Fix (APAR):  PI34326

Status:  Fix

Release:  8.5.5.5,8.5.5.4,8.5.5.3

Operating System:  AIX,HP-UX,IBM i,Linux,Solaris,Windows,z/OS

Supersedes Fixes:  

CMVC Defect:  xxxxxx

Byte size of APAR:  254812

Date: 2015-05-29

Abstract:  frequent wsopaquetoken w secj5003w: errors in systemout.log when using oauth tai

Description/symptom of problem:  
PI34326 resolves the following problem:

ERROR DESCRIPTION:                                              
Client is seeing following message in SystemOut.log very        
frequently.                                                     
                                                                
CompoundClass > loadClass                                       
com.ibm.ws.security.oauth20.token.impl.WSOAuth20TokenImpl       
this=com.ibm.ws.classloader.CompoundClassLoader@4aeb5665[PL][app
war:Communities] Entry                                          
                                                                
CompoundClass < loadClass                                       
com.ibm.ws.security.oauth20.token.impl.WSOAuth20TokenImpl       
failed Exit                                                     
java.lang.ClassNotFoundException:                               
com.ibm.ws.security.oauth20.token.impl.WSOAuth20TokenImpl       
                                                                
WSOpaqueToken W   SECJ5003W: An error occurred while            
de-serializing a custom object from the inbound authorization   
token.  This does not cause the request to fail but this custom 
object will not get restored in the inbound Subject.            

LOCAL FIX:                                                      
None                                                            

PROBLEM SUMMARY

USERS AFFECTED:
 IBM WebSphere Application Server users of
OAuth TAI

PROBLEM DESCRIPTION:
com.ibm.ws.security.oauth20.token.impl
export is missing from the file
com.ibm.ws.security.oauth2.jar

RECOMMENDATION:
 Install a fix pack that contains this
APAR.

When using the Oauth Trust Association Interceptor (TAI), you
may see messages like the following in SystemOut.log:
CompoundClass < loadClass
com.ibm.ws.security.oauth20.token.impl.WSOAuth20TokenImpl
failed Exit
java.lang.ClassNotFoundException:
com.ibm.ws.security.oauth20.token.impl.WSOAuth20TokenImpl
WSOpaqueToken W   SECJ5003W: An error occurred while
de-serializing a custom object from the inbound authorization
token.  This does not cause the request to fail but this custom
object will not get restored in the inbound Subject.
An FFDC like the following is produced:
FfdcProvider  W com.ibm.ws.ffdc.impl.FfdcProvider logIncident
FFDC1003I: FFDC Incident emitted on
/opt2/IBM/WebSphere/AppServer/profiles/AppSrv01/logs/ffdc/test_s
erver2_1297b8a0_15.02.02_17.31.23.4156843171133233
607947.txt
com.ibm.ws.security.server.lm.wsMapDefaultInboundLoginModule.log
in 1686
The following may be observed in a trace:
wsMapDefaultI 3   Exception deserializing custom objects.
java.lang.ClassNotFoundException:
com.ibm.ws.security.oauth20.token.impl.WSOAuth20TokenImpl
wsMapDefaultI 3   Successfully deserialized a custom private
object:
{com.ibm.wsspi.security.cred.cacheKey=connectionsProvider-
218271
251, OAuthProvider=connectionsProvider}

PROBLEM CONCLUSION:                                             
The following export is missing from the                        
com.ibm.ws.security.oauth2.jar file:                            
                                                                
com.ibm.ws.security.oauth20.token.impl                          
                                                                
The corresponding import is also missing from the               
com.ibm.ws.runtime.jar file.                                    
                                                                
The export and import have been added.                          
                                                                
The fix for this APAR is currently targeted for inclusion in    
fix packs 7.0.0.39, 8.0.0.11 and 8.5.5.7.  Please refer to      
the Recommended Updates page for delivery information:          
http://www.ibm.com/support/docview.wss?rs=180&uid=swg27004980   


Directions to apply fix:  Fix applies to Editions:
Release 8.5
_x_ Application Server (Express or BASE)
_x_ Network Deployment (ND)
__ Liberty Core
__ Edge Components
__ Developer

Install Fix to all WebSphere installations unless special instructions are included below.

Special Instructions: None

NOTE:
The user must:
* Logged in with the same authority level when unpacking a fix, fix pack or refresh pack.
* Be at V1.4.3 or newer of the Installation Manager. Certain iFixes may require a newer version of the Installation Manager and the Installation Manager will inform you during the installation process if a newer version is required.

The IBM Knowledge Center can provide details, if needed, on the use of the Installation Manager to apply the iFixes.
http://publib.boulder.ibm.com/infocenter/install/v1r4/index.jsp.  Shutdown WebSphere Application Server before applying the iFixes.  Restart WebSphere Application Server after applying the iFixes.

Directions to remove fix:  

The IBM Knowledge Center can provide details, if needed, on the use of the Installation Manager to remove the iFixes.
http://publib.boulder.ibm.com/infocenter/install/v1r4/index.jsp.  Shutdown WebSphere Application Server before removing the iFixes.  Restart WebSphere Application Server after removing the iFixes.

Directions to re-apply fix:  
1) Shutdown WebSphere Application Server.

2) Follow the Fix instructions to apply the fix.

3) Restart WebSphere Application Server.



Additional Information: