PM90897: LIBERTY PROFILE SECURITY THROWS SERVLET RESPONSE CLASSCASTEXCEPTION

8.5.5.1: WebSphere Application Server V8.5.5 Fix Pack 1
8.5.5.2: WebSphere Application Server V8.5.5 Fix Pack 2
8.5.5.3: WebSphere Application Server V8.5.5 Fix Pack 3
8.5.5.4: WebSphere Application Server V8.5.5 Fix Pack 4
8.5.5.5: WebSphere Application Server V8.5.5 Fix Pack 5
8.5.5.6: WebSphere Application Server V8.5.5 Fix Pack 6
8.5.5.7: WebSphere Application Server V8.5.5 Fix Pack 7
8.5.5.8: WebSphere Application Server V8.5.5 Fix Pack 8
8.5.5.9: WebSphere Application Server V8.5.5 Fix Pack 9
8.5.5.10: WebSphere Application Server V8.5.5 Fix Pack 10
8.5.5.11: WebSphere Application Server V8.5.5 Fix Pack 11
8.5.5.12: WebSphere Application Server V8.5.5 Fix Pack 12
8.5.5.13: WebSphere Application Server V8.5.5 Fix Pack 13
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14
8.5.5.15: WebSphere Application Server V8.5.5 Fix Pack 15
8.5.5.14: WebSphere Application Server V8.5.5 Fix Pack 14

APAR status

• Closed as program error.

Error description

• Liberty profile Using Spring security causes
  java.langClassCastException with
  com.ibm.wsspi.webcontainer.servlet.IExtendedResponse
  
  Exception:
  
  
  source=com.ibm.ws.webcontainer
  class=com.ibm.ws.webcontainer.internal.WebContainer
  method=handleRequest org= prod= component=
            SRVE0232E: Internal Server Error. <br> Exception
  Message: [com.ibm.ws.webcontainer.webapp.WebAppErrorReport:
  java.lang.ClassCastException:
  org.springframework.security.web.context.HttpSessionSecurityCont
  extRepository$SaveToSessionResponseWrapper incompatible with
  com.ibm.wsspi.webcontainer.servlet.IExtendedResponse
   at
  com.ibm.ws.webcontainer.webapp.WebAppErrorReport.constructErrorR
  eport(WebAppErrorReport.java:153)
   at
  com.ibm.ws.webcontainer.webapp.WebAppErrorReport.constructErrorR
  eport(WebAppErrorReport.java:197)
   at
  com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters
  (WebAppFilterManager.java:1126)
   at
  com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:
  4290)
   at
  com.ibm.ws.webcontainer.webapp.WebGroup.handleRequest(WebGroup.j
  ava:302)
  
  Caused by: java.lang.ClassCastException:
  org.springframework.security.web.context.HttpSessionSecurityCont
  extRepository$SaveToSessionResponseWrapper incompatible with
  com.ibm.wsspi.webcontainer.servlet.IExtendedResponse
   at
  com.ibm.ws.webcontainer.security.SSOCookieHelperImpl.removeSSOCo
  okieFromResponse(SSOCookieHelperImpl.java:142)
   at
  com.ibm.ws.webcontainer.security.SSOCookieHelperImpl.addSSOCooki
  esToResponse(SSOCookieHelperImpl.java:79)
   at
  com.ibm.ws.webcontainer.security.internal.FormLoginExtensionProc
  essor.formLogin(FormLoginExtensionProcessor.java:162)
   at
  com.ibm.ws.webcontainer.security.internal.FormLoginExtensionProc
  essor.handleRequest(FormLoginExtensionProcessor.java:109)
   at
  com.ibm.ws.webcontainer.filter.WebAppFilterChain.invokeTarget(We
  bAppFilterChain.java:127)
   at
  com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebApp
  FilterChain.java:88)
  

Local fix

• n/a
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:  All users of IBM WebSphere Application      *
  *                  Server Liberty Profile                      *
  ****************************************************************
  * PROBLEM DESCRIPTION: A class cast exception is thrown for    *
  *                      an incompatible servlet response class  *
  *                      from WebSphere Application Server       *
  *                      Liberty Profile.                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  ****************************************************************
  A class cast exception was thrown for a web request during
  a form login when web application security is enabled.  The
  exception thrown is as follows,
  java.lang.ClassCastException:
  the.incompatible.servletResponseClass incompatible with
  com.ibm.wsspi.webcontainer.servlet.IExtendedResponse
  at
  com.ibm.ws.webcontainer.security.SSOCookieHelperImpl.removeSSOCo
  okieFromResponse(SSOCookieHelperImpl.java:142)
  

Problem conclusion

• The code was modified to prevent the class cast exception.
  
  The fix for this APAR is currently targeted for inclusion in
  fix pack 8.5.5.1. Please refer to the Recommended Updates page
  for delivery information:
  http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  LIBERTY PROFILE

• Fixed component ID

  5724J0814

Applicable component levels

• R850 PSY

     UP