R850 PSY
UP
Document Information
Modified date:
28 April 2022