A fix is available
APAR status
Closed as program error.
Error description
REST API behavior changed in IBM Business Process Manager (BPM) V8.5.6.0. Security authentication has been enhanced and only users who have administrative rights may access the /system/env/variable or /rest/bpm/wle/v1/processModel/<bpd_id> API. Tasks owners or users who have project rights may not access these APIs.
Local fix
Problem summary
PRODUCTS AFFECTED IBM BPM Advanced IBM BPM Standard IBM BPM Express LOCAL FIX - None PROBLEM SUMMARY This behavior change on IBM BPM V8.5.6.0 might cause applications that have been migrated from previous IBM BPM versions to fail. Previously, all users could call these APIs to query for process application data and parse the response for further processing. However, now runtime non-admin users may no longer access that information and they might experience unexpected application behavior.
Problem conclusion
The fix is available for IBM BPM V8.5.6.0. With the fix applied, only users part of the admin group may use the processApps APIs if you enable the <enforce-rest-admin-auth> property on the IBM Process Server environment. On the IBM Process Center environment, only users who are part of the admin group or part of the project authoring group may use the processApps APIs. By default, this property is disabled (false) and all authenticated IBM BPM users may access to these APIs, which is the behavior prior to V8.5.6.0. On Fix Central (http://www.ibm.com/support/fixcentral), search for JR54212: 1. Select IBM Business Process Manager with your edition from the product selector, the installed version to the fix pack level, and your platform, and then click Continue. - Select APAR or SPR, enter JR54212, and click Continue. - When you download fix packages, ensure that you also download the readme file for each fix. Review each readme file for additional installation instructions and information about the fix.
Temporary fix
Comments
APAR Information
APAR number
JR54212
Reported component name
BPM ADVANCED
Reported component ID
5725C9400
Reported release
856
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt / Xsystem
Submitted date
2015-09-09
Closed date
2015-11-23
Last modified date
2016-10-13
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
BPM ADVANCED
Fixed component ID
5725C9400
Applicable component levels
R856 PSY
UP
[{"Business Unit":{"code":"BU053","label":"Cloud & Data Platform"},"Product":{"code":"SSFTN5","label":"IBM Business Process Manager Advanced"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"856","Line of Business":{"code":"LOB45","label":"Automation"}}]
Document Information
Modified date:
14 October 2021