PH05262: Calling request.login() from a servlet does not sync the ID to the thread

APAR status

• Closed as program error.

Error description

• When using HttpServletRequest.login() to log in a user, the
  ThreadIdentityService is not called to sync the user to the
  thread.  The TCBSENV field is not updated.  This results in
  some native language callers receiving the unauthenticated
  user from TCBSENV after the login completes.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty for z/OS                     *
  ****************************************************************
  * PROBLEM DESCRIPTION: The ThreadIdentityService is not called *
  *                      to change the authenticated user when   *
  *                      an HttpServletRequest.login() is        *
  *                      successful.                             *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  The ThreadIdentityService is used to implement the
  SyncToOSThread function.  This allows the TCBSENV field in the
  TCB control block, to be in sync with the Subject that has been
  authenticated and is currently attached to the Java thread.
  When HttpServletRequest.login() is called, the Java thread is
  updated with the authenticated Subject, but the TCBSENV field is
  not updated.  This leads to inconsistent behavior between Java
  applications asking for the current user, and native language
  applications reading the TCBSENV field.
  

Problem conclusion

• Code was added to sync the user to the TCBSENV when
  HttpServletRequest.login() is called, and SyncToOSThread is
  correctly configured.
  
  The fix for this APAR is currently targeted for inclusion in fix
  pack 19.0.0.1.  Please refer to the Recommended Updates page for
  delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  LIBERTY PROF -

• Fixed component ID

  5655W6514

Applicable component levels

• RCD0 PSY

     UP